static dns?

jhmc93

Hello,
I have the DNS setup in my pfsense pointing to my pi hole instance, but on some test machines I'd like to set a static DNS on the individual machine, when I do currently it doesn't allow internet connection...
Can someone help?
regards

SteveITS

@jhmc93 Can you provide details? Which DNS server is set where, DNS lookup results, firewall rules etc.

jhmc93

@SteveITS So my DNS on pfsense is pointing to my pihole instance... "192.168.0.*"

I want my test machine to point to google dns "8.8.8.8" but when I do that it drops the internet connection...

also when I get my DNS via DHCP is it possible for it to show where it's going instead of it showing the pfsense gateway IP...

johnpoz

@jhmc93 you can set dhcp to hand out specific dns, it defaults to pfsense IP on the interface dhcp is running on.

If you want your clients to use your pihole, it prob best to hand that out to them via dhcp vs pfsense IP.

I use pihole on my network as well, clients all point to pihole IP for dns, pihole then forwards to pfsense.. This allows to resolve local resources pfsense has dns entries for, and then pfsense resolves anything public.

Do you have any firewall rules that block dns or redirection setup.. Unless you have firewall blocking or some redirection going on, any client should just be able to query any dns they want.

simple test from your test machine with nslookup or dig or any other dns tools would allow you to query whatever dns you want. Unless you were blocking or redirecting at pfsense.

example

$ dig @8.8.8.8 www.netgate.com

; <<>> DiG 9.16.50 <<>> @8.8.8.8 www.netgate.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29473
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.netgate.com.               IN      A

;; ANSWER SECTION:
www.netgate.com.        60      IN      CNAME   1826203.group3.sites.hubspot.net.
1826203.group3.sites.hubspot.net. 120 IN CNAME  group3.sites.hscoscdn00.net.
group3.sites.hscoscdn00.net. 300 IN     A       199.60.103.30
group3.sites.hscoscdn00.net. 300 IN     A       199.60.103.226

;; Query time: 81 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Apr 14 07:38:34 Central Daylight Time 2026
;; MSG SIZE  rcvd: 160

edit:
Are you using pfblocker - I recall something about some list(s) on pfblocker blocking 8.8.8.8 for example

jhmc93

@johnpoz even when I set the DNS as 8.8.8.8 on windows it does not have an internet connection...
firewall rules I don't think so...
How do I change DHCP server showing gateway address as my DNS on machines?

johnpoz

@jhmc93 said in static dns?:

DNS as 8.8.8.8 on windows it does not have an internet connection...

can you even ping 8.8.8.8 ?

Are you using pfblocker, are you using a vpn?

As to changing what dhcp server hands out

But I wouldn't change that until you figure out why you can't just query any dns you want.. Where does your pihole point to for dns?

jhmc93

@johnpoz so I'm using surfshark VPN on my connection... Would that have an effect on it?, also pfsense can it hand out the subnet mask i.e when u go to change it windows on some routers it auto fills the subnet mask

johnpoz

@jhmc93 yeah you can set dhcp server to be a different mask then standard /24 if you want your network to be say a /23 or a /25 or something.

Yeah windows will guess to what mask you want for setting an IP, but you can put in the actual mask you want.

And yeah its quite possible a vpn could block dns to other than what they provide.. There were some threads a while back where nord was intercepting dns, they prob still are. But yeah its quite possible a vpn could mess with that traffic.

Keep in mind the dhcp server will use the mask you set on the actual interface.. If that is /24 then /24 would be handed out, if its a /26 then that is what would be handed out.

edit: you wouldn't hand out a via dhcp a different mask then what your network is.. If you set your interface in pfsense to be a /26 network, you can't hand in dhcp a /27, etc.. But you can set the range of IPs that dhcp would hand out.. Notice in my screen shot I only hand .110 to .130 vs the whole .1 to .254 range. Of the /24 I use on my lan

jhmc93

@johnpoz can u set a firewall rule for the DNS to bypass the vpn?

johnpoz

@jhmc93 you could sure, this would be a policy route..

https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

jhmc93

@johnpoz so how would I go about doing that in pfsense

stephenw10

Sending general traffic via a different route to DNS queries is exactly what causes issues with some sites though. Just so you're aware. Anything that tries to detect VPN use will likely see that and block your traffic.

johnpoz

where that can become problematic is when your vpn exit is different region than your normal connection. So your dns happens in region A for example and returns the IP for the resource in region A.. But your vpn exit point is in region B.. And the resource access in region A doesn't like that the IP accessing it is region b.

Resources that limit access by region prob be most likely to have issues with this.. Say streaming services where they filter access by region.

Just something to keep in mind if you notice your having issues with say netflix or something.

johnpoz

@jhmc93 said in static dns?:

so how would I go about doing that in pfsense

what part do you not understand from the link.. Your vpn connection is setup on pfsense right, if your doing something on a client for vpn pfsense can not control that..

jhmc93

@johnpoz Apologies, still a newbie when it comes to pfsense, had a lot of guidance with my setup..

stephenw10

It's kinda surprising you can't just connect to 8.8.8.8 through the VPN to be honest.

If you had assistance setting it up perhaps your assistant added a rule to redirect or block other DNS queries? That would be quite common to prevent 'dns leaks'.

johnpoz

As @stephenw10 mentions not being able to do dns to anywhere from any client behind pfsense would not be an out of box sort of thing.

So you are either blocking/redirecting it causing the problem, you are routing all traffic out a vpn that is messing with it. Or you have say pfblocker with some lists, and one of the lists is blocking 8.8.8.8 (it has been seen before)

Can you even ping 8.8.8.8? Lets see your query, what sort of response do you get? timeout, nx, servfail?