How to setup split DNS & SubDomain in pfsense DNS forwarder

[sbs]

HI,

I have the following setting :

pfsense dns resolver is active and handles split DNS for corp.com between internet and corporate AD.
IE there is a domain override rule in dns resolver corp.com <dnsserver IP on AD LAN>

I am setting up a separate LAN on a separate NIC. I use pfsense DHCP to provide LAN info to this net.
Is there a way to split dns so that sublan.corp.com can be a delegated domain in AD DNS servers and have pfsense provide answers to dns queries using dhcp host names on LAN2 NIC.

I have tried to domain override sublan.corp.com to pfsense IP (both on LAN1 and LAN2 ip), but it does not work.

[johnpoz]

@sbs said in How to setup split DNS & SubDomain in pfsense DNS forwarder:

I have tried to domain override sublan.corp.com to pfsense IP (both on LAN1 and LAN2 ip), but it does not work.

Who is going to be authoritative if you will for these sublan.corp.com records. Is pfsense going to hold the records you want to resolve or is your AD dns?

If you want your AD dns to answer for host.sublan.corp.com domain this would just be another domain override pointing to the same AD NSers.. You will also want to mark this domain as private as well - because any time you forward and the answer is rfc1918 that would be a forward.

You could also just create records in unbound for host.sublan.corp.com if you want them to resolve..

[sbs]

@johnpoz said in How to setup split DNS & SubDomain in pfsense DNS forwarder:

@sbs said in How to setup split DNS & SubDomain in pfsense DNS forwarder:

I have tried to domain override sublan.corp.com to pfsense IP (both on LAN1 and LAN2 ip), but it does not work.

Who is going to be authoritative if you will for these sublan.corp.com records. Is pfsense going to hold the records you want to resolve or is your AD dns?

I intend to use pfsense as authoritative for sublan.corp.com.

If you want your AD dns to answer for host.sublan.corp.com domain this would just be another domain override pointing to the same AD NSers.. You will also want to mark this domain as private as well - because any time you forward and the answer is rfc1918 that would be a forward.

I want AD Dns to use sublan as a stub or copy of the domain infos provided by pfsense for the sublan

You could also just create records in unbound for host.sublan.corp.com if you want them to resolve..

Since I use pfsense DHCP server on sublan, I would like that dhcp hosts on SUBLAN can be looked up from the AD DNS.

Is this possible?

[johnpoz]

@sbs said in How to setup split DNS & SubDomain in pfsense DNS forwarder:

hosts on SUBLAN can be looked up from the AD DNS.

yeah that would just be a conditional forwarder you setup on AD dns. Or where does your AD go when its looking for say www.google.com - if it already forwards to pfsense that that should arleady work, anything that AD dns does not think its authoritative for should be forwarded or resolved.. If forwarding to pfsense then it should already work for sublan - the only thing is since its authoritative for corp.com - it might not forward for sublan.corp.com because there has been no delegation or conditional forwarder setup.

I personally prob wouldn't set it up this way.. Might be easier to just setup say corp.net or corp.lan or .org or even better maybe corp.home.arpa as your other domain.. vs making it a sub of your already split dns..

Not a fan of splitting internal resolution with external resolution.. Back in the day we would always setup .com for all our external resolving records, and our AD used .net - so that they were always sep..

[sbs]

@johnpoz I agree that splitting again is probably overcomplicating things. But I have the feeling it's easier to tell user.
You domain is corp.com and when you go to sublan then you are sublan.corp.com.

However before settling on using a subdomain or a completely separate domain, I am under the impression something is wrong in my setup.

If I nslookup and set pfsense as server, it resolves google.com and corp.com hosts, but it does not resolve any sublan.corp.com host. Did I miss an important setting in my kea dhcp?

(I did not find the update dns for each dhcp lease checkbox, in the settings, so I can't confirm it is checked as it should)

[johnpoz]

@sbs said in How to setup split DNS & SubDomain in pfsense DNS forwarder:

Did I miss an important setting in my kea dhcp?

kea does not support static or dhcp reservations as of yet.. If that is how your wanting to add hosts.. Kea is preview version - there was blog and release notes on what features are missing, which is most of them.. Kea is only really viable if you just want to hand out IPs and not doing anything with them or any sort of dhcp options.

[sbs]

@johnpoz Thank you for the feed back.

I wish this was as clearer in pfsense settings:

where it looks to me that KEA is the way to go NOW.

Is the "blog and release notes", your refer to : Netgate Adds Kea DHCP to pfSense Plus Software Version 23.09 ?

It looks like the dhcp clients registration in the resolver should be working.

Regards,

[johnpoz]

@sbs said in How to setup split DNS & SubDomain in pfsense DNS forwarder:

It looks like the dhcp clients registration in the resolver should be working.

Where would you have gotten that idea?

Yes the notification of eol could of been worded better, nobody is disagreeing with that.. But then again reading the release notes are something you should really do when upgrading.

[sbs]

@johnpoz
/me facepalms.
Sorry for not reading the "Basic functionality present in 23.09" sentence all the way to the end.

I usually look at the release notes before running the upgrades. But in this case the combination of :

• 2.7.0 not suggesting upgrade to 2.7.2
• HD Crash leading to fresh install from freshly downloaded 2.7.2
• Configuration restore
• Got deprecation warning at start-up, followed the advice.

did not help.

I guess we can now close this question with a will work later on when kea implements DHCP-> DNS resolver updates.

Thank you very much for your help.