• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

DNS resolver doesn`t work with virtual IP

Scheduled Pinned Locked Moved DHCP and DNS
18 Posts 8 Posters 3.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    DmnTMN
    last edited by Nov 3, 2015, 9:01 PM

    Good day!

    On LAN interface i set main address - 192.168.1.1/24 and virtual IP (IP alias) 10.1.1.2/24
    WAN - is pppoe.
    For clients i use DNS resolver on default gateway. On DNS resolver page i marked all interfaces to answer DNS requests.
    Clients from network 192.167.1.0/24 work without errors.
    Clients from network 10.1.1.0/24 cann`t resolve names.

    Any ideas?

    PS 2.2.4-RELEASE

    1 Reply Last reply Reply Quote 0
    • K
      KOM
      last edited by Nov 3, 2015, 9:09 PM

      What is the application here?  I'm no expert by a long shot, but I must admit I've never seen a virtual IP being used on LAN.

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by Nov 3, 2015, 9:18 PM

        Did you add that 10.1.1.0/24 network to the allowed ACL?

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by Nov 3, 2015, 9:38 PM

          ^ yup most likely ACL in resolver..  Why would you create an alias in a completely network.. So your running 2 different IP spaces on the same layer 2 network - that is BAD idea!!!  If you want to have a 10.x network using the same physical interface then setup vlan.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • D
            DmnTMN
            last edited by Nov 3, 2015, 11:04 PM

            About acl 's…
            Ping from every subnet to 8.8.8.8 is success.

            Ping to every default router of every subnet (192.168.1.1 and 10.1.1.2) from both subnets are success.

            About 2 3-rd layer networks in 1 2nd layer.. Switches in this projects are without vlan support. As is... But secondary interface in my..Cisco pactice is not bad idea - it's design.  :P

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by Nov 3, 2015, 11:08 PM Nov 3, 2015, 11:05 PM

              1/

              2/ How's Cisco relevant here?!  :o Go to DNS Resolver settings - the last tab!

              1 Reply Last reply Reply Quote 0
              • D
                dotdash
                last edited by Nov 3, 2015, 11:13 PM

                Why not point them to 192.168.1.1 for DNS? Or hand out a public DNS server. I don't think the resolver listens on an alias, but haven't tried… Run sockstat -4 and see where the resolver is listening.

                1 Reply Last reply Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator
                  last edited by Nov 4, 2015, 4:21 AM

                  Switches in this projects are without vlan support.

                  So your a cheap ass???  Still bad idea no matter how cheap you are running multiple L3 over the same L2..

                  WTF does ping have to do with resolver ACL.. So since pictures are worth 1000 words.. See here where my 192.168 is allowed, I can resolve www.pfsense.org.. I then remove that network from the allow list - and REFUSED, but yet I can still ping it so how could it be the ACL????

                  resolveracl.png
                  resolveracl.png_thumb

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • K
                    KOM
                    last edited by Nov 5, 2015, 5:34 PM Nov 4, 2015, 2:14 PM

                    So your a cheap ass???

                    We don't all control the budgets of the companies we work for.  My entire infrastructure is built on dumb switches because my boss thought smart switches were too expensive for what they did, despite my protests.

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Nov 4, 2015, 5:00 PM

                      Well explain it too them… If you can not explain why you need a smart switch vs a dumb one.. Maybe you don't need smart ones ;)

                      Where did OP state this was company??  Where did he say he asked for smart switches and got denied?

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • D
                        dotdash
                        last edited by Nov 4, 2015, 5:49 PM

                        @johnpoz:

                        Where did OP state this was company??  Where did he say he asked for smart switches and got denied?

                        He said the project did not have smart switches. So, you can tell him he's doing it wrong and has to buy new switches, but that's not especially helpful. I agree he's doing it wrong- even though Cisco supports secondary IPs, they do not advocate placing two subnets on the same wire- but he wasn't asking for advice on how to setup the network, but how to fix a specific problem.

                        1 Reply Last reply Reply Quote 0
                        • K
                          KOM
                          last edited by Nov 4, 2015, 6:11 PM

                          Well explain it too them.

                          I see you've never dealt with bosses who suffer from Dunning-Kruger effect.

                          Where did OP state this was company??  Where did he say he asked for smart switches and got denied?

                          I usually find it a safe assumption that when people mention network projects with multiple networks and multiple devices, they're not talking about their homes.  Usually.

                          1 Reply Last reply Reply Quote 0
                          • A
                            awebster
                            last edited by Nov 4, 2015, 7:19 PM

                            @KOM:

                            Well explain it too them.

                            I see you've never dealt with bosses who suffer from Dunning-Kruger effect.

                            Thanks KOM, I have learned something new and unexpected today.

                            –A.

                            1 Reply Last reply Reply Quote 0
                            • K
                              KOM
                              last edited by Nov 5, 2015, 5:34 PM Nov 4, 2015, 7:28 PM

                              Once you find out about D-K, the behaviour of a LOT of people starts to make a whole lot more sense.

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by Nov 4, 2015, 9:23 PM Nov 4, 2015, 9:17 PM

                                Great read thanks for the link, D-K I had never heard of that before - but makes a lot of sense ;)  This quote is spot on!!

                                "The skills you need to produce a right answer are exactly the skills you need to recognize what a right answer is."

                                "but he wasn't asking for advice on how to setup the network, but how to fix a specific problem."

                                But this is right in line with D-K if you ask me.. Running multiple L3 over the same L2 is wrong approach to whatever actual problem is.. That would never be correct solution no matter the problem..  So helping him do the WRONG thing is not freaking helping him that is for sure..

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • K
                                  KOM
                                  last edited by Nov 4, 2015, 9:25 PM

                                  The PHB from Dilbert is another prime example of DKE.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mohsh86
                                    last edited by Jan 12, 2021, 5:58 AM

                                    Anyone still looking at this, this is solved by ticking "DNS Rebind Check" in "System -> Advanaced" Settings

                                    M 1 Reply Last reply May 27, 2023, 8:58 PM Reply Quote 1
                                    • M
                                      matthewmalk248 @mohsh86
                                      last edited by May 27, 2023, 8:58 PM

                                      @mohsh86 i registered an account just to say thank you for this!

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                        This community forum collects and processes your personal information.
                                        consent.not_received