PfSense DNS Server

Hello,

Regarding the machine that has a network issue, what do the following commands return?

ip route cat /etc/resolv.conf ping -c2 www.google.fr

Good luck

Hello,

In fact, I think at this stage we shouldn’t reason in relation to whether we are using pfSense or not. The Linux that is there "doesn't care" and either the network configuration is correct in absolute terms, or it is not. If it is not, then we need to ask if pfSense can explain why it is not correct.

ip route

At first glance, the routing table reported in message #3 seems correct to me.

Regarding messages #4 and #5, I actually think there is a misunderstanding.

• In IP routing, we look at the destination IP and choose the route whose prefix is the most specific and contains the destination address.
  • The interface involved (real, virtual, ethernet, wifi, VPN) doesn’t matter, the reasoning never changes. No need to ask existential questions or talk about WAN or LAN.
  • The reasoning remains true regardless of how the route has been configured or learned. No need to wonder if the route is learned via DHCP, manually configured, or learned through a routing protocol.
• In your case, your routing table shows that there are two scenarios:
  • If the IP starts with 192.168.1.* then it belongs to the network 192.168.1.0/24. Since this prefix is the most specific in the routing table, the corresponding route is used. The IPs in this prefix are directly reachable (no gateway, hence the 0.0.0.0) via ens18 because they are part of the same prefix (192.168.1.0/24).
  • Otherwise, the IP belongs to the prefix 0.0.0.0/0 (default) and therefore the default route is used. This must involve a routable gateway. In this case, the gateway is 192.168.1.1 and it is reachable thanks to the other route, so everything is presumably correct. The question remains whether 192.168.1.1 exists and can act as a gateway.

ping (gateway)

Can you ping your gateway?

• If yes, move to the next test
• If not, there’s a strong chance everything else won’t work because if you can’t reach the gateway, you won’t be able to reach the rest.
  • Check that you can ping your own machine. If not, you might have a firewall issue on your own machine (which is blocking the emission or reception of ICMP packets used by ping).
  • Verify that the IP address of the gateway is correct. If not, you may need to revisit how it was configured (local configuration or DHCP server configuration).

ping (DNS)

Can you ping the DNS server?

ping -c2 172.0.0.53

• If yes, move to the next test
• If not, does the IP of the DNS seem correct to you?
  • Note that ping is not a perfect test to know if the routing is correct (if there is no response, it could be because a firewall is blocking ping. In that case, still perform the test with nmap). If ping works, then the routing is correct.

nmap

The DNS server normally hosted on 172.0.0.53 may not respond as the DNS request might be filtered by a firewall, either on the machine you are configuring, on 172.0.0.53, or on an intermediary machine located between the two (for example, gateway 192.168.1.1).

To check if the DNS port (53) is visible from the machine you are configuring, install nmap and run:

nmap -p 53 127.0.0.53

For reference, here’s what nmap returns for my own DNS server (in my case, 192.168.0.254):

 (mando@silk) (~) $ nmap -p 53 192.168.0.254 Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-13 19:32 CEST Nmap scan report for 192.168.0.254 Host is up (0.0031s latency). PORT STATE SERVICE 53/tcp open domain Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds

In your case, does your machine see port 53 for 172.0.0.53?

• If yes, then the problem is presumably neither related to routing, nor to a firewall, nor to the DNS server being down. We would then need to check the DNS server logs for what’s not working.
• If not, check that the DNS server 172.0.0.53 is running.
• If it is running, check what happens if you configure another DNS server.

Test with another DNS

No matter how your DNS configuration is obtained (via DHCP or manually), you can temporarily replace your DNS server in /etc/resolv.conf so that it has:

 nameserver 8.8.8.8

This corresponds to the anycast address of Google’s DNS.

Does it work?

• If yes, the problem is likely due to the DNS server 172.0.0.53 itself. You should check its logs.
• If not, it is possible that a machine (either the one you are configuring, or the DNS server, or a machine in between) is filtering the request with its firewall.

Good luck

Hello,

> a LAN with address 192.168.1.1/24 (gateway: 192.168.1.254)

No gateway should be configured on the pfSense LAN interface.
And for the machines connected to this LAN, the gateway and DNS are the pfSense router, so 192.168.1.1

Make sure that the information configured in the DHCP server is consistent with this.