Netgate SG-1000 microFirewall

Author Topic: [SOLVED] DNS Requests From Clients Failing  (Read 410 times)

0 Members and 1 Guest are viewing this topic.

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
[SOLVED] DNS Requests From Clients Failing
« on: January 11, 2018, 11:58:52 pm »
I am a new user of pfSense and new to this forum. I have a working knowledge of networking in general, but it's not my area of expertise since "we have a guy for that" at work. I have just recently built a pfSense box to replace my consumer router at home.

My setup (while configuring) is:

    client <==> pfSense <=(nat 10.x.x.x)=> router <=(nat 192.168.x.x)=> cable-modem

(When I am happy with everything, I'll remove the router, which is currently serving the rest of the house, but for right now I want only my computer behind the pfSense box.)

The problem I have is that DNS requests from the client do not seem to be received (or responded to). I can resolve names for public servers from the pfSense box, but not from the client. However, the client is able to communicate to the internet using IP addresses, and the pfSense DHCP works and I can ping the client computer. I can also reach computers on the downstream home network by IP. So I conclude that wiring and IP addressing is correct and that DNS resolution is the problem.

Settings for the DNS service have been left at installed defaults, but I've also tried enabling some of the more obvious options with no success.

DHCP assigns the DNS Servers as the LAN IP of the pfSense LAN interface (singular):

    Default Gateway . . . . . . . . . : 10.x.x.1
    DNS Servers . . . . . . . . . . . : 10.x.x.1

Since I am brand new to this, I don't know how to go about diagnosing the issue, though I have poked around in the diagnostics menu.

ETA: Marking as solved as requested.
« Last Edit: January 13, 2018, 02:57:54 pm by Derelict »
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline KOM

  • Hero Member
  • *****
  • Posts: 5823
  • Karma: +710/-23
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #1 on: January 12, 2018, 09:00:27 am »
Can you confirm via ipconfig /all that the client has the correct DNS?  Can you confirm that pfSense itself can resolve via Diagnostics - DNS Lookup?

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #2 on: January 12, 2018, 11:31:35 am »
@KOM,

Yes, the information in my post was obtained by doing both of these. The DNS server IP is the same as the gateway, both being the PFSense address on the LAN interface. And I used PFSense diagnostics to resolve and ping multiple internet hosts by name. I can also ping the client and the downstream LAN devices using names from the PFSense box. So it's only the client where DNS seems to fall into a black hole.
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline KOM

  • Hero Member
  • *****
  • Posts: 5823
  • Karma: +710/-23
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #3 on: January 12, 2018, 11:56:52 am »
Did you edit the LAN rules perhaps and somehow block DNS?  What do you get if you manually try to resolve via nslookup?

Code: [Select]
nslookup
server (pfSense hostname or LAN IP)
www.google.com

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #4 on: January 12, 2018, 12:31:35 pm »
I get:

Code: [Select]
nslookup
Default Server:  pfsense.lan
Address:  10.70.80.1

But I'd expect OpenDNS to show as the final server, since that's what I've configured.

I did not edit the LAN rules.
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10257
  • Karma: +1176/-313
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #5 on: January 12, 2018, 01:29:59 pm »
The default configuration is a DNS Resolver.

The DNS resolver does not use configured name servers to resolve client requests. It starts at the root name servers and works down hierarchically until it obtains the answers from the authoritative name servers for that zone/domain.

If you want to leverage OpenDNS, Quad9, etc, you must use either the DNS Forwarder or the DNS Resolver in forwarding mode so all answers are obtained from those specific servers.

There are three different things to keep in mind:
  • What servers the clients are configured to use as DNS servers (The configuration of the client itself - often via DHCP)
  • What servers the firewall itself uses as DNS servers (The settings in System > General)
  • Where/how the DNS server software on pfSense is configured to obtain answers to client queries. (The choice between the DNS Forwarder or DNS Resolver and the configuration of the same)
« Last Edit: January 12, 2018, 01:33:07 pm by Derelict »
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline KOM

  • Hero Member
  • *****
  • Posts: 5823
  • Karma: +710/-23
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #6 on: January 12, 2018, 02:09:42 pm »
Actually, I wanted you to manually use pfSense as your DNS server for this test by issuing the command:

Code: [Select]
server (pfSense hostname or IP)
Then you would try to resolve google.com or whatever and see what you get on your client.

