pfSense » pfSense Packages

Stupid me just discovered the already present option "Use alternate DNS-servers for the proxy-server".

I still think this should default to 127.0.0.1 if the local DNS Forwarder is enabled as the current behavior is just too confusing. Maybe a <select> would work?

i agree that this is a good idea especially when running in a multi-wan environment where upstream proxies are used to implement faillover and/or load balancing. If the WAN interface is lost DNS lookups fail unless dns_nameservers 127.0.0.1 is set or "never_direct allow ..." is used to force all DNS lookups to be sent to the upstream proxy.

bottom line is that i believe its a good idea to make dns_nameservers 127.0.0.1 the default if the "User alternate DNS-servers for proxy-server" is blank and the DNS forwarder is enabled.

The following patch fixes implements this...

replace this around line 1410 at the end of function squid_validate_general

if(!empty($post['dns_nameservers'])) {
         $altdns = explode(";", ($post['dns_nameservers']));
         foreach ($altdns as $dnssrv) {
    if (!is_ipaddr($dnssrv))
      $input_errors[] = 'You must enter a valid IP address in the \'Alternate DNS servers\' field';
         }}

with

if(!empty($settings['dns_nameservers'])) {
                $altdns = explode(";", ($settings['dns_nameservers']));
                $conf .= "dns_nameservers ";
                foreach ($altdns as $dnssrv) {
                        $conf .= $dnssrv." ";
                }
//              $conf .= "\n";  //Kill blank line after DNS-Servers
        } else if ( isset($config['dnsmasq']['enable']) ) {
                // if use alternate dns servers is blank and the dns forwarded is on then we should use it instead of
                // having squid go over the link for its lookups.  Also, this helps with failover since the built in
                // in squid lookups don't deal with failover.
                $conf .= "dns_nameservers 127.0.0.1";
        }