pfBlockerNG-devel Not Blocking Malvertizing on LAN
-
@gertjan I read the post your provided. I am forwarding, at least the way I read the entry for the checkbox, "If this option is set, DNS queries will be forwarded to the upstream DNS servers defined under System > General Setup...", because I thought pfSense would use the DNS servers that I want it to use, not my ISP DNS servers, but the ones that I define only. I'm not a big proponent of using the Google's DNS servers or my ISP's DNS servers. I'm glad that pfSense gives me a choice. Anyway, maybe I have the incorrect understanding of the language for that checkbox. Here is my DNS Forwarder page. Now I'm a little confused. I don't have it selected so I'm not forwarding?
Before I uncheck Enable DNSSEC Support, I just want to make sure I understand (remember, I'm no network guru) that the unbound DNS Resolver does DNSSEC already?
-
And then they wonder why we try to block their snooping!
-
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
Here is my DNS Forwarder page. Now I'm a little confused. I don't have it selected so I'm not forwarding?
pfSense contains an forwarder, dnsmasq (the name of the process).
It still present and isn't activated by default. You don't need to use the forwarder (and if you do, disable the resolver/unbound first with the top most check box on it's settings page !). See it as as a extra possibility to do "DNS".Unbound, the resolver can do both. So unbound can resolve, or forward.
The checkbox discussed above is the main switch between these two functionalities.
It can resolve, that's why pfSense included it several years ago, and it can do forwarding for those who like to do, have no choice, or whatever.@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
at least the way I read the entry for the checkbox, "If this option is set, DNS queries will be forwarded to the upstream DNS servers defined under System > General Setup...", because I thought pfSense would use the DNS servers that I want it to use, not my ISP DNS servers , but the ones that I define only.
And you are correct.
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
Before I uncheck Enable DNSSEC Support, I just want to make sure I understand (remember, I'm no network guru) that the unbound DNS Resolver does DNSSEC already?
See it like this :
If you want to use DNSSEC you need to use the unbound as a resolver, not a forwarder.
To answer the question : why is this so ? you need to understand what dnssec is, what it isn't.
Just keep in mind what's easy to remember : dnssec needs resolving, not forwarding. -
@gertjan Maybe I should have asked it like this. Seeing I have Cloudflare DNS servers entered in pfSense to use instead of any others, in Services > DNS Resolver > General Settings, if I uncheck DNS Query Forwarding - Enable Forwarding Mode, will pfSense continue to use the Cloudflare DNS servers I entered or different DNS servers?
As well, from the below screenshot, apparently if I uncheck Enable Forwarding Mode, the box right below, Use SSL/TLS for outgoing DNS Queries to Forwarding Servers, my DNS queries will no longer be encrypted? Do I have to uncheck that as well or if it remains checked, will my DNS queries still be encrypted?
I did a test with DNS Leak Test dot com [https://www.dnsleaktest.com/]. I found that with the Enable Forwarding Mode checked, this is the result of the Extended Test:
When I uncheck the Enable Forwarding Mode, the DNS Extended Leak Test shows:
-
@newuser2pfsense
When you use "Cloudflare DNS servers", you are not resolving, but forwarding to an upstream DNS resolver.
Cloudflare DNS is a resolver.
Added to that, Cloudflare DNS servers supports DNS over TLS.When unbound is in the default Resolving mode, TLS, port 853, is 't available, as as far as I know, root and tld servers, and most domain name servers, don't support this mode yet.
Root servers (13 of them, and all there CDN's over the world) typically only receive "where are/is the DNS = TLD that handles dot com" (if you were asking domain.com). Then a TLD server would handle "where is the domain name server of domain.com" - and finally a domain name server would handle your entire request.While TLS isn't available when resolving, DNSSEC is, which mans that you can be sure of the received data, that it wasn't get spoofed. For those domains that support DNSSEC, that is.
Btw : supporting TLS while doing resolving means that every server in chain must support TLS. That will need a 100++ fold processing increase load on every server in the chain.
Cloudflare, Google DNS support TLS, as for them, the DNS service, while you are not paying, they make a revenue out of it, as your data is 'value' to them that can be sold.
-
@gertjan Thanks for all of the explanations. It helps. So I've unchecked Enable Forwarding Mode and kept the other boxes checked such as Enable DNSSEC Support and Use SSL/TLS for outgoing DNS Queries to Forwarding Servers. Hopefully this is OK?
Interestingly though, I'm still getting a 127.0.0.53 using nslookup.
Using Firefox on my LAN, email malvertising images are still coming through. Maybe it's a Firefox and Gmail thing?On my iPhone, I'm using Apple's native email app. Maybe this is why malvertising is blocked when displayed through this email app when checking my Gmail?
-
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
nd kept the other boxes checked such as Enable DNSSEC Support and Use SSL/TLS for outgoing DNS Queries to Forwarding Servers. Hopefully this is OK?
