DNS Forwarder in pfSense 2.2
-
Would it still be possible to use DNS Forwarder in 2.2 instead of Unbound (in case I rather have the simplicity instead of security)?
-
Yes, both are available. Upgraded systems stay with the DNS Forwarder, only new configs get DNS Resolver/Unbound by default.
-
which should we be using ??
-
Which ever one best suites your needs/wants.. Not sure I understand the question.. So you have a hard time picking between chocolate and vanilla I take it ;) Baskin-Robbins 31 flavors must make your head explode ;) heheheheeh
-
wifiuk is asking a reasonable question - since it seems that the DNS Resolver (i.e. unbound) offers all of the features of the DNS Forwarder and is now the default for new installations, I would guess that at some point in the future support for the DNS Forwarder will be dropped?
Let's put the question to the forum in another way: Is there any reason or advantage to using the DNS Forwarder instead of the DNS Resolver?
-
" Is there any reason or advantage to using the DNS Forwarder instead of the DNS Resolver?"
Yeah you want to use the forwarder, you don't like chocolate (unbound) and are use to an like to use dnsmasq (vanilla)
Might as well discuss why he doesn't install bind vs using unbound - which is another option lets call that one strawberry ;) They all have slightly different way to accomplish something, feature sets while you might then a recursive resolver is a recursive resolver - they are in fact different!!
The resolver has a forwarding feature, or you can turn that off.. If you want to resolve from roots, etc..
-
Eventually the DNS forwarder may migrate to a package but I would not it expect to disappear entirely. There are still things it does better than unbound. Sourcing domain override queries from a local address to deal with IPsec better, for one.
-
chocolate by the way …
-
While I like strawberry in most scenarios, chocolate works out great with the integration - much better than vanilla for my taste (needs).. But as jimp points out seems ipsec is a bigger fan of vanilla ;)
I would most likely point newer users to just vanilla, for one the web interface has less options.. When you provide lots of choices to a user, it confuses them ;)
-
I'd say make unbound the default and have DNSSEC enabled as default also.
Why? Because it works and anyone smart enough to set up IPSEC VPN server is smart enough to turn off unbound and turn on dnsmasq.
-
I'd say make unbound the default and have DNSSEC enabled as default also.
Why? Because it works and anyone smart enough to set up IPSEC VPN server is smart enough to turn off unbound and turn on dnsmasq.
That is the default for new installs of 2.2. :-)
-
" Because it works and anyone smart enough to set up IPSEC VPN server is smart enough to turn off unbound and turn on dnsmasq."
You would think so huh ;) But seems that is clearly not the case.. To be honest maybe there should be a basic skills tests before you can even download pfsense - like what is an IP address, what a mask is - what is the function of a gateway. What does ingress mean ;)
What is the difference between a recursive query and iterative. What is difference between tcp and udp. What is the rfc1918 address space..
-
I fail :-[
-
… maybe there should be a basic skills tests before you can even download pfsense - like what is an IP address, what a mask is - what is the function of a gateway.
Smite them with the clue stick - that's the ASR approach, then firewall them with real fire.
