Project

General

Profile

Actions
Copy link

Bug #12902

closed
FS VG

DNS Forwarder creates a loop when "Use local DNS, ignore remote DNS servers" is selected

Bug #12902: DNS Forwarder creates a loop when "Use local DNS, ignore remote DNS servers" is selected

Added by Flole Systems over 4 years ago. Updated about 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Viktor Gurov
Category:
DNS Forwarder
Target version:
2.7.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
22.05
Release Notes:
Default
Affected Version:
2.6.0
Affected Architecture:

Description

I am using the DNS Forwarder, I set up a few DNS Servers in System->General Settings. Also I selected "Use local DNS, ignore remote DNS servers" as I have a few domain overrides set that need to be evaluated. Anyways, with that option I am always getting "REFUSED" as reponse, setting it to "Use remote DNS" causes it to work properly again. It looks like a loop is created there and the forwarders aren't passed properly to dnsmasq.

Related issues 1 (0 open — 1 closed)

Has duplicate Bug #13033: DNS lookups using DNS forwarder yields invalid cache entries in systemd-resolvedDuplicate

Actions

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #1

  • Status changed from New to Not a Bug
  • Target version deleted (2.7.0)

Your issue is related to DNS rebind protection,
please read https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html#dns-forwarder

FS Updated by Flole Systems over 4 years ago Actions
Copy link
 #2

Why should this be related to DNS rebind protection? It happens for any query. Also on my system DNS rebind protection is disabled.

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #3

Flole Systems wrote in #note-2:

Why should this be related to DNS rebind protection? It happens for any query. Also on my system DNS rebind protection is disabled.

it can be related to #12901 and https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=2561f9fe0eb9c0be1df48da1e2bd3d3feaa138c2

FS Updated by Flole Systems over 4 years ago Actions
Copy link
 #4

No.... Can you please just leave issues that you don't understand for someone else to take care of? Thanks. Or at least try to reproduce before marking obvious bugs as "not a bug", then you would notice that /etc/resolv.conf only contains 127.0.0.1 and that dnsmasq is missing a list of the other remote forwarders, so it's causing a loop as it tries to use itself as an upstream server, which isn't the case with the other options as then /etc/resolv.conf is containing the remote DNS servers.

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #5

  • Status changed from Not a Bug to New
  • Assignee set to Viktor Gurov
  • Target version set to 2.7.0
  • Plus Target Version set to 22.05
  • Affected Version set to 2.6.0

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #6

  • Status changed from New to Pull Request Review

VG Updated by Viktor Gurov over 4 years ago Actions
Copy link
 #7

  • Status changed from Pull Request Review to Feedback
  • % Done changed from 0 to 100

Applied in changeset commit:9a36d90138b5230abeacd80162fca7c4937263de.

DZ Updated by Danilo Zrenjanin over 4 years ago Actions
Copy link
 #8

  • Status changed from Feedback to Resolved

Tested against:

2.7.0-DEVELOPMENT (amd64)
built on Fri Mar 11 06:21:33 UTC 2022
FreeBSD 12.3-STABLE

The firewall resolves successfully using Forwarder, and the "Use local DNS, ignore remote DNS servers" option is set under System General.

I am marking this ticket resolved.

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #9

  • Has duplicate Bug #13033: DNS lookups using DNS forwarder yields invalid cache entries in systemd-resolved added

OP Updated by Orion Poplawski about 4 years ago Actions
Copy link
 #10

I'm afraid that this broke my use-case. I set the following custom options:

no-resolv
server=208.67.222.222
server=208.67.220.220

because I specifically do NOT want the forwarder to use the local resolvers, but instead the ones I specify. Now the local resolvers always get added and there is no way to prevent it.

Actions
Copy link

Also available in: Atom