DNS Doctoring in pfsense
-
@sparkyMcpenguin That is what I meant too. We are not using any dynamic DNS from outside. We have static IPs allocated by our ISP going to internal servers with 1:1 NAT. To restate, many of the systems allow our customers to create their own DNS records pointing to our IP addresses. The firewall has no way to know what these DNS records are in advance, but DNS Doctoring (or
aliasas dnsmasq calls it) allows Split DNS to work with no additional configuration. -
@yakatz
are you using the forwarder on the wan? or am i mixing the functionality of that up -
@sparkyMcpenguin said in DNS Doctoring in pfsense:
@yakatz said in DNS Doctoring in pfsense:
@sparkyMcpenguin All static IPs. We are current;y using unbound, so no upstream DNS servers.
my logic with redundancy in my dns resolver choices is "i dont trust just one source". if that source gets corrupted or altered (lol sorta like what youre trying to do, but you're doing it for a legitimate thing) then im sure there's billions more ip addresses out there to tell everyone else that your IP result is incorrect(?)
when i added more than one DNS i also changed my ASN check settings to 1 hour (just cause i want it to update faster - i assume the default 24 hours would cause ... 24 hours wait time for the change to take effect, for verifying the cache in unbound)
in regards to my 'redundancy' comment, the further logic being maybe helping to prevent ARP poisoning? just two cents
-
@yakatz said in DNS Doctoring in pfsense:
@sparkyMcpenguin That is what I meant too. We are not using any dynamic DNS from outside. We have static IPs allocated by our ISP going to internal servers with 1:1 NAT. To restate, many of the systems allow our customers to create their own DNS records pointing to our IP addresses. The firewall has no way to know what these DNS records are in advance, but DNS Doctoring (or
aliasas dnsmasq calls it) allows Split DNS to work with no additional configuration.what about a 'Proxy ARP' VIP under firewall for east host? wikipedia page for reference Proxy ARP
this and (maybe needed not quite sure - but u did say 'dnsmasq') having the forwarder (i see it say dnsmasq a lot on there i just dont use it) on the wan