Microsoft Updates Not Progressing
-
@stormgate said in Microsoft Updates Not Progressing:
Unbound Mode only
Using this mode, after sorting, removing the doubles, all DNSBL info is placed in one file ( see it here - it(s the 'biggest' file ) and unbound is informed to read it during startup.
Unbound isn't fast at reading these files, so on every restart, it will take time, timing during your network has no DNS.The "python mode" is using a python script ( as the developers of unbound chose python as a script/API access for unbound ) : unbound loads the small python script, and can continue.
This python scripts handles the big DNSBL file access, and also adds some new features, like regex filtering, AAAA filtering, and gives you a way to exclude some LAN devices from being DNSBL filtered.
Python mode is well tested by now. -
Hmm, so your test was using python mode and it still caused huge delays with that massive list @Gertjan?
-
@gertjan Thank you, I will give it a try, as the issue with microsoft updates is far from fixed. One PC has been running since 5PM yesterday to get its updates and its at 20% on only one of them. So simply changing the mode is all I need to do to implement python?
-
Yup. See: https://forum.netgate.com/post/947354
-
@stephenw10 said in Microsoft Updates Not Progressing:
Hmm, so your test was using python mode and it still caused huge delays with that massive list @Gertjan?
Yep, I'm using python mode.
Most of the 'huge file' treatment doesn't change, as pfblockerng still has to download de DNSBL file.
Sort it.
Adding it to the 'main' DNSBL file, while taking care of 'doubles'.
This is done using PHP, and has nothing to with the 'Python mode" which is actually just a set of function used in the resolve process within unbound.PHP isn't famous for it text file parse power ;)
-
@gertjan said in Microsoft Updates Not Progressing:
PHP isn't famous for it text file parse power ;)
Ha! Indeed.
-
@stephenw10 Yeah I am starting to wonder if I have a DNS setup issue cause nothing seems to be work correct. Its not really blocking sites, even adult sites should be blocked regardless of pfblockerng because I am using cloudflares malware and adult site DNS values but they all still go thru. I followed so many different tutorials on DNS over TLS and making sure the devices only get their DNS form pfsense starting to question it.
-
If you have just entered cloudflare DNS in System > General Setup that will only do anything for clients if Unbound is set in forwarding mode. Otherwise it resolves dircetly and ignore those settings.
-
@stephenw10 Like this you mean.
-
@stormgate But I don't have this checked.
-
Yup, like that. In forwarding mode you should usually disable DNSSec also.
You don't need to have Unbound respond to DoT queries internally.
-
@stephenw10 Thanks yes DNSsec is unchecked.
-
@stephenw10 And these are the rules I was told to setup to make this all happen.
-
@stormgate said in Microsoft Updates Not Progressing:
@stormgate But I don't have this checked.
@stormgate said in Microsoft Updates Not Progressing:
@stormgate But I don't have this checked.
Windows 11 Pro might handle DNS over TLS port 853.
Windows 10 : no-go (but you could install an add-in utility).Btw : You only need to encrypt your own local DNS traffic if you do not trust your own wiring ;)
This :
only works if you set up each LAN client individually.
It's TLS - so you can't use a an IP, you need a fqdn, and this fqdn must be part of he certificate unbound uses to initiate the TLS traffic.
Like https..... (which is http over tls). -
Those rules are on LAN I assume?
That will prevent clients using external DNS and DNSoverTLS servers.
A rule with destination 127.0.0.1 can never match anything. Localhost like that is only valid on the host itself. Unless you have already added a port forward to redirect.
Those rules don't block DNSoverHTTPS so clients that use that will get real results.
You are ofetn better off redirecting DNS traffic to pfSense. That way anything hard coded with an external server, like 8.8.8.8, will still be able to resolve:
https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.htmlSteve
-
@stephenw10 Headed to work and will have a look, too me it didn't look right but not being an expert I took the recommendations on the rules. What is the best method on this device to take when it comes to up a secure DNS environment that works and allows the categories to be blocked correctly. I'll look at that link.
-
@stephenw10 I think I may see the issue, I do have the DNS over TLS NAT rule but I guess I need one for each VLAN, its only only setup on the Default Vlan. But maybe the rules themselves need some work also.
-
@stormgate
Why would you want to use DNS over TLS on the pfSense LAN side & VLAN side ?
You will be one of the first to do so among the pfSense user base, over 100 000 (this is very IMHO).
Again : you will have to configure every LAN/VLAN device ! See [https://en.wikipedia.org/wiki/DNS_over_TLS](https://en.wikipedia.org/wiki/DNS_over_TLS.It can be done of course.
I've installed a Windows 10 Pro DNS-over-TLS client just a couple of days ago.If you want to make your traffic invisible, go for the much simpler VPN tunnel.
Or do you really want to MITM with pfSense ? ;)
-
@gertjan Only because I thought DNS over TLS was a better secure setup, but I have no other reason. I would be prefer to set it up so its reliable and works for everything and yet secure. Would you simply recommend setting up DNS (53) with a some rules? This system is going to be thousands of kms away so I have no margin for error, so the most recommended setup is what I will adhere too. Thanks
-
Category based DNS filtering on the firewall can only be done via pfBlocker like that.
You can block DoH using IP lists in pfBlocker. Obviously that's not 100%
Firefox will look for a specific domain locally and not use DoH if it finds it. But users can still force it to use DoH.
https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-httpsSteve
