How to access pfsense machine fully qualified domain name in local network

richardsago

Good day. I'm attempting to follow the instructions on setting up acme let's encrypt and on 50 minutes 15 seconds from netgate's youtube video "Let's Encrypt on pfSense" (https://www.youtube.com/watch?v=h7Rlru3agdA) the instruction was that pfsense must be accessible in the network by hostname. I think I followed the speaker's setup by going to "System" > "General Setup" and changing "Hostname" and "Domain"

I set the two information above to be the same value as set in the hostname + domain in "Services" > "Acme Certificates" > "Certificates":

The TXT value has been set in the dns provider:

This certificate has passed issue and renew steps under "Services" > "Acme Certificates" > "Certificates":

But I can't access pfsense by its hostname + domain name in the network:

pfsense can still be accessed using IP Address:

The youtube speaker gave alternative of adding host override but I did not do this because we have two WAN and I don't know which IP address I need to set in "Services" > "DNS Resolver" > "General Settings" > "Host Overrides"

In case useful this is WAN1:

This is WAN2:

Please let me know what I'm doing wrong so that pfsense's hostname can be accessible in the local network while making sure pfsense is not accessible through the internet. Thank you in advance.

Gertjan

@richardsago said in How to access pfsense machine fully qualified domain name in local network:

But I can't access pfsense by its hostname + domain name in the network:

Get a command line.
Type

nslookup

what do you see ?

Type

ipconfig /all

Who is the DNS your PC is using ?

Your Librewolf, what DNS is it using ?
My browser shows me this info :

and guess what is the default setting ? Sure enough, not the one I picked manually : "Use default Resolver".
If Librewolf was asking pfSense for this "hostname+domain", it would get the correct answer. Only pfSense has this answer.

richardsago

Thank you @Gertjan for the reply. Running nslookup on my PC result in this:

Result of ipconfig /all:

This is my browser's DNS setting:

My hunch is I need to add host override in DNS Resolver and in that entry's IP Address I need to add all my pfsense VLAN top IP address (separated by commas) because they all point to pfsense. Will this solve my problem? And will this solution still prevent my pfsense from being accessed through the internet? <-- I would like to access my pfsense using its hostname in my local network, but I don't want my pfsense to be accessed through the internet.

Gertjan

@richardsago

With

your browser will never find the IP of hostname + domain name (the host name of pfSense).

You have to check :

"Use your default Resolver".

Is that your LAN IP ?

richardsago

Thank you @Gertjan for the reply. I can now access the fully qualified domain name of pfsense in the local network. It looks like there's a delay between setting "Hostname" and "Domain" in "System" > "General Setup" and being able to access its FQDN in the local network.

luckman212

@richardsago Not aware of any such delay on pfSense's side. More likely your system or browser's local DNS cache. I personally despise the ham-fisted attempts by these browsers that add complexity to a battle-tested system like DNS. I understand it's trying to ~~protect people~~ (show ads?) but no thank you, I'd rather control my own DNS. I have rules to try to block DoH/DoT and also emit the option to try to signal the browsers not to enable it:

server:
local-zone: "use-application-dns.net" always_nxdomain

from https://docs.netgate.com/pfsense/en/latest/recipes/dns-block-external.html#dns-over-tls

johnpoz

@luckman212 agree if you want to offer doh, sure ok - but it should be an opt in setup.. The problem is if it was - nobody would be using it.

Gertjan

@richardsago said in How to access pfsense machine fully qualified domain name in local network:

It looks like there's a delay between setting "Hostname" and "Domain" in "System" > "General Setup" and being able to access its FQDN in the local network.

As soon as you enter :

and Save at the bottom of the page "System > General Setup" world’s most know file file /etc/host is created.
Don't take my words for granted, please check for yourself : change hostname for an instance, like add an "x" and save.
Now look at the file, the first 3 lines :

( now remove the 'x' you have added, and Save, and check again )

This /etc/hosts file will be read and used by Unbound, the resolver.
The moment you set up, or change the pfSense hostname and domain, the unbound resolver will be aware of this, as it will get restarted with the most recent, pfSense GUI settings.

@luckman212 said in How to access pfsense machine fully qualified domain name in local network:

I understand it's trying to protect people (show ads?)

No, imho, way more basic : it does "what they all do" : they (browser authors) want your DNS requests, as that has a value ($ or €) for them.

but no thank you, I'd rather control my own DNS

That's a big one
You - we all, actually - can only control something, if we master it (humm, I presume you get my point here).

Gertjan

@johnpoz said in How to access pfsense machine fully qualified domain name in local network:

but it should be an opt in setup. The problem is if it was - nobody would be using it.

depends how they would ask / explain it I guess.
Like, when installing a new browser :

Hi there, welcome, new user, do you want to use our very safe DNS, or do you want to use the DNS source that is offered by your local gateway/firewall ?

( No need to add the following : This so called local DNS is controlled by your father, older brother, the big boss or anyone else you never ever want to give your DNS requests to - right ? )

What will the "I don't no sh*t about DNS average user" answer ? They will chose the safe DNS. And I can't really say that they did anything wrong. The big brother commecail DNS might seem more 'save' (or should I say anonymous ?) as a local supplier ... or the ISP as a DNS supplier, as for some reason nobody trusts the ISP DNS these days anymore.
I'm still blocking DoH/DoT also with the pfBlockerng option, as permitting it (= default) will fail all the legacy captive portal users (read : the android devices). My pfSense exposes a captive portal, and iwhen the DNS gets bypassed, the browser's (or OS) portal detection will fail.
I also prefer, by far, the DNSSEC capabilities of the unbound resolver, as, imho, its way better to know if my own resolver says "It's ok" as that '8.8.8.8' (does also do DNSEC afaik) or some other commercial DNS server says : 'It's ok'.
After all : when DNS gets spoofed, we can all say goodbye to our security models, as all our OS's (Windows Linux, whatever will start to 'update:upgrade' against 'unknown' upgrade/update servers .... and minutes later it's game over.
Extra info : when DNS goes wrong (spoofed), things like 'certificates' (TLS) become useless.

@richardsago : you obtained your acme certificate ?
Normally, you shouldn't use the 'manual DNS' method, as it's tedious.

tinfoilmatt

It became clear a while ago now that vendors/service providers stand to gain the most from DoH implementation, not end users.

luckman212

@Gertjan Yup. An interesting problem indeed. I propose this draft RFC RFC 9666: Method for Efficient Selection of DNS Resolution

patient0

@luckman212 said in How to access pfsense machine fully qualified domain name in local network:

I propose this draft RFC RFC 9666: Method for Efficient Selection of DNS Resolution

Finally a RFC I understand :)

richardsago

Thank you all for the replies. @luckman212, @Gertjan I forgot about clearing browser cache and will try to remember this in the future for similar problem.

Normally, you shouldn't use the 'manual DNS' method, as it's tedious.
@Gertjan my DNS-cPanel certificate did not work yet so I thought to make DNS-Manual work first, then make captive portal work, before coming back to make DNS-cPanel work.