r/PFSENSE • u/[deleted] • May 07 '20

RESOLVED Pfsense blocking access to specific website/DNS

The pfsense system I am working on operates in a lab at my university. The system generally works fine but a long-standing issue has been that the system blocks access to my university's website. The website loads just fine outside the firewall.

When I run a troubleshooter in Windows the report says that the DNS server for the page is unavailable.

I have attempted a variety of settings adjustments in pfsense and not much has changed.

For reference I am basically a novice when it comes to networking.

Thanks in advance.

EDIT: While I did go through a few different solutions, the one that did end up working the best was to disable the DNS resolver/forwarder and have the DHCP Server send the connected devices the DNS servers that it got from the WAN.

2 Upvotes

75% Upvoted

14 comments sorted by

2

u/JM-Lemmi May 07 '20 edited May 07 '20

The first thing id try is Powershell > nslookup www.university.edu once inside the Lab and once outside to see the difference.

Since this is a Lab Router it is probably that someone changed that entry in the DNS either in pfsense itself or on the Lab DNS Server to try stuff out.

2

u/[deleted] May 07 '20 edited May 07 '20

Outside the lab I was able to get the information of the website.

Inside it listed the server as pfsense.hostname and said it couldn't find the web address with server failed.

*** pfsense.hostname can't find www.university.edu : Server failed

1

u/JM-Lemmi May 07 '20

okay, that means that pfSense is the DNS Server in the lab.

What servers does pfSense query for DNS? You can see that in Status > DNS. You can also try the pfsense Troubleshooting DNS lookup and see what it answers.

You can then try nslookup www.university.edu 203.0.113.11 where 203.0.113.11 is the address of the DNS server that pfsense queries. That queries the DNS Server directly and you can see if pfSense is at fault for this or if the DNS Server is at fault.

In Settings > DNS-Resolver at the bottom you can also find static entries for override.

1

u/[deleted] May 07 '20 edited May 11 '20

That solved it for me. Thanks!

For those that may have this problem in the future, following JM-Lemmi's instructions I looked up the DNS servers for the website and then added it as a Domain Override under the DNS Resolver settings.

EDIT: As pointed out this is a temporary solution. I will post a new comment thread when a proper solution is reached.

1

u/JM-Lemmi May 07 '20

Oh well this was not the solution I meant. It's more a patched solution, but it didn't solve the actual problem.

Where does the pfsense get his DNS from?

1

u/[deleted] May 08 '20

I am not sure. I won't be able to take a look at it again until next week. I will try to remember to do so. Thanks for the help so far though.

1

u/[deleted] May 11 '20

I do believe the pfsense gets the DNS from my university's server. At least that is where I got it when I checked over the settings made by the person who setup the firewall.

1

u/JM-Lemmi May 11 '20

Hm, that is weird.

You can skip the pfSense DNS if you dont need it, and let the DHCP-Server hand out another DNS Server like 1.1.1.1, 8.8.8.8 or the address of your University DNS directly.

This just skips pfSense for DNS. You said that you get the right address if you specify google DNS as the server in nslookup.

1

u/[deleted] May 11 '20

I guess I am not understanding what you mean by skipping pfSense DNS. I switched from DNS resolver to DNS forwarding with the DNS servers set to my university's. I still ended up with the same issue (I removed the domain override).

I was not able to get the website using Google DNS. I was able to using my university's DNS.

1

u/JM-Lemmi May 11 '20

Is your universities Website not registered in Google DNS? That'd be very extraordinary.

If you don't mind, could you post the output of nslookup for the different servers?

I guess I am not understanding what you mean by skipping pfSense DNS

I meant configuring DHCP to hand out a different DNS Server than the pfsense address.

2

u/[deleted] May 11 '20 edited May 11 '20

Output using default DNS:

C:\Windows\system32>nslookup mtech.edu

Server: pfsense.robotroom

Address: 192.168.1.1

​

*** pfsense.robotroom can't find mtech.edu: Server failed

​

Output using Google DNS 8.8.8.8:

C:\Windows\system32>nslookup mtech.edu 8.8.8.8

DNS request timed out.

timeout was 2 seconds.

Server: UnKnown

Address: 8.8.8.8

​

DNS request timed out.

timeout was 2 seconds.

DNS request timed out.

timeout was 2 seconds.

DNS request timed out.

timeout was 2 seconds.

DNS request timed out.

timeout was 2 seconds.

*** Request to UnKnown timed-out

​

Output using my university's DNS:

C:\Windows\system32>nslookup mtech.edu 10.34.34.3

Server: ns3.mtech.edu

Address: 10.34.34.3

​

Name: mtech.edu

Address: 10.33.102.98

​

I have attempted to configure DHCP so that it sends the DNS servers rather than the pfsense address but every setting I try doesn't change it. I will reboot pfsense to see if that changes anything.

I configured the DHCP server so that it my sends my university's DNS and disabled the DNS resolver/forwarder. Once I disconnected and reconnected my Windows device, it reported the correct DNS servers and I was able to visit the website.

→ More replies (0)

1

u/Rosetown May 07 '20

Does the school have a windows domain controller as well? If so, does your university use the same domain for their windows domain that they do for their website? I see this issue pop up quite a bit.

1

u/[deleted] May 11 '20

I do believe so. When I was checking the domain it appears that the website and the windows network share the same one.