Block All VLANs

zinder · May 12, 2022, 7:58 PM

Why DNS works puzzles me also. From a DOS box on a PC on 192.168.20.0/24....

ipconfig
DHCP Enabled. . . . . . . . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.20.10(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.20.1
DHCP Server . . . . . . . . . . . : 192.168.20.1
DNS Servers . . . . . . . . . . . : 192.168.20.1

ping google.com
Pinging google.com [142.250.31.102] with 32 bytes of data:
Reply from 142.250.31.102: bytes=32 time=17ms TTL=106
Reply from 142.250.31.102: bytes=32 time=11ms TTL=106
Reply from 142.250.31.102: bytes=32 time=18ms TTL=106
Reply from 142.250.31.102: bytes=32 time=16ms TTL=106

Ping statistics for 142.250.31.102:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 11ms, Maximum = 18ms, Average = 15ms

ping 192.168.20.1
Pinging 192.168.20.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.20.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

johnpoz · May 12, 2022, 8:08 PM

@zinder said in Block All VLANs:

From a DOS box on a PC on 192.168.20.0/24....

so do a nslookup or something..

My "guess" would be your browser is actually using doh to do dns, to google dns or something - you know because you as the admin of your network are too stupid to manage it securely - so we are going to in your best interest point to our doh servers for dns..

The different browsers are moving towards doh being default - now the user/admin has to go out of their way to make sure browsers don't do doh..

That would be my guess, because your rules are not allowing for dns to work.. So in that scenario it would not be possible for your browser to access the internet.. Unless it was using somethinig else for dns - like doh.

this is the curious one

Pinging google.com [142.250.31.102] with 32 bytes of data:

windows shouldn't be able to resolve that, unless it was cached.. Even if your browser was using doh.. do a nslook for something that you haven't looked up before..

Or flush your local dns cache.. ipconfig /flushdns

zinder · May 12, 2022, 8:42 PM

I appreciate your help, but I don't think calling me stupid was necessary. I'm new to some of this and I'm testing to ensure a secure network.

I tried to ping google.com from a cmd prompt on another PC on 192.168.20.0/24 and its not finding it. So it appears to be blocked..as you say. If I run Firefox, then the cmd prompt can ping google.com, but DoH is not checked. So it does seem to be related.

I'll look into the rules in your example.

johnpoz · May 12, 2022, 8:52 PM

@zinder said in Block All VLANs:

but I don't think calling me stupid was necessary

I wasn't calling you stupid ;) heheh Its the browser makers thinking all users are too stupid to run their own networks or dns.. heheh It was not meant at you directly at all..

They like to enable doh by default.. I am all for them offering up dns if they want - but it should be required OPT in, not any sort of default... Its like they think users that want to use doh are too stupid or lazy to click the button to opt in.. So they will do it for you..

Chrome is doing it too.. If I wanted to send you all my dns, I would - setting the default to use anything other than my OS dns is not a good direction... If I want to use doh, it should be an OPT in where the user has to actually select it, not default.. Or the admin has to configure it..

zinder · May 12, 2022, 8:57 PM

This DoH thing doesn't make much sense. Maybe something is in a cache somewhere. On one PC, ping google.com didn't work from a cmd prompt. I open Forefox and then ping google.com worked from the cmd prompt. I close FF and ping google.com still works. It seems, somehow, FF affects the cmd prompt. But DoH is turned off in FF Settings. I'll work on it more tomorrow.

flat4 · May 12, 2022, 9:07 PM

@johnpoz said in Block All VLANs:

@zinder said in Block All VLANs:

but I don't think calling me stupid was necessary

I wasn't calling you stupid ;) heheh Its the browser makers thinking all users are too stupid to run their own networks or dns.. heheh It was not meant at you directly at all..

They like to enable doh by default.. I am all for them offering up dns if they want - but it should be required OPT in, not any sort of default... Its like they think users that want to use doh are too stupid or lazy to click the button to opt in.. So they will do it for you..

Chrome is doing it too.. If I wanted to send you all my dns, I would - setting the default to use anything other than my OS dns is not a good direction... If I want to use doh, it should be an OPT in where the user has to actually select it, not default.. Or the admin has to configure it..

@johnpoz you can call me stupid..... What is DoH? no really

AndyRH · May 12, 2022, 9:12 PM

@flat4 DoH = DNS over HTTPS
It is a secure DNS request that happens on 443 so it is hard to see and stop.

johnpoz · May 12, 2022, 9:24 PM

@flat4 Doh is dns over https

https://en.wikipedia.org/wiki/DNS_over_HTTPS

Browsers are making it the default - and it bypasses your local dns, and sends all the dns requests from a browser to their dns servers over a 443 https tunnel - making it very difficult for a local admin to block..

While I am not a fan of it at all - I don't have a problem with browser makers offering it.. The problem is making it the default is not the way to go about it..

And then you run into issues like this user. They think their clients are using pfsense for dns, but clearly they are not because they have no rules that would even allow it.. Browser is circumventing the local dns by using doh is what seems to be happening..

See quite a few threads where users think something is broken in dns on pfsense, like host overrides not working - when their browsers isn't even asking pfsense dns because its using doh...

edit:
I have spent time I shouldn't have had to spend making sure my browsers and other devices are not circumventing what I have setup for dns on my network.. Dot (dns over tls) isn't as bad because it uses a specific port 853 which is easy enough to block. But using 443 is clearly an attempt to allow the browser to circumvent restrictions put in place on the network.. Circumvention of the local networks controls is not something I want my browser doing that is for damn sure.. If I don't want you looking up xyz, then you shouldn't go out of your way to look it up if I filter it on my dns..

You have a bunch of stuff now hard coding dns, or trying to use doh.. F!! off - use the dns I as the network admin hand you, or don't use any dns.. How is circumvention of my controls have anything to do with security or privacy.. No its about sending you dns, and allowing your thing to circumvent local controls..

If user wants to circumvent their ISP dns by using something like doh - then they should have to on purpose select to do that, after fully understand what is happening vs the browser maker making that decision.. There is no legit reason why such a thing should ever be "default"..

If you couldn't tell - not a fan of doh ;) hehehe

flat4 · May 12, 2022, 9:17 PM

@andyrh

thank you

flat4 · May 12, 2022, 9:30 PM

@johnpoz I would agree, I will now have to look at my devices to see if my family has accepted this without thinking about it.

For the record at first i thought DoH was a reference to Homer

johnpoz · May 12, 2022, 9:36 PM

@flat4 said in Block All VLANs:

DoH was a reference to Homer

Yeah I agree - its something stupid like Homer would do that is for sure ;)

zinder · May 13, 2022, 6:10 PM

Thanks to all for explaining doh. I changed my SecureLANs alias to not include the 192.168.20.0/24 network. So now, all PCs on 20.0 seem to get DNS, etc. I added a rule to block source from 20.0 network and destination to This Firewall/443. I think I'm good, unless I missed something else.