Authentication Method DNS question

Laxarus

I have noticed this issue but I am not sure if this is a bug, oversight or something else

My current environment is a windows domain environment where DNS, DHCP are managed by the domain controllers.

pfSense uses DHCP relay, and DNS Resolver (forwarding mode to dns servers (Cloudflare) defined in the pfsense general settings.)

Windows DNS Server acts as a forwarder to the pfSense Resolver for public dns queries
so it goes like this
Client > Windows DNS > pfsense resolver > cloudflare

When testing my LDAPS auth in pfsense I have to use a FQDN so it needs to resolve the hostname of the Windows DNS Server for SSL/TLS. There is no option in the auth methods to ignore verification.

However, after hours of troubleshooting I found out that pfSense cannot resolve that local Windows DNS FQDN and there is no option to use an alternative DNS Server.
I imagine pfSense tried to resolve my local DNS Server FQDN via cloudflare and as expected failed.
Only after I added a record in the pfSense resolver, it did start to work properly.

I would have appreciated a note about this on the "auth servers" page or a field to define a custom dns server before spending hours on it for troubleshooting.

Any thoughts, inputs on this?

bmeeks

Use a Domain Override in the DNS Resolver settings on pfSense. Domain override values tell the Resolver on pfSense which DNS server should answer queries against that particular domain.

So, in your case, configure a Domain Override in pfSense under DNS Resolver in the menu and provide the domain name and the IP of your authoritative Windows DNS server(s). That way, whenever pfSense is looking for a host in your internal Windows domain, it will go and ask your Windows DNS server(s). For all other domains, it will go ask Cloudflare since you have them configured as the forwarder.

Don't forget when configuring the Domain Override to also configure the appropriate reverse PTR setting so that pfSense can do reverse PTR lookups against your Windows DNS if necessary.

Here is a link to the pertinent documentation page: https://docs.netgate.com/pfsense/en/latest/services/dns/resolver-domain-overrides.html.

In effect, Domain Overrides are the way you configure "alternative DNS servers" for certain domains.

johnpoz

@Laxarus said in Authentication Method DNS question:

When testing my LDAPS auth in pfsense I have to use a FQDN so it needs to resolve the hostname of the Windows DNS Server for SSL/TLS. There is no option in the auth methods to ignore verification.

That is pretty specifically gone over in the doc..

https://docs.netgate.com/pfsense/en/latest/usermanager/ldap.html

Also mentioned in that, is you could always just add a IP SAN to your cert..