Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS shows wrong (maybe old) entry

    Scheduled Pinned Locked Moved DHCP and DNS
    10 Posts 3 Posters 201 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      NetRunner8050
      last edited by

      Hello folks,

      I have a strange problem.

      My DNS shows a wrong lookup for the internal address and I can't find where to delete it.

      The address I want to resolve is as follows: edgerunner.xxx.xxx

      My DNS configuration looks like this:
      d80ec203-e67d-4861-a70f-1c22d0f272ee-image.png

      And the DNS on my firewall shows the following entries:
      10.1.4.1 (that would be correct)
      10.1.2.1 (that would be incorrect)
      86cad947-13bc-4101-85eb-6667c2f84457-image.png

      This of course leads to very long loading times as it first queries the wrong one. Now I wanted to delete the wrong entry. I have done the following:

      • Restarted the DNS resolver service
      • Entered the following command in the command line: unbound-control -c /var/unbound/unbound.conf reload

      However, when I now query the DNS cache of my PFsense with the following command:
      unbound-control -c /var/unbound/unbound.conf dump_cache
      I do not see this entry anywhere.

      Can anyone help me?

      GertjanG 1 Reply Last reply Reply Quote 0
      • GertjanG
        Gertjan @NetRunner8050
        last edited by

        @NetRunner8050 said in DNS shows wrong (maybe old) entry:

        nbound-control -c /var/unbound/unbound.conf dump_cache

        Don't worry, none of my local host overrides can't be found in the DNS cache neither.
        They are here :

        cat /etc/hosts
        

        No "help me" PM's please. Use the forum, the community will thank you.
        Edit : and where are the logs ??

        N 1 Reply Last reply Reply Quote 0
        • N
          NetRunner8050 @Gertjan
          last edited by NetRunner8050

          @Gertjan said in DNS shows wrong (maybe old) entry:

          /etc/hosts

          Okay Thanks for the reply!

          I deleted it from etc/hosts and restarted the unbound service but its still there. What else could I do?

          Edit: After the reboot of unbound it came back, where does this come from?

          GertjanG 1 Reply Last reply Reply Quote 0
          • GertjanG
            Gertjan @NetRunner8050
            last edited by Gertjan

            @NetRunner8050 said in DNS shows wrong (maybe old) entry:

            I deleted it from etc/hosts and restarted the unbound service but its still there. What else could I do?

            Edit: After the reboot of unbound it came back, where does this come from?

            No need to edit that /etc/hosts file, as it is regenerated with your settings every time unbound (re)starts.

            For me, the first 2 lines in that file are the local host :

            127.0.0.1       localhost localhost.bhf.tld
            ::1     localhost localhost.bhf.tld
            

            Then :

            192.168.1.1     pfSense.bhf.tld pfSense
            2a01:cb19:907:dead:beef:fe29:392c  pfSense.bhf.tld pfSense
            

            and all the others are my static DHCP leases (bottom page DHCP server settings), and host over rides (bottom part resolver settings).

            Are you using :
            7c1174c8-dcd2-4b26-a190-8534c2d85038-image.png

            ?

            No "help me" PM's please. Use the forum, the community will thank you.
            Edit : and where are the logs ??

            N 1 Reply Last reply Reply Quote 0
            • N
              NetRunner8050 @Gertjan
              last edited by

              @Gertjan
              No I dont use this option:
              5926234a-d50c-423a-9a90-3c4cb96a3881-image.png

              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @NetRunner8050
                last edited by Gertjan

                @NetRunner8050

                You have these two IPs:

                2438cba0-44e7-45bb-aacb-031d7587be90-image.png

                in your host file ?
                Again : if they are there, then that's because they are in you pfSense config some where.
                Afaik : host overrides and DHCP static leases.

                The order I saw is :
                First, the first 2, or 4, as mentioned above.
                DHCP4 static leases, one interface after the other.
                DHCP6 static leases, one interface after the other.
                At the end : hosts over rides from the Resolver page.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                N 1 Reply Last reply Reply Quote 0
                • N
                  NetRunner8050 @Gertjan
                  last edited by

                  @Gertjan

                  Those addresses are my gateway addres for the specific network.

                  Maybe I should mention that the domain is my "internal domain" and also local zone.

                  Yes I got those in my Hosts file:058f34bd-c04f-4d9c-b587-ba490cbed76c-image.png

                  But I dont get this in my Host Override config
                  f568f429-d776-4ef4-a3a3-ba3df2b44239-image.png

                  Nothing in my DHCP leases (I dont use IPv6)
                  12bf54f2-1bae-43fa-a129-c1d6c55af34a-image.png

                  There are no DHCP static mappings or anything.

                  But they are in the /var/unbound/host_entries.conf
                  4ab49e36-c703-425d-8a27-5a670046058f-image.png

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    NetRunner8050 @NetRunner8050
                    last edited by

                    I figured it out.

                    It was because my Firewall was named edgerunner and my domain was the xxx.xxx Domain and my LAN interface had the IP 10.1.2.1 it mapped edgrerunner to the IP.

                    My solution now was to rename the firewall.

                    Then I got the potential DNS Rebind attack error and had to add the alternate Hostname in System-> Advanced.

                    Thanks for the help!

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • GertjanG
                      Gertjan @NetRunner8050
                      last edited by Gertjan

                      @NetRunner8050

                      This :

                      9305d78d-7472-48a8-ad1a-7f41560669b3-image.png

                      comes from this :

                      1add95d0-c6d2-479c-b198-510f6b30f6f6-image.png

                      edit : Ok, you have found that also.

                      No "help me" PM's please. Use the forum, the community will thank you.
                      Edit : and where are the logs ??

                      1 Reply Last reply Reply Quote 1
                      • JonathanLeeJ
                        JonathanLee
                        last edited by

                        Have you inspected the config.conf file to see if it is listed on that and boots with it?

                        Make sure to upvote

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.