Problem with DNS forwarding

[Stage4972]

Hi, I'm having troubles with the DNS forwarder. My setup is PFSense (192.168.1.1) as gateway / dhcp / dns and Zentyal 8 (192.168.1.10) as DC forwading the DNS to the PFSense. While Zentyal forwards all internet DNS queries upstream it fails to forward .lan names and just gives ** server can't find pfsense.lan: SERVFAIL. I need the DNS forwarder to forward .lan dns queries because PFSense has to resolve them. The same setup with same settings worked on Zentyal 7. How can I debug that.

Code: [Select]

root@dc:/etc# nslookup pfsense.lan
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: pfsense.lan
Address: 192.168.10.1

root@dc:/etc# nslookup google.com
Server: 127.0.0.1
Address: 127.0.0.1#53

Non-authoritative answer:
Name: google.com
Address: 142.251.140.78
Name: google.com
Address: 2a00:1450:4017:815::200e

root@dc:/etc# cat /etc/bind/named.conf.options

options {
        sortlist {
                192.168.1.0/24;
        };
directory "/var/cache/bind";

// If there is a firewall between you and nameservers you want
// to talk to, you may need to fix the firewall to allow multiple
// ports to talk.  See http://www.kb.cert.org/vuls/id/800113

//========================================================================
// If BIND logs error messages about the root key being expired,
// you will need to update your keys.  See https://www.isc.org/bind-keys
//========================================================================
dnssec-validation auto;

listen-on-v6 { none; };

        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.
        forward first;
        forwarders {
                192.168.1.1;
        };

        tkey-gssapi-keytab "/var/lib/samba/private/dns.keytab";

    auth-nxdomain no;    # conform to RFC1035

    allow-query { any; };
    allow-recursion { trusted; };
    allow-query-cache { trusted; };
    allow-transfer { internal-local-nets; };
};

logging { category lame-servers { null; }; };
root@dc:/etc# cat /etc/resolv.conf

# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# and managed by Zentyal.
#
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
#
nameserver 127.0.0.1
search lan

Thanks

EDIT: I've compared the  /etc/bind/named.conf.options file between zentyal 7 and 8 and actually one this line was changed and and when I reverted it to Zentyal 7 version it fixed the issue for me:
Zentyal 8: dnssec-validation auto;
Zentyal 7: dnssec-validation yes;

I have no idea why but I'm leaving this here if anyone encounters the same problem.

EDIT: this file get recreated on reboot. Any idea how to make my change persitant?

[Siroco]

Hi,
To make changes persistent in Zentyal, you must use stubs. Below you have the link to the official documentation about stubs.
 https://doc.zentyal.org/en/appendix-c.html#stubs
Best regards.

[Stage4972]

Just what I needed. Thanks