DNS resolver doesn`t work with virtual IP
-
Good day!
On LAN interface i set main address - 192.168.1.1/24 and virtual IP (IP alias) 10.1.1.2/24
WAN - is pppoe.
For clients i use DNS resolver on default gateway. On DNS resolver page i marked all interfaces to answer DNS requests.
Clients from network 192.167.1.0/24 work without errors.
Clients from network 10.1.1.0/24 cann`t resolve names.Any ideas?
PS 2.2.4-RELEASE
-
What is the application here? I'm no expert by a long shot, but I must admit I've never seen a virtual IP being used on LAN.
-
Did you add that 10.1.1.0/24 network to the allowed ACL?
-
^ yup most likely ACL in resolver.. Why would you create an alias in a completely network.. So your running 2 different IP spaces on the same layer 2 network - that is BAD idea!!! If you want to have a 10.x network using the same physical interface then setup vlan.
-
About acl 's…
Ping from every subnet to 8.8.8.8 is success.Ping to every default router of every subnet (192.168.1.1 and 10.1.1.2) from both subnets are success.
About 2 3-rd layer networks in 1 2nd layer.. Switches in this projects are without vlan support. As is... But secondary interface in my..Cisco pactice is not bad idea - it's design. :P
-
1/
2/ How's Cisco relevant here?! :o Go to DNS Resolver settings - the last tab!
-
Why not point them to 192.168.1.1 for DNS? Or hand out a public DNS server. I don't think the resolver listens on an alias, but haven't tried… Run sockstat -4 and see where the resolver is listening.
-
Switches in this projects are without vlan support.
So your a cheap ass??? Still bad idea no matter how cheap you are running multiple L3 over the same L2..
WTF does ping have to do with resolver ACL.. So since pictures are worth 1000 words.. See here where my 192.168 is allowed, I can resolve www.pfsense.org.. I then remove that network from the allow list - and REFUSED, but yet I can still ping it so how could it be the ACL????
-
So your a cheap ass???
We don't all control the budgets of the companies we work for. My entire infrastructure is built on dumb switches because my boss thought smart switches were too expensive for what they did, despite my protests.
-
Well explain it too them… If you can not explain why you need a smart switch vs a dumb one.. Maybe you don't need smart ones ;)
Where did OP state this was company?? Where did he say he asked for smart switches and got denied?
-
Where did OP state this was company?? Where did he say he asked for smart switches and got denied?
He said the project did not have smart switches. So, you can tell him he's doing it wrong and has to buy new switches, but that's not especially helpful. I agree he's doing it wrong- even though Cisco supports secondary IPs, they do not advocate placing two subnets on the same wire- but he wasn't asking for advice on how to setup the network, but how to fix a specific problem.
-
Well explain it too them.
I see you've never dealt with bosses who suffer from Dunning-Kruger effect.
Where did OP state this was company?? Where did he say he asked for smart switches and got denied?
I usually find it a safe assumption that when people mention network projects with multiple networks and multiple devices, they're not talking about their homes. Usually.
-
@KOM:
Well explain it too them.
I see you've never dealt with bosses who suffer from Dunning-Kruger effect.
Thanks KOM, I have learned something new and unexpected today.
-
Once you find out about D-K, the behaviour of a LOT of people starts to make a whole lot more sense.
-
Great read thanks for the link, D-K I had never heard of that before - but makes a lot of sense ;) This quote is spot on!!
"The skills you need to produce a right answer are exactly the skills you need to recognize what a right answer is."
"but he wasn't asking for advice on how to setup the network, but how to fix a specific problem."
But this is right in line with D-K if you ask me.. Running multiple L3 over the same L2 is wrong approach to whatever actual problem is.. That would never be correct solution no matter the problem.. So helping him do the WRONG thing is not freaking helping him that is for sure..
-
The PHB from Dilbert is another prime example of DKE.
-
Anyone still looking at this, this is solved by ticking "DNS Rebind Check" in "System -> Advanaced" Settings
-
@mohsh86 i registered an account just to say thank you for this!
