DNS(?) not working on fresh install

[DeepB]

Hello,

I did a fresh install of opnsense.

I got the WAN working.

opnsense is also the DHCP-server on the lan.

I can ping ip addresses (8.8.8. from clients and from opnsense.
I can DNS-resolve on opnsense (interfaces-diagnostics-DNS lookup).

Hower I cannot DNS resolve from any client.
nslookup google.com : "*** firewall.home can't find google.com: Server failed"

nslookup google.com 8.8.8.8  returns a DNS timeout.

DNS i got from DHCP is the opnsense box.

What I tried:
1) reinstalling
2) deactivating all DNS resolvers on opnsense, setting 1.1.1.1 and 8.8.8.8 as DNS in the general settings and dactivating "allow DNS override from WAN"
3) setting 1.1.1.1 or 8.8.8.8 as manual DNS on the client side.

Unfortunately nothing helped.

Any ideas?

Thanks
Daniel

[WN1X]

Under System->Settings->General where you entered the DNS servers, did you set the correct "Use Gateway" for each server?

Also, did you renew the client DHCP after making your OPNSense modifications?

[DeepB]

Under System->Settings->General where you entered the DNS servers, did you set the correct "Use Gateway" for each server?

Yes, I tried both "none" and my wan. results do not change

Also, did you renew the client DHCP after making your OPNSense modifications?

Yes.

[securid]

From a client try nslookup or dig and specify the dns server to query.

Open your opnsense gui, firewall, log files, live view.
add a filter, dstport=53

Try to resolve, ping hostname or use nslookup from a client. see what the log says.

You probably haven't added a rule to allow that traffic, or made a mistake doing so.

[sawtooth]

I had similar issue and wasted a day trying to figure it out. Re-installed it 3 times and turns out the hardware was the issue.
I was using an old Sophos XG105 which used to run IPfire perfectly. It worked for a bit, then DNS or some weird network issue broke the whole thing.
Gave up and installed on a Qotom 5th gen i5 8GB RAM and works straight off the bat.

[wogman]

Check that your LAN segment is allowed in the access list section of your DNS resolver settings.