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #7 on: January 12, 2018, 02:33:59 pm »
KOM,

Sorry about that. I'd not used nslookup before.

Despite the fact the ipconfig /all reports the correct local IP address of the pfSense box for the DNS server, I had to set the server to the IP address, from the default DNS name. That resulted in the following (successful) queries:

Code: [Select]
nslookup
Default Server:  pfsense.lan
Address:  10.70.80.1

> google.com
Server:  pfsense.lan
Address:  10.70.80.1

> server 10.80.80.1
Default Server:  [10.80.80.1]
Address:  10.80.80.1

> google.com
Server:  [10.80.80.1]
Address:  10.80.80.1

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:400a:806::200e
          216.58.216.142

> exit

Derelict,

I have the resolver configured for forwarding mode (Enable Forwarding Mode), now, but still with no success. (Screenshot attached.)
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #8 on: January 12, 2018, 02:54:04 pm »
I just noticed the typo in my IP address... 10.80 instead of 10.70... I wonder why that worked, since I don't have a 10.80 network?

It seems that the problem is having the DNS IP set to 10.70.80.1 (the LAN address of the pfSense box). If I set it to something unknown lookups work??

Code: [Select]
nslookup
Default Server:  pfsense.lan
Address:  10.70.80.1

> google.com
Server:  pfsense.lan
Address:  10.70.80.1

*** pfsense.lan can't find google.com: Server failed
> server 10.70.80.1
Default Server:  pfsense.lan
Address:  10.70.80.1

> google.com
Server:  pfsense.lan
Address:  10.70.80.1

*** pfsense.lan can't find google.com: Server failed
> server 10.1.2.3
Default Server:  [10.1.2.3]
Address:  10.1.2.3

> google.com
Server:  [10.1.2.3]
Address:  10.1.2.3

Non-authoritative answer:
Name:    google.com
Addresses:  2607:f8b0:400a:806::200e
          216.58.216.142

> exit

Wuhuh?
« Last Edit: January 12, 2018, 02:58:43 pm by Lawrence Dol »
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline KOM

  • Hero Member
  • *****
  • Posts: 5823
  • Karma: +710/-23
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #9 on: January 12, 2018, 03:01:26 pm »
You're getting nothing back when you do a manual lookup?  It should come back with either a resolution or an error.  Here is how it should work (from my location):

Quote
PS C:\Users\kom> nslookup
Default Server:  ad.kom.local
Address:  10.10.0.1

> server pfsense.kom.local
Default Server:  pfsense.kom.local
Address:  10.10.4.1

> www.google.com
Server:  pfsense.kom.local
Address:  10.10.4.1

Non-authoritative answer:
Name:    www.google.com
Addresses:  2607:f8b0:400b:808::2004
          172.217.0.228

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #10 on: January 12, 2018, 03:23:57 pm »
Yes, successful lookup is what my output, above, shows... but only afer I change the server to an invalid IP address, like 10.1.2.3. As long as the server is the name or IP address of the pfSense box (10.70.80.1) the lookup fails (which the above output also shows, first).
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline KOM

  • Hero Member
  • *****
  • Posts: 5823
  • Karma: +710/-23
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #11 on: January 12, 2018, 03:34:03 pm »
Sorry, I'm a dummy.  I didn't notice the scroll bars in your output and thought that was all.

It certainly shouldn't be resolving when you supply a bogus DNS.  I'm starting to get suspicious about your extra router in the mix.

What do you have under System - General - DNS Server Settings?


Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #12 on: January 12, 2018, 03:53:51 pm »
General DNS settings attached.
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10257
  • Karma: +1176/-313
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #13 on: January 12, 2018, 05:48:59 pm »
First off, OpenDNS does not properly support DNSSEC (last I heard) so uncheck that in the resolver.

Second, you should be getting some kind of response. Are you POSITIVE you didn't dork with the firewall rules on that inside interface such that DNS is now blocked?

Or the listen interfaces?
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #14 on: January 12, 2018, 06:08:43 pm »
Derelict,

It was IPSEC doing it! If I turn that off and apply, then I can ping; if I turn it back on, apply and flush DNS on the client then it fails; turning it back off allows the client to work again.

Thank you!

PS: The only firewall rules I have are those created automatically on the LAN interfaces.
Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB