Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    conditional dns forwarding

    Scheduled Pinned Locked Moved General pfSense Questions
    5 Posts 3 Posters 210 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      michmoor LAYER 8 Rebel Alliance
      last edited by michmoor

      Hello,
      Maybe its late and im lacking sleep but I'm having trouble wrapping my head around how i can make this scenario work.

      pfsense HA cluster running for a special needs school. They have an external DNS service (CleanBrowsing) that's handling the filtering for external domains. The problem they have is that internal domains cannot be reached as DHCP hands out the Clean Browsing DNS servers. The DNS server for clients using the external filtering service is not pfsense. So what the staff does is to log-into PC that is using pfsense as the local resolver to get to internal resources. Obviously, this is not optimal.

      Is there a way to make internal resources available and only forward to the filtering service for external domains?

      Firewall: NetGate,Palo Alto-VM,Juniper SRX
      Routing: Juniper, Arista, Cisco
      Switching: Juniper, Arista, Cisco
      Wireless: Unifi, Aruba IAP
      JNCIP,CCNP Enterprise

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @michmoor
        last edited by johnpoz

        @michmoor setup forwarding in pfsense to whatever the dns is for this cleanbrowsing they use. Then hand out pfsense IP for clients to use for dns.

        If client is looking up some local resource, that will be returned - if looking for something that is not in pfsense dns, then it will be forwarded to this cleanbrowsing NS.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        M 1 Reply Last reply Reply Quote 0
        • M
          michmoor LAYER 8 Rebel Alliance @johnpoz
          last edited by

          @johnpoz The Forwarding under System > General Setup , i suspect is what you are talking about?
          The problem is that there are different profiles configured for filtering.
          So teachers get one set of restrictions while students/classrooms get a different set up filtering.

          Firewall: NetGate,Palo Alto-VM,Juniper SRX
          Routing: Juniper, Arista, Cisco
          Switching: Juniper, Arista, Cisco
          Wireless: Unifi, Aruba IAP
          JNCIP,CCNP Enterprise

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @michmoor
            last edited by johnpoz

            @michmoor yeah that not going to work then. Because you have a shared cache.

            How do the teachers get a different profile - do they point to a different IP for dns than say the students get?

            What you could do is say run the dnsmasq (forwarder) along with unbound in forwarding mode - just run 1 on different port.. So say kids user the normal pfsense IP for dns. But say teachers point to the cleanbrowsing IP, but you redirect that to dnsmasq port via dns redirection, which then looks up local records and then forwards to the other cleanbrowsing IP.

            Now you have different caches one in dnsmasq, one in unbound. Could be done with the bind package as well.

            Or if you have a place you could run a different NS, you wouldn't have to use the port redirection thing and different port. Or have to look you might be able to setup a vip or use a different lan side interface to listen on for the other NSer running on pfsense.

            I assume you have different lan side interfaces? You could have unbound listen on 1 and dnsmasq listen on different one.. And then use those IPs to hand out to your clients and depending which one they use they would use either student clean browsing or teacher cleanbrowsing.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Mmm, if it's account based are they using a local AD server or similar?

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.