Solved Working FreeBSD Gateway with DNS problem

Aknot

Aknot

I have successfully set up a working FreeBSD gateway, but I can't get DNS to work from the gateway itself, when working in the shell.
I'm not sure what's wrong, or what I miss, is DHCP on igb0 overwriting the resolv.conf file?

This is what I have:

/etc/rc.conf
Code: 
gateway_enable="YES"
defaultrouter="192.168.8.100"
ifconfig_igb0="DHCP"
ifconfig_igb1="inet 172.16.1.1 netmask 255.255.255.0"

/etc/resolv.conf
Code: 
# Generated by resolvconf
# nameserver 8.8.8.8
# nameserver 8.8.4.4
nameserver 127.0.0.1
options edns0

/usr/local/etc/pf.conf
Code: 
### Macros
ext_if="igb0"
int_if="igb1"
int_net="172.16.1.0/24"

### Options
set block-policy drop
set skip on lo0

### Normalization
#scrub in all random-id frag reassemble

### NAT
nat on $ext_if from $int_net to any -> ($ext_if).

### Default Deny
block in all

### Pass local network traffic
pass out quick on $ext_if from any to any

### Pass Internal Traffic Out
pass in quick on $int_if from $int_net to any keep state
pass out quick on $ext_if from $int_net to any keep state

### Pass Gateway Services
pass in on $int_if proto udp from $int_net to port domain keep state
pass in on $int_if proto tcp from $int_net to port domain keep state

### ALLOW PING FROM INSIDE
pass in on $int_if proto icmp all
 
Aknot said:
is DHCP on igb0 overwriting the resolve.conf file?
Click to expand...
It's /etc/resolv.conf (without the e), but yes, that's very likely. Your defaultrouter will get changed too. Set defaultrouter if you use static IP addresses, don't set it for DHCP. DHCP typically sets the IP address, subnet mask, gateway address and often one or two DNS servers.
 
If you dont want dhcp changes, you can put this into /etc/resolvconf.conf:
Code: 
resolvconf=NO

nameserver 127.0.0.1 <-- local-unbound? Did you try local-unbound-setup?
 
Aknot said:
I have successfully set up a working FreeBSD gateway, but I can't get DNS to work from the gateway itself, when working in the shell.
I'm not sure what's wrong, or what I miss, is DHCP on igb0 overwriting the resolv.conf file?

This is what I have:

/etc/rc.conf
Code: 
gateway_enable="YES"
defaultrouter="192.168.8.100"
ifconfig_igb0="DHCP"
ifconfig_igb1="inet 172.16.1.1 netmask 255.255.255.0"

/etc/resolv.conf
Code: 
# Generated by resolvconf
# nameserver 8.8.8.8
# nameserver 8.8.4.4
nameserver 127.0.0.1
options edns0

/usr/local/etc/pf.conf
Code: 
### Macros
ext_if="igb0"
int_if="igb1"
int_net="172.16.1.0/24"

### Options
set block-policy drop
set skip on lo0

### Normalization
#scrub in all random-id frag reassemble

### NAT
nat on $ext_if from $int_net to any -> ($ext_if).

### Default Deny
block in all

### Pass local network traffic
pass out quick on $ext_if from any to any

### Pass Internal Traffic Out
pass in quick on $int_if from $int_net to any keep state
pass out quick on $ext_if from $int_net to any keep state

### Pass Gateway Services
pass in on $int_if proto udp from $int_net to port domain keep state
pass in on $int_if proto tcp from $int_net to port domain keep state

### ALLOW PING FROM INSIDE
pass in on $int_if proto icmp all
Click to expand...
First of all, this is likely not what you want and blocking ICMP will break things.
See https://forums.freebsd.org/threads/generic-nat-firewall-pf-config-template.60144/

You probably don't need to change the DNS on the gateway itself (as accessing distsites is about the only thing it'll ever do unless it's used as a workstation too) but you might want to have a look at something like blocky/adblockhome/* and point your clients to it on your internal interface.
 
I have made some tests now, and as expected, adapter igb0 get both its Gateway IP and DNS IP from the Internet Router, which is a Huawei 4G SIM Card router (before testing on the fiber). Default is 192.168.8. on this router btw.

Code: 
lease {
  interface "igb0";
  fixed-address 192.168.8.100;
  option subnet-mask 255.255.255.0;
  option routers 192.168.8.1;
  option domain-name-servers 192.168.8.1;
  option dhcp-lease-time 86400;
  option dhcp-message-type 5;
  option dhcp-server-identifier 192.168.8.1;
  option dhcp-renewal-time 43200;
  option dhcp-rebinding-time 75600;
  option option-213 "urn:www-huawei-com:service:NetworkSyncService:1";
  renew 5 2026/7/17 20:04:38;
  rebind 6 2026/7/18 05:04:38;
  expire 6 2026/7/18 08:04:38;
}

I already had supersede set, and have tried resolvconf=NO with no luck.

Now to the funny part, when pinging from the gateway itself.

If I ping microsoft.se:

Code: 
# ping microsoft.se
PING microsoft.se (20.231.239.246): 56 data bytes
64 bytes from 20.231.239.246: icmp_seq=0 ttl=108 time=119.265 ms
64 bytes from 20.231.239.246: icmp_seq=1 ttl=108 time=127.239 ms
64 bytes from 20.231.239.246: icmp_seq=2 ttl=108 time=125.466 ms
...
^C
--- microsoft.se ping statistics ---
4 packets transmitted, 4 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 119.265/125.445/129.811/3.888 ms

If I ping microsoft.com
Code: 
# ping microsoft.com
ping: UDP connect: No route to host


I havent tested diizzy tips yet, if this is related to PF.
Also might need to test this live on our fibre.
 
You must log in or register to reply here.
Back
Top