Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there any way to use pfsense as caching DNS server. It will resolve domains starting from root servers and will cache them for consequent hits.

I tried DNS servers package on pfsense 1.2.2, which I guess uses WAN dns serversby default.

share|improve this question

3 Answers 3

up vote 0 down vote accepted

pfsense has a DNS cache, it is called dnsmasq. It doesn't start from the root servers. By default, it will take the DNS from the WAN DHCP server, but you can override that from the web page. I would point the box to an open DNS server, like

Google's at 8.8.8.8, Level3 at 4.2.2.1, 4.2.2.2 OpenDNS at 208.67.222.222, 208.67.220.220

The root servers are busy, so I wouldn't suggest starting with them. Use the addresses above and you should get better performance.

UPDATE:

Based on the comment below that states that dnsmasq is not a cache (not true, dnsmasq does cache responses, just not all types of records, see dnsmasq), I'd like to point out that there is another package on pfSense that does full DNS caching. Unbound is a full DNS resolver with support for DNSSEC (signed DNS requests). If you want a "full and complete" DNS cache, install that instead of using dnsmasq (which comes by default).

NOTE: There is one thing to be aware of when using Unbound. During an upgrade to the system, if you have pfSense itself set to only use Unbound as a resolver, DNS will fail because the packages are not be installed until after the OS is installed (but the OS upgrade requires DNS to get the packages). In this case, make sure that there are backup DNS resolvers for pfSense to use during an upgrade.

share|improve this answer
    
this is a workaround, but not suitable for my situation. btw thanks. –  dereli Jan 21 '10 at 9:18
    
this should not be the accepted answer, dnsmasq does not cache responses –  levinalex Jul 12 at 18:41
    
According to thekelleys.org.uk/dnsmasq/doc.html, dnsmasq does do caching of common DNS responses. Think of it as a stripped down DNS cache. –  Walter Jul 28 at 23:01

A pfSense forum thread suggests installing the DNS package for tinydns, and then adjusting the cache size to suit your needs.

share|improve this answer
    
This did not work for my case. –  dereli Nov 23 '09 at 6:42
    
Why did it not work? –  Zanchey Nov 23 '09 at 7:26
    
By "did not work", I meant DNS server did not resolve host names. –  dereli Nov 24 '09 at 14:49
    
TinyDNS is an authoritative DNS server only. The DJBDNS package that it came from has a separate program that does recursive DNS called dnscache. A 'caching DNS server' is usually what people call something like BIND without any local domains. –  Walter Dec 30 '09 at 22:03

You can use the Unbound pacakge for this.

https://doc.pfsense.org/index.php/Unbound_package

share|improve this answer
    
I used this. Works very well on pfsense 2.1 –  levinalex Jul 12 at 18:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.