DNS resolution issue with High Availability

Networking & Firewalls
1

I finished setting up High Availability on my network.
The fallback works as expected when the main pfSense goes offline.

An issue that I’m encountering is DNS resolution on the backup pfSense.
Whenever the second pfSense takes over as the main, I am unable to resolve any DNS to the internet. I am able to ping 1.1.1.1 without any issue, and even ping google.com without any issue, at the moment of googling anything I am hit with a DNS page error.

System/General Setup/DNS Server Settings
1.1.1.1
8.8.8.8

Services/DHCP Server/VLAN
DNS Servers: 192.168.100.1 (CARP IP)
Gateway: 192.168.100.1 (CARP IP)
Failerover peer IP: 192.168.100.3 (Secondary PFSENSE)

Services/DNS Resolver/General Settings
DNS Query Forwarding (Enabled)
Outgoing Network Interfaces (ALL)

I also have some host overrides under DNS Resolver, and those work fine on the browser.

Any help would be appreciated, thanks!

2

What does your DHCP status page look like? Does they syncing say they are normal?

3

I should’ve been more specific. I am able to ping from pfsense2 to 1.1.1.1 and google.com. I am unable to ping 1.1.1.1 or google.com from my end user (laptop).

The DHCP status of the device appears as active in the backup pfsense. And in the end user running “ipconfig /all” I can see that the DHCP Server changes to the IP of the backup pfsense

4

A couple of weeks ago you had this setup:

My current setup consists of:
End user devices point to Windows Server for DNS.
Windows DNS Forwards all DNS to pihole.

Does the above still apply or are you using only PFSense for DNS?

5

Both apply. I am currently troubleshooting my Guest network, which uses DNS Resolver in pfSense. My other VLANs use Active Directory->PiHole.

I finished some more troubleshooting just now. It seems that if under Services/DHCP Server/VLAN/DNS servers I substitute the VLAN CARP IP 192.168.100.1 for an external IP 1.1.1.1 the DNS error gets fixed and browsing works.

This just makes me wonder why the VLAN CARP IP 192.168.100.1 does not work. I would think that this IP would point to pfSense DNS set up under System/General Setup/DNS (Which are 1.1.1.1 and 8.8.8.8)

6

Can you ping 192.168.100.1? I have a feeling that you have a network path problem as 192.168.10.1 is probably not accessible.

7

When pfSense1 is Master:
pfSense1 router can ping 192.168.40.1
End user laptop can ping 192.168.40.1 (can browse without an issue)
pfSense2 cannot ping to 192.168.40.1

When pfSense2 is Master:
pfSense1 router is down
End user laptop cannot ping 192.168.40.1 (Cannot ping or browse anything)
pfSense2 router can ping 192.168.40.1

8

You did not answer my question. Can you ping 192.168.100.1 when the primary is down.

9

I cannot ping 192.168.100.1 when the primary is down from the end user devices

10

A topology map would be helpful for the wan and lan of the PFSense devices and the device that cannot ping it. It sounds like you have a route when the primary is up but do not when it is down.

11

Here is an image representation and explanation:

INBOUND TRAFFIC
-Comcast modem is set to forward all traffic to DMZ and it specifies to forward all traffic to the IP 10.10.10.10 (WAN CARP IP)

OUTBOUND TRAFFIC
-End user has DNS, DHCP configured to LAN CARP IP 192.168.100.1
-Outbound NAT in both pfSense are configured to use WAN CARP IP

image
image1056×988 114 KB

I’m not sure how accurate this information is but in one of netgate youtube videos, they mention to delete outbound NAT if DMZ is enabled. [Minute 39:30]. He does not expand more on why, but this is the only information I’ve been able to gathered that is similar to my setup.

12

To follow my prior post. I deleted the Outbound rules for this specific VLAN and left them at default. DNS resolution is working now whenever pfSense2 becomes master.

13

Try something like the

image
image1185×755 146 KB

Is Carp setup setup on both PFSense instances and using /24 subnet mask?

14

This is what I have (No router between Comcast Modem and the pfSense firewalls). Both pfSense firewalls are connected directly to the modem as the it has six ethernet pots. The DMZ and internal IPv4 is also setup in Comcast modem.

a8b6eadcc7ce3e7b5fb175c879bad57382c51565
a8b6eadcc7ce3e7b5fb175c879bad57382c515651185×755 133 KB

Yes, both pfSense are using /24 subnet masks for CARP.
Without the outbound NAT configured to the CARP WAN IP, all VLANS are able to resolve DNS.

The only issue here now is about port forwarding rules. All port forwards have been changed to the WAN CARP IP. However, if a single VLAN happens to fail and pfSense2 becomes master only for that VLAN (Let’s say VOIP), the port forwards will still apply to pfSense1 as long as the device WAN is operational, and not pfSense2 where the VLAN is master. This causes incoming call issues