pfSense Gold Subscription

Author Topic: OpenDnS not working  (Read 5568 times)

0 Members and 1 Guest are viewing this topic.

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: OpenDnS not working
« Reply #15 on: June 19, 2015, 12:34:24 pm »
Quote
No, not with Unbound. It won't use anything in System - General by default.

Ah yes, I checked the option and it will offer pfSense LAN IP if DNS Forwarder is enabled, otherwise it will offer the DNS configured in General Settings.

That misleading description in DHCP server settings is already fixed in 2.2.3 snapshots:

Quote
"NOTE: leave blank to use the system default DNS servers - this interface's IP if DNS Forwarder or Resolver is enabled, otherwise the servers configured on the General page.

Point being - unbound won't forward anything anywhere by default, it does the resolution itself.
Do NOT PM for help!

Offline phil.davis

  • Hero Member
  • *****
  • Posts: 4612
  • Karma: +550/-3
    • View Profile
    • International Nepal Fellowship
Re: OpenDnS not working
« Reply #16 on: June 28, 2015, 03:47:01 am »
I'll put a summary here that will hopefully help future readers:

If you want to use particular DNS servers out on the internet to do some filtered DNS for you (e.g. OpenDNS or DynDNS Internet Guide or...) then your DNS on pfSense must be in forwarding mode.
a) If DNS Forwarder is enabled - then it always does forwarding mode - easy, done.
b) If DNS Resolver is enabled - then select the checkbox to "Enable Forwarding Mode".

Put the special DNS servers in System->General.

If you are using DHCP on pfSense then let it do its default thing - it will give the clients the pfSense interface IP as the DNS, and pfSense DNS is in forwarding mode to those.

For clients with hard-coded static IPs - set their DNS manually to the pfSense interface IP.
As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

Offline maverik1

  • Jr. Member
  • **
  • Posts: 76
  • Karma: +2/-0
    • View Profile
Re: OpenDnS not working
« Reply #17 on: August 31, 2015, 11:59:34 pm »
I am unable to get this working...pain in butt with so many tabs dealing with DNS.... I've specified OpenDNS servers under General Setup and made sure Allow DNS server list to be overridden by DHCP option was unchecked. I also specified same OpenDNS servers under DHCP server. Rebooted my machines, cleared cache, cookies, history from browser... ran ipconfig /flushdns...  When I do an ipconfig /all  DNS server shows 192.168.1.1 which is the dhcp server/gateway and so forth.

I've also verified my IP has been updated with OpenDNS. I've setup Dynamic DNS as well and its working.  If I go to Diagnostics and do DNS Lookup I can see it is using OpenDNS servers:

Server    Query time
208.67.222.222    22 msec
208.67.220.220    24 msec

Why is it not working?
« Last Edit: September 01, 2015, 12:32:36 am by maverik1 »

Offline drurb75

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: OpenDnS not working
« Reply #18 on: February 19, 2016, 03:10:11 am »
New to forums - first ever post.  Bear with me if I break the rules.

This thread helped confirm I was on the right path - thanks Phil for the succinct solution.

Following on the solution you offered, which is correct, there is one extra setting I found blocking me from forwarding from unbound to OpenDNS specifically; Unchecking the advanced unbound setting to Harden DNSSEC Data allowed me to forward to that service.  Note, Google DNS was working with the Harden DNSSEC setting enabled.

One extra point on static / user-set DNS settings in devices on the network - Port Forward traffic into LAN interface that has a DNS (port 53) destination IP that is not the LAN interface IP to the LAN interface IP.  No more sneaking around your network-wide DNS settings.

Hope this helps someone.

Offline dabigoreo

  • Newbie
  • *
  • Posts: 10
  • Karma: +4/-0
    • View Profile
Re: OpenDnS not working
« Reply #19 on: February 19, 2016, 11:17:54 am »
Newbie here. Had a similar problem with OpenDNS as well. During initial setup I used the OpenDNS entries on the General page and could not figure out why the welcome test page for OpenDNS said I wasn't configured properly. I eventually figured out that forwarding needed to be turned on for the DNS Resolver (default mode on initial install). This kinda fixed things but then I noticed a lot of websites were not resolving or taking a very long time to resolve. I changed gears by turning off DNS Resolver and enabling DNS Forwarder - all dns issues went away and OpenDNS confirmation was achieved. Hope this helps other newbies to pfsense.  8)
fw: 2.3-RELEASE(amd64)
packages: Snort, Nmap

system: Dell Optiplex 745 desktop
cpu: Intel Pentium D 3.4GHz
ram: 4GB DDR2
wan nic: Broadcom Gbe
lan nic: Marvell Gbe

Offline strawberrypacketjam

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: OpenDnS not working
« Reply #20 on: November 26, 2017, 04:33:16 pm »
I know this is a bit old, but I just wanted to confirm that disabling the Harden DNSSEC Data and enabling DNS Query Forwarding will allow OpenDNS to work.

Enabling the DNS Query Forwarding on the resolver will break DNS for clients if Harden DNSSEC Data is enabled. I was kicking all around trying to get this working.


Disable Harden DNSSEC Data:
Services > DNS Resolver > Advanced Settings > Uncheck Harden DNSSEC Data
Services > DNS Resolver > Check DNS Query Forwarding


Offline Gertjan

  • Hero Member
  • *****
  • Posts: 2147
  • Karma: +165/-9
    • View Profile
Re: OpenDnS not working
« Reply #21 on: November 29, 2017, 08:41:04 am »
I know this is a bit old, but I just wanted to confirm that disabling the Harden DNSSEC Data and enabling DNS Query Forwarding will allow OpenDNS to work.

Enabling the DNS Query Forwarding on the resolver will break DNS for clients if Harden DNSSEC Data is enabled. I was kicking all around trying to get this working.


Disable Harden DNSSEC Data:
Services > DNS Resolver > Advanced Settings > Uncheck Harden DNSSEC Data
Services > DNS Resolver > Check DNS Query Forwarding
Today, November 2017, OpenDNS isn't doing any DNSSEC yet, and worse, by concept it can't pass along the DNS requests without breaking the security chain.