3

Is there any way to use pfsense as caching DNS server. It will resolve domains starting from root servers and will cache them for consequent hits.

I tried DNS servers package on pfsense 1.2.2, which I guess uses WAN dns serversby default.

Improve this question

3 Answers 3

Reset to default
1

2nd UPDATE:

The current versions of pfSense (2.2+) are now based on FreeBSD 10.X. This includes Unbound as the resolver. You can point Unbound at the resolvers at OpenDNS or Google.

[True for pfSense 2.1 and lower]

pfsense has a DNS cache, it is called dnsmasq. It doesn't start from the root servers. By default, it will take the DNS from the WAN DHCP server, but you can override that from the web page. I would point the box to an open DNS server, like

Google's at 8.8.8.8, Level3 at 4.2.2.1, 4.2.2.2 OpenDNS at 208.67.222.222, 208.67.220.220

The root servers are busy, so I wouldn't suggest starting with them. Use the addresses above and you should get better performance.

UPDATE:

Based on the comment below that states that dnsmasq is not a cache (not true, dnsmasq does cache responses, just not all types of records, see dnsmasq), I'd like to point out that there is another package on pfSense that does full DNS caching. Unbound is a full DNS resolver with support for DNSSEC (signed DNS requests). If you want a "full and complete" DNS cache, install that instead of using dnsmasq (which comes by default).

NOTE: There is one thing to be aware of when using Unbound. During an upgrade to the system, if you have pfSense itself set to only use Unbound as a resolver, DNS will fail because the packages are not be installed until after the OS is installed (but the OS upgrade requires DNS to get the packages). In this case, make sure that there are backup DNS resolvers for pfSense to use during an upgrade.

Improve this answer
4
  • this is a workaround, but not suitable for my situation. btw thanks.
    – dereli
    Jan 21, 2010 at 9:18
  • this should not be the accepted answer, dnsmasq does not cache responses
    – levinalex
    Jul 12, 2014 at 18:41
  • According to thekelleys.org.uk/dnsmasq/doc.html, dnsmasq does do caching of common DNS responses. Think of it as a stripped down DNS cache.
    – Walter
    Jul 28, 2014 at 23:01
  • UPDATE: the current version of pfSense (2.2.X) uses Unbound as the resolver and not dnsmasq.
    – Walter
    Mar 31, 2015 at 18:32
1

A pfSense forum thread suggests installing the DNS package for tinydns, and then adjusting the cache size to suit your needs.

Improve this answer
4
  • This did not work for my case.
    – dereli
    Nov 23, 2009 at 6:42
  • Why did it not work?
    – Zanchey
    Nov 23, 2009 at 7:26
  • By "did not work", I meant DNS server did not resolve host names.
    – dereli
    Nov 24, 2009 at 14:49
  • TinyDNS is an authoritative DNS server only. The DJBDNS package that it came from has a separate program that does recursive DNS called dnscache. A 'caching DNS server' is usually what people call something like BIND without any local domains.
    – Walter
    Dec 30, 2009 at 22:03
1

You can use the Unbound pacakge for this.

https://doc.pfsense.org/index.php/Unbound_package

Improve this answer
1
  • I used this. Works very well on pfsense 2.1
    – levinalex
    Jul 12, 2014 at 18:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .