I'm setting up Pfsense to replace our existing firewall with. Currently the setup is pretty straight forward.

  • I have internet connected to my wan port
  • connected a switch to the lan port
  • connected my desktop to the switch

I use 1 vlan (10) which is assigned to the lan port. The switch is configured so it handles the vlan correctly. I use (Pfsense) DHCP on the VLAN and my desktop get an ip in the configured range and also the DNS servers on my desktop are correctly set. ( and by DHCP) The DNS resolver settings are still default (Enabled, network interfaces all, outgoing network interfaces all) and DNS forwarder is disabled.

My NAT settings are set to Automatically outbound NAT rule generation and i configured a firewall rule on the VLAN to allow all traffic (for test purposes) enter image description here

I can ping from my desktop AND Pfsense diagnostics. I cannot ping nu.nl for example from my desktop but i can from Pfsense diagnostics.

Why cant i resolve the domain on my desktop? I think i need to configure an extra firewall rule or something but i have no idea which one as i currently allow all traffic...

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Dec 17, 2020 at 17:29

2 Answers 2


I noticed that i only allowed TCP traffic instead of TCP and UDP. I changed my rule to allow TCP and UDP and this solved my problem.

  • 2
    DNS uses (mostly) UDP, but ping uses ICMP echo requests/replies that might need additional rule permission.
    – Zac67
    May 14, 2020 at 10:51

Firewall -> NAT -> Outbound -> Mode

(Checklist) Automatic outbound NAT rule generation 

///Then Scroll to the Bottom

Mappings -> Add ->

(No Checklist) "Disabled" 
(No Checklist) "Do not NAT"
(LAN) "Interface"
(IPv4) "Address Family"
(TCP/UDP) "Protocol"
(Any) "Source"
(Any) "Destination"
(No Checklist) "Not"
(Interface Address) "Address"
(No Checklist) "Static Port"
(No Checklist) "No XMLRPC Sync"

-> Save

//// Then Setting The DNS Forwarder

Services -> DNS Forwarder ->

(Checklist) "Enable DNS forwarder"
(53) "Listen Port"
(ALL) "Interfaces"

-> Save

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.