leiweibau / Pi.Alert

Scan the devices connected to your WIFI / LAN and alert you the connection of unknown devices. It also warns if a "always connected" device disconnects. In addition, it is possible to check web services for availability. For this purpose HTTP status codes and the response time of the service are evaluated.
https://leiweibau.net
GNU General Public License v3.0
342 stars 25 forks source link

QUESTION: Not picking up host names #247

Closed holocronology closed 5 months ago

holocronology commented 6 months ago

I'm not sure if this is a bug or likely a configuration issue.

My network router is running bare metal OPNsense. Most of my devices have static IP and hostnames defined in the DHCPv4 server.

My DNS is configured as AdGuard Home (on Proxmox) > Unbound DNS > Out to DNSoverTLS servers.

I'm running this installation of Pi.Alert on the same Proxmox server as AdGuard Home. I'm not sure what changed, but since the last update I am not getting any hostname data. Previously it would autopopulate with the hostnames from my routers.

Now I see: image

or

image

Note that 10.10.0.57 is my AdGuard instance--aka primary DNS.

leiweibau commented 6 months ago

If it worked before, maybe the sourcery optimization broke something. I will undo this.

leiweibau commented 6 months ago

What happens, when you run the command dig +short -x ONE_UNKNOWN_HOST_IPwith the IP of one for the (unknown) hosts instead of ONE_UNKNOWN_HOST_IP? Do you get an error or a hostname?

holocronology commented 6 months ago

dig +short -x ONE_UNKNOWN_HOST_IP

I get no response running it on the shell of the LXC or the host.

leiweibau commented 6 months ago

That is a sad. With this command, the backend tries to determine hostnames that it has not yet been able to determine using other methods. Do you have the possibility to install "avahi-utils" in the container and then execute the command avahi-resolve -a ONE_UNKNOWN_HOST_IP (replace ONE_UNKNOWN_HOST_IP with an IP of an unknown host)? Or for example avahi-resolve -a 10.10.0.57.

leiweibau commented 6 months ago

what happens when you modify the command to dig +short -x ONE_UNKNOWN_HOST_IP @10.10.0.57 (replace ONE_UNKNOWN_HOST_IP with an IP of an unknown host)?

holocronology commented 6 months ago

image

holocronology commented 6 months ago

I don't know if this is helpful.

I have a printer on my local network that has a host name assigned to it on my OPNsense router with a static IP. So, even without something like NPM set up, it will resolve from hostname.localnet.net to the correct address.

image

The above is from inside the command shell of the pi.alert lxc.

I wonder if Pi.Alert is getting tripped up because when AdGuard processes and then forwards to the upstream DNS server (Unbound DNS on my OPNsense router) it does so on port 65353 and my firewall is set up to allow DNS on the LAN on that port.

leiweibau commented 6 months ago

At that moment, your DNS simply does not seem to have a hostname for this IP. In addition to "dig", I have added "avahi-resolve" as a source for determining the host name and also created the option to explicitly specify a DNS server in the configuration that is to be used for name resolution, as with the command "dig +short -x ONE_UNKNOWN_HOST_IP @10.10.0.57"

Have you tried to install the avahi-utils and test for example avahi-resolve -a 10.10.0.80?

If Adguard uses an upstream DNS for name lookup, how is upstream DNS supposed to recognize your hostname? Is Adguard your only DNS server in the LAN?

leiweibau commented 6 months ago

I wonder if Pi.Alert is getting tripped up because when AdGuard processes and then forwards to the upstream DNS server (Unbound DNS on my OPNsense router) it does so on port 65353 and my firewall is set up to allow DNS on the LAN on that port.

As interesting as I find OPNsense or pfSense, I have no experience with them at the moment, so I can't help here.

holocronology commented 6 months ago

option to explicitly specify a DNS server in the configuration that is to be used for name resolution

I thought this might be the case but for some reason I was unable to find it. Let me check to see if that helps. I appreciate the assistance thus far.

holocronology commented 6 months ago

Is this what you were referring to? image

leiweibau commented 6 months ago

Is this what you were referring to?

No. This entry is used to determine a rogue DHCP server.

The configuration option I am referring to has not yet been published, as I only run such things for a few days to see if there could be any problems. I am referring to this commits in the "next_update" branch https://github.com/leiweibau/Pi.Alert/commit/27800d3a398cadfc1fd0296075ba22759510c16b, https://github.com/leiweibau/Pi.Alert/commit/ad1ab0aca1c8e8fce9fb40e3a6b7eee53c8711ae, https://github.com/leiweibau/Pi.Alert/commit/7ba156f184374b7b5f0d83e4b701f6623f47d40c, https://github.com/leiweibau/Pi.Alert/commit/cea08ecb06574c4ba28e72d0e3ad22fdf9fc5f36

leiweibau commented 5 months ago

I have added 2 more methods for hostname detection (mDNS and Netbios). It is important that Pi.Alert gets through the firewall to be able to query these protocols. The same still applies to DNS, of course. If you create a DNS entry in your DNS server for each device in question, name resolution should no longer be a problem at all, as long as Pi.Alert can reach the DNS server.