Netgate SG-1000 microFirewall

Author Topic: [SOLVED] DNS Requests From Clients Failing  (Read 409 times)

0 Members and 1 Guest are viewing this topic.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 10257
  • Karma: +1176/-313
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #15 on: January 12, 2018, 07:07:50 pm »
DNSSEC or IPsec?

And don't confuse "ping" with "resolve names".

You could probably always ping the correct IP address. You just couldn't resolve the correct IP address from the name.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Gertjan

  • Hero Member
  • *****
  • Posts: 2581
  • Karma: +207/-9
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #16 on: January 12, 2018, 07:12:52 pm »
It was IPSEC doing it! If I turn that off and apply, then I can ping; if I turn it back on, apply and flush DNS on the client then it fails; turning it back off allows the client to work again.
IPSEC ? Or DNSSEC ?

The pfSense Resolvers uses DNSSEC by default - some sort of future secured DNS - and, you should know that OpenDNS doesn't work with DNSSEC.
When you flush the DNS on your client, you didn't flush the DNS cache on pfSense, so it still seems to work. But as soon as the cache times out, things will be 'broken' again.
Rule of thumb : when using OpenDNS, disable your local (pfSense) resolver the DNSSEC capabilities - or use the forwarder, this is one of the reasons it still exists in pfSense : for those who want to send all their DNS traffic to some off-site DNS service like OpenDNS.

Offline Lawrence Dol

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
    • Software Monkey
Re: DNS Requests From Clients Failing
« Reply #17 on: January 12, 2018, 07:34:11 pm »
All,

Sorry, I did mean DNSSEC.

I do know that I was flushing the client cache, but since it was only the client which was failing to resolve DNS names (resolving from the pfSense box has been working since inception) and since pinging with a host name requires a DNS resolution first, that seems a valid test to me. Specifically what I did was `ping google.com` => fail. Disable DNSSEC, then `ping google.com` => success. Enable DNSSEC again, then `ping google.com` => success (address still cached on client). Then `ipconfig /flushdns` and `ping google.com` => fail (expected). Finally, disable DNSSEC then `ping google.com` => success again. Which demonstrates conclusively that DNSSEC is causing an issue with the client (given that there was no problem resolving names from the pfSense diagnostic tool). Of course, my initial and subsequent posts did make clear that I could ping and access hosts by their IP address the whole time.

[This train of logic actually suggests that it is the client (Windows 10) not OpenDNS which can't do DNSSEC, since with DNSSEC enabled resolving names from the pfSense box works. But that is an aside for me right now since the problem is resolved.]

Again, thanks for your help.

PS: Is there a way to mark this thread as resolved?

Lawrence Dol
Perfection is the enemy of excellence.
pfSense on a recycled AMD AthlonII X3 435; 3GHz; 8 GiB

Offline johnpoz

  • Hero Member
  • *****
  • Posts: 15736
  • Karma: +1469/-210
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: DNS Requests From Clients Failing
« Reply #18 on: January 12, 2018, 07:55:02 pm »
"This train of logic actually suggests that it is the client (Windows 10) not OpenDNS which can't do DNSSEC"

Sorry but that is not what that train of non logic suggests at all...  Suggest you research how dnssec works, and why asking opendns for dnssec is not going to work..  But why it does work when you acktually resolve, etc.
- An intelligent man is sometimes forced to be drunk to spend time with his fools.
- Please don't PM me for personal help
- if you want to say thanks applaud or https://www.freebsdfoundation.org/donate/
1x SG-2440 2.4.3-RELEASE (work)
1x SG-3100 2.4.3-RELEASE (work)
1x SG-4860 2.4.3-RELEASE (home)