Pfsense Recursive DNS Resolution, 2 questions



  • I have a pfsense router behind a pfsense router.
    I prefer to log all incoming and outgoing traffic, and to keep the traffic simple and 'readable'.
    This is complicated by both pfsense routers attempting to do DNS queues, which creates (much) additional traffic on UDP port 53.

    Is there a way I could force all networked machines, plus the first pfsense router itself, to do DNS queues only from the first pfsense router?

    Additionally, pfsense will send DNS queues to a great deal of different DNS servers. I don't really understand how recursive DNS queues are done, and I would like to simplify this traffic as much as possible. Is it possible to choose only one, or several specific, sources to send DNS queues to?


  • LAYER 8 Netgate

    Use DNS forwarder or DNS resolver in forwarding mode.



  • Thanks!

    For other peoples reference:

    https://doc.pfsense.org/index.php/DNS_Forwarder
    (The DNS Forwarder is not active by default. It has been replaced by Unbound as a DNS Resolver. It may still be used, and is still active on upgraded configurations)

    https://doc.pfsense.org/index.php/Unbound_DNS_Resolver
    (Enable Forwarding Mode: Controls whether Unbound will query root servers directly (unchecked, disabled) or if queries will be forwarded to the upstream DNS servers defined under System > General or those obtained by DHCP/PPPoE/etc (checked, enabled).)


Log in to reply