DNS Resolver doesn't work

Gertjan

You should do the test on a device that is attached to the pfSense LAN.

Example : on windows PC :

nslookup www.google.com

example :

C:\Users\Gauche>nslookup www.google.com
Serveur :   pfSense.bhf.tld
Address:  2a01:cb19:dead:beef:92ec:77ff:fe29:392c

Réponse ne faisant pas autorité :
Nom :    www.google.com
Addresses:  2a00:1450:4006:80c::2004
          142.250.200.196

Btw : "2a01:cb19:dead:beef:92ec:77ff:fe29:392c" is my pfSense LAN IP.
Also known as "192.168.1.1" in the old days.

orphen76

@Gertjan said in DNS Resolver doesn't work:

nslookup www.google.com

nslookup www.google.com
Server: UnKnown
Address: 103.86.96.100

Risposta da un server non autorevole:
Nome: www.google.com
Address: 192.0.0.88

Gertjan

@orphen76 said in DNS Resolver doesn't work:

Address: 103.86.96.100

Who is that 103.86.96.100 ?
Not your pfSense, right ?

What was the DNS IP your PC got from pfSense (see the ipconfig /all command shown above )?
More something like 192.168.1.1, right ? wrong ?

edit : anyway, your PC got an answer : 192.0.0.88 so that must be Google. That's all a browser needs to connect to 'Google : that IP.
The thing is : that IP is, IMHO, not Google ...

johnpoz

@Gertjan said in DNS Resolver doesn't work:

The thing is : that IP is, IMHO, not Google ...

hahaha - yeah I would concur.. that is not google ;) hehah

stephenw10

That's a NordVPN DNS server. So your client might be using a VPN dircetly. Or you might have added it to pfSense etc....

Gertjan

@stephenw10

He ? what ? where is nordvpn coming from ?

johnpoz

If nord is involved yeah I would say your dns is borked.. They started intercepting a while back, per other threads..

That 103 address is a packethub IP.. But as so eloquently stated by @Gertjan 192.0.0.88 is not google.. hehehe, still giggling.. Love it!

stephenw10

https://www.reddit.com/r/nordvpn/comments/13ii3zk/nordvpn_dns_servers_resolve_googlecom_into_a/

Gertjan

@johnpoz said in DNS Resolver doesn't work:

would say your dns is borked.

Wasn't NordVPN intercepting 'all DNS' requests as seen in some recent forum threads ??
And now it is replying with Pure-BS ?!

@stephenw10 Don't need to go that far, we've got all the resources on board : https://forum.netgate.com/topic/186580/dns-suddenly-broken-on-some-vlans/60?_=1726676960650

johnpoz

@Gertjan yeah they were intercepting all dns from test had one user do, they were getting answer from 1.2.3.4, which sure and the hell is not providing dns.. So right there is smoking gun that interception and redirection is happening.

I wouldn't trust those idiots with anything.. VPN service intercepting something as basic as dns is not what they are suppose to be about.. Most people use a vpn to make sure their isp isn't seeing or intercepting their dns..

orphen76

@stephenw10 yes sory on a host.
below from a clean host:

nslookup www.google.com
Server: UnKnown
Address: 172.16.24.1

johnpoz

@orphen76 said in DNS Resolver doesn't work:

Server: UnKnown

that points to a problem to be honest, is that not pfsense? pfsense should always be able to resolve its own name.

Gertjan

@orphen76 said in DNS Resolver doesn't work:

Address: 172.16.24.1

That is your pfSense LAN IP, right ?

And no answer came back ?

Can you post your LAN firewall rules ?
Like :

Unbound is listening on the LAN interface ?
Like :

orphen76

@Gertjan ![alt text]
Hi,
below

Gertjan

@orphen76

Thanks.
I've added to the mix : queues and scheduled rules ....

I hope Google translate will do the job :

Backup your pfSense config. So from now on, you can go back the what you have right now.

Then : console menu option 4 - Factory defaults.

From now on, you have to respect one rule : change only the admin password. Change nothing else.
I make a special note for DNS : don't remove add change anything. Out of thne box, the resolver works just fine.

Do some testing and conclude that everything works fine.

Now, you have a choix :
Import the backed up config. And then goto here, as you're back to square one.
Or : add your own changes one by one, each step separated by extensive testing.
As soon as you detect that something 'fails', you know where it went wrong.

orphen76

@johnpoz the firewall router to which the workstation from which I ran the command is connected is pfsense