DNS set to gateway, External Queries Blocked on UDP 53

[cybrnook]

Riddle me this...... I have been tracing a little Gremlin that I finally figured out this morning. I run about 15 or so plugins, and I use CA Auto Update plugin to do nightly checks for plugins and dockers. It's been working for a while now, until recently I noticed that update checks were hanging, not completing all the way. If I ran a manual check, I could see it make it to 3 or 4 plugins, then hang. Try again, and it makes it through 6 or so. Try it again it completes. Try it again, hangs after two. Has been driving me bonkers. I was thinking github was down or something.

 

Things I tried:

- Change Unraid DNS settings from gateway to 8.8.8.8 / 8.8.4.4  | no change

- Disabled notifications -> check for update for plugins / dockers, let auto update do it's thing  | no change

- Assign manually 8.8.8.8 / 8.8.4.4 to unraid in pfsense  | no change

- Pull one of the two cables in my active/backup bond  | no change

- reboot pfsense  | no change

- reboot unifi switches  | no change

- reboot unraid  | no change

 

UNTIL!!! I had that ah-ha moment. I logged in via ssh, and cat'd out the hosts file and resolv.conf. Hosts file had your standard entries, local host for unraid and a hard coded ip for unraid keys server. Then resolv.conf had whatever I was pushing, when I set unraid to use google, it had google. When I pushed gateway as dns, then it was 192.168.1.1, again all good. So I tried pinging google.com from os, nothing...... tried pinging github.com (since CA FCP was bitching at me), again nothing....... I thought WTF....

 

So I went into pfSense and remembered that I recently blocked UDP port 53 for anything on my LAN network UNLESS it was from LAN to LAN (https://docs.netgate.com/pfsense/en/latest/dns/blocking-dns-queries-to-external-resolvers.html), meaning : unless you are something on my network trying to resolve UDP 53 against 192.168.1.1, then go pound sand. The moment I disabled the block rule on UDP 53 it all came back to life.

 

So my question is, if I have unraid set to use 192.168.1.1 as it's DNS server, why is it facing issues when I block 53 to external queries? Is Unraid hardcoded in some places to bypass your defined DNS and try and resolve queries on it's own with it's own DNS servers?