Logging DNS queries

[johnpoz]

@Octopuss so your running wireless on pfsense?

These jumped out at me

iwi_monitor: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.

You can get rid of those with setting entry in your loader.conf file

https://forum.netgate.com/topic/78681/error-dmesg-module_register_init-mod_load

From your previous, seemed like you had other APs for your wifi..

just a VLAN where all the wifi devices go, and their APs.

[Octopuss]

@johnpoz said in Logging DNS queries:

so your running wireless on pfsense?

What do you mean?

@johnpoz said in Logging DNS queries:

From your previous, seemed like you had other APs for your wifi..

Yes. I don't understand the question.

[johnpoz]

@Octopuss this looks like some wifi on pfsense

module_register_init: MOD_LOAD (ipw_bss_fw, 0xffffffff807475a0, 0) error 1
ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
wlan: mac acl policy registered
TCP_ratelimit: Is now initialized
Launching APs: 2 3 1

Oh never mind, I don't see those on mine because I had set in loader.conf

[24.11-RELEASE][admin@sg4860.home.arpa]/boot: cat loader.conf.local 
hint.ichsmb.0.disabled=1
legal.intel_ipw.license_ack=1
legal.intel_iwi.license_ack=1
[24.11-RELEASE][admin@sg4860.home.arpa]/boot: 

Never mind - my bad..

[Octopuss]

@johnpoz Yes, we have wifi in the house, two APs. And the internet connection is wifi as well, but I already wrote that - I literally wrote we have an AP on the roof.

[johnpoz]

@Octopuss yeah my bad, those lines jumped out at me that maybe some wifi was actually running on pfsense - and yeah I knew you had said you were running your own AP.

But that is common thing if you hadn't set in loader.conf - my pfsense has zero wifi card even and was seeing those until I set the loader.conf so I didn't see that warning.

Forget I brought it up..

The only thing that comes to mind that not able to listen on a specific interface and its IP is delay in the IP/interface being available when unbound goes to start when you boot. And then when you restart it they are available.

Thought maybe if there was local wifi trying to come up it could delay the availability of the IP when unbound started on boot when you called out specific interfaces to use vs all.

Its a grasping at straws idea.. but you could remove those errors on your boot by adding those entries in your loader.conf.local file

legal.intel_ipw.license_ack=1
legal.intel_iwi.license_ack=1

It is normally good idea to clear up any sort of such errors, because they are really a sort of log spam that can make it harder to spot a specific issue.. I don't see how that could cause the problem - but it would clean up your boot log a bit ;)

[Octopuss]

@johnpoz So if I only leave LAN and localhost in network interfaces, it works after boot. If I add the wifi interfaces, it's kaput.
Why is that I have no idea.

[Octopuss]

@Octopuss said in Logging DNS queries:

@johnpoz So if I only leave LAN and localhost in network interfaces, it works after boot. If I add the wifi interfaces, it's kaput.
Why is that I have no idea.

Ok, no, I was wrong. This forum refreshed but other websites didn't work either.
Nothing makes sense. I either run with DNSSEC enabled or I have to keep in mind to restart the DNS service after every reboot, which I will certainly forget about and when I reboot the thing in several weeks, I will spend several hours trying to troubleshoot why is there no internet.

[johnpoz]

@Octopuss so hmmm.. those are vlan only right.. They are vlans on your lan interface.. So possible delay in those coming up causing the problem.

But I would think if you said bind to lan, wifi and there was a delay in vlan being available it would still bind to the lan IP.. But maybe the vlans is causing a delay and nothing is available when unbound starts other than localhost.

Do you have interfaces where you could bring those up as native on an interface vs being vlan on lan?

If you have more physical interfaces on your pfsense, and your switch you could run those on their own physical nic and uplink from your switch vs being vlans on the lan interface.

I have multiple uplinks from my switch to pfsense, but I also have some vlans on an interface - those vlans don't ever talk to each other anyway.

I could try adding some vlans to my VM and see if I can then duplicate the problem.

edit:

. I either run with DNSSEC enabled

I thought you said if you select all with dnssec disabled it worked?

[Octopuss]

@johnpoz No, the pfSense box only have two LAN ports.
I guess I will just wait for 2.8.0 release and then do a reinstall just to see whether it makes a difference.
For now I'll let it be, it's not going anywhere, plus you are wasting your time troubleshooting something that's not even your problem, and with someone who doesn't know what is he doing.

[MoonKnight]

@johnpoz said in Logging DNS queries:

@Octopuss if your using unbound as resolver - doesn't matter how many IPs you setup in general for dns.. It isn't going to ask those, unless you setup forwarding in unbound.

Unless you set that, then the only thing that could ever use the ones you put in general would be pfsense own dns lookups. And if you left loopback in there 127.0.0.1 it should normally ask it, which would then resolve from roots and your dns servers listed in there would never be asked anything.. Unless your unbound was down and pfsense itself moved to one of the others listed.

@johnpoz
Can I use the same setting like you have in your image when i'm using "Enable Forwarding Mode"
I have been running like this for years:

Disable: "Enable DNSSEC Support"
Disable "Strict Outgoing Network Interface Binding"

System Domain Local Zone Type: "Transparent"

Outgoing Network Interface: WAN and localhost