DNS Resolver connection issues
-
Running 26.03.1-RELEASE on my own hardware
Woke up this morning and noticed that internet was down on my phone. After investigating, I found that serveral of my devices were having DNS issues.
Rebooted pfSense and the issue persisted.
Changed DNS in the General Setup - Nothing
Added DNS servers to the DHCP servers - Nothing
Turned off DNS Resolver and everything started working again.I haven't touch this configuration in ages, so I am curious to what happened. Did a my DNS provider go down?
Would appreciate if you wizards can look at the settings and tell me if they are set correctly. If I turn DNS resolver on, I get "No Internet" messages which are likely due to DNS issues.
-
@hypnosis4u2nv Your current settings configures the DNS on pfsense to send all DNS it recieves to the DNS servers your have either statically configured on your SYSTEM -> GENERAL page, or to the DNS servers pfSense learned if you are running DHCP on your WAN.
The trick is it’s supposed to send it to those using DNS over TLS (your configuration says so), so it requires those server to run DNS over TLS. IF they do not… No DNS.THere can be good reasons to use forwarding with DNS over TLS (Prevent eavesdropping from your ISP), but it also requires your pfSense’s own DNS servers to be configured statically so you know exactly where you are sending those requests.
Try and disable “Enable Forwarding mode” and see if things start working again. That would show that the problem is with the servers or your configuration you are forwarding to.
-
Some troubleshooting:
Disabled DNS Query Forwarding and DNS resolver seems to be working again.
My DNS settings in the General Setup:
Edit: @keyser I wrote this before seeing your reply. I guess I'm on the correct path
-
@hypnosis4u2nv For troubleshooting yes. But I expect you have that config because of eavesdropping prevention from your ISP?
That probably also means you would like it to work again?I have seen repeated problems with DNS over TLS if you have any Quad9 servers in the list as they do throtteling at times - which at least my onbound/pfsense does not seem to like very well. I have no idea if your other providers could cause similar issues
Guess what I’m saying is: try with “just” cloudflare in the list. They have the best service, so It would show you if the other providers are causing issues
EDIT: I can see you are using surfsharkDNS over an OPT7 interface which i Assume is som VPN of sorts. Thats probably your culprit. Either their service or your VPN.
-
@keyser You could be right, this was never an issue until now. Although, would it not fall back to cloudflare at 1.1.1.1 if failed since they are both set on the same interface?
And yes, trying to avoid Google if possible.
-
@hypnosis4u2nv said in DNS Resolver connection issues:
@keyser You could be right, this was never an issue until now. Although, would it not fall back to cloudflare at 1.1.1.1 if failed since they are both set on the same interface?
And yes, trying to avoid Google if possible.
It should yes, but I have convinced myself that it not do failover as expected all the time (at least thats what I have experienced). It might be related to the fact that in order for that to work it first has to do normal (UDP 53) name resolution of the DNS servers it should use for DNS over TLS, and perhaps that is causing problems?
Hmm, come to think of it: That would probably require the Preferred DNS settings on the General page to be set to “Use Remote, ignore localhost” - otherwise that would cause a catch 22…
EDIT: Then again no, since you have both provided the IP and the name, there is no need to resolve it.
-
@keyser I have that set to default, use Local DNS and Fallback to Remote DNS Servers.
Should I enable Enable SSL/TLS Service?
disable Use SSL/TLS for outgoing DNS Queries to Forwarding Servers?
-
@hypnosis4u2nv I just have a question. What are you using as your outgoing network interface if you don’t have WAN selected?
Going to give my two cents on your resolver issues, but after reviewing the docs , forwarding configuration became confusing. It looks like it’s changed from what I remember. (I resolve).
One thing I did notice is you can uncheck DNSSEC. That is just for unbound resolving. If you are forwarding your forward DNS servers already have that enabled. -
@Uglybrian Good catch, never noticed WAN wasnt selected. SURFSHARK interface was only selected. I disabled DNSSEC.
-
I did some reconfiguring:
General Setup -> DNS
- Dropped Quad 9 as per suggestion from @keyser
- Added 1.0.0.1 in its place
- Changed the hostname for Cloudflare to 1dot1dot1dot1.cloudflare-dns.com (Not sure if my original hostname of cloudflare-dns.com was valid)
DNS Resolver -> General Settings
- enabled SSL/TLS Service
- enabled DNS Query Forwarding
- disabled DNSSEC @Uglybrian
- added WAN to Outgoing Clients @Uglybrian
DHCP Server -> Interface
- removed DNS entries
Ran a DNS leak test and DNS is routing to Cloudflare and no "No Internet" issues popping up.
-
@hypnosis4u2nv said in DNS Resolver connection issues:
disabled DNSSEC
Just a note that this needs to be disabled, if forwarding:
https://docs.quad9.net/Setup_Guides/Open-Source_Routers/pfSense_%28Encrypted%29/#:~:text=Disable%20Enable%20DNSSEC%20SupportThe default is enabled, and it worked for a long time, until a couple years ago when we had to disable it everywhere. I don't recall which update now unfortunately.
-
@SteveITS Thanks for chiming in. After the suggestion that I turn it off (I don't know how or when it was turned on) I looked up in the docs and there's a note to turn it off whether forwarding is enabled or not. As such, I won't delve into whether it's useful or not.
Not sure if it was that setting that caused the issue, or something borked with the DNS entries, specifically the hostnames I had entered, and the DNS could not resolve correctly. I will point out that the cloudflare hostname you gave as an example in the documents isn't the same one that I got after searching for cloudflare dns hostname. It also could have been an issue with the Quad 9 dns entry, probably their Malware protection kicking in for some reason.
Privacy Policy · Cookie Policy