Text only | Text with Images

OPNsense Forum

English Forums => General Discussion => Topic started by: baz on December 04, 2021, 07:07:21 PM

Title: Why isn't my port forward that forces all DNS to be resolved locally working?
Post by: baz on December 04, 2021, 07:07:21 PM
I have setup a port forward to force all DNS queries to be resolved locally like so:

interface: LAN
source: any
source port: any
destination: !LAN net (inverted)
destination port: 53
nat IP: 127.0.0.1
nat port: 53

To test this, I changed the DNS on my wired LAN desktop to Cloudflare's 1.1.1.1 then did an nslookup of google.com and it returned that it was using server: one.one.one.one (1.1.1.1) instead of 192.168.0.1 as it should.

Any idea why?
Title: Re: Why isn't my port forward that forces all DNS to be resolved locally working?
Post by: Patrick M. Hausen on December 04, 2021, 07:59:17 PM
TCP+UDP?
Title: Re: Why isn't my port forward that forces all DNS to be resolved locally working?
Post by: baz on December 04, 2021, 08:04:53 PM
Good question, yes "TCP/UDP"
Title: Why isn't my port forward that forces all DNS to be resolved locally working?
Post by: Greelan on December 04, 2021, 10:23:12 PM
Are you sure it is not working? As far as nslookup is concerned, it is asking 1.1.1.1, but that doesn't mean that the reply is coming from there

A good way to check is to query a local DNS record - if a correct reply is received, then the redirect must be working, because Cloudflare would not know about the local DNS record

Alternatively turn on logging on your rules and watch the traffic when a request is made
Title: Re: Why isn't my port forward that forces all DNS to be resolved locally working?
Post by: baz on December 04, 2021, 10:52:23 PM
Great call! I didn't realize that's how it works, but I'm sure you're right, it just prints whats registered, not what's happening. Turning the forward off creates failures finding local domains and turning it on successes, so all is good again 👍
Text only | Text with Images