Unbound can't do DNSSEC, as DNSSEC needs resolving, not forwarding.
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
I'm still getting a 127.0.0.53 using nslookup
Running nslookup on which device ?
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
Using Firefox on my LAN, email malvertising images are still coming through. Maybe it's a Firefox and Gmail thing?
Well, Firefox can decide, according settings, to do it's own DNS, totally bypassing pfSense.
Check FF settings.@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
On my iPhone, I'm using Apple's native email app. Maybe this is why malvertising is blocked when displayed through this email app when checking my Gmail?
The iPhone email app, the iPhone uses probably the DNS it got from pfSense, which is unbound. As unbound uses pfBlockerNG as a filter, now it works.
-
@Gertjan
When I run nslookup using a host on my LAN is where I get the 127.0.0.53 below:nslookup google.com
Server: 127.0.0.53
Address: 127.0.0.53#53When I go to pfSense > Diagnostics > Command Prompt and run nslookup, I get the following:
Shell Output - nslookup google.com
Server: 127.0.0.1
Address: 127.0.0.1#53Ive checked my Firefox settings and I believe it to be using the correct settings. Hmmm
.So this is where I'm still a bit confused... I left the box DNSSEC checked and I unchecked the box Enable Forwarding Mode.
Unbound can't do DNSSEC, as DNSSEC needs resolving, not forwarding.
If I unchecked Enable Forwarding Mode, is it resolving? If it's not resolving, what do I need to configure and where? What boxes do I need to check? I seem to be missing something here.
-
@Gertjan
Per an above post 127.0.0.53 is:Linux systemd "DNS Resolver daemon"
Hence I had suggested using "nslookup site_name 192.168.1.1" to test a particular site that should be blocked.
If it works (is the blocked IP) while forcing the use of 192.168.1.1, then pfBlocker is working as designed.
If it does not work using 127.0.0.53 then that daemon is apparently not using 192.168.1.1.
-
Linux host ?
Type in the magic command that shows what name server it is using :cat /etc/resolv.confIt probably tells you
127.0.0.1so you have a process listeing on port 127.0.0.1:53 that handles DNS for your host.
This could be, for example, bind, or dnsmasq, or, why not, unbound.
This bind, or dnsmasq, or, unbound can
For unbound and bind : resolve - thus complely bypassing pfSense.
Or, for bind, or dnsmasq, or, unbound : forward to your upstream pfSense = 192.168.1.1, or to 8.8.8.8, or whatever. ask the administrator of your Linux host what he has decided.@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
If I unchecked Enable Forwarding Mode, is it resolving?
Yes, that's the pfSense default setting, resolving.
-
@gertjan
On pfSense, cat /etc/resolv.conf :Shell Output - cat /etc/resolv.conf
nameserver 127.0.0.1
nameserver 1.1.1.1
nameserver 1.0.0.1On a Linux host on my LAN, cat /etc/resolv.conf :
nameserver 127.0.0.53
It's good to know that I'm now resolving.
-
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
hell Output - cat /etc/resolv.conf
That file doesn't tell you if you resolve, or forward.
It informs the system about the IP addresses where DNS requests can be send.@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
It's good to know that I'm now resolving
So you can remove these : 1.1.1.1 1.0.0.1 from System >General Setup > DNS Server Settings
On your Linux host : who listens on 127.0.0.53 ?
If it is a process called dnsmasq then it forwards to some [ see dnsmasq settings ]
If it is bind, then it could do what does bind best : it resolves, which means it bypasses completely pfSense. bind can also be set up to forward to .... who ever you want. Could be pfSense, or some Alfabet company.
If it is unbound, .... same thing, look at the settings. -
@gertjan I removed the Cloudflare DNS server IP addresses. I also followed the instructions from this site [https://b3n.org/hijacked-slow-dns-unbound-pfsense/] for setting up unbound on pfSense. It states "Under Services > DHCP Server, set your DNS Server to your pfSense’s LAN IP. As your DHCP clients renew their lease they’ll start using pfSense for DNS." Seeing I have a LAN and WLAN in Services > DHCP Server, do I set each one respectively to each of their DHCP Server adddress as below?
LAN
WLAN
I remember when I very first configured pfSense when I knew nothing at all about it and was learning, I had searched for internet access rules because at the time I couldn't reach the internet (I did the search on my cell phone at the time as I recall). For my LAN and WLAN, I read a post from the search and I created 2 rules on both my LAN and WLAN (the image is for my LAN but it's the same on my WLAN):
I'm wondering if these 2 rules have anyting to do with the 127.0.0.53?I'm reading on this page [https://medium.com/@davetempleton/setting-up-dns-over-tls-on-pfsense-bd96912c2416] that I should be blocking port 53. I tried doing that by disabling the rule in the image above and I couldn't get to the internet so I had to re-enable it.
Interestingly, the DNS resolver listen port is 53:
Now I'm wondering by following the 2 sites I listed above, something may not be configured correctly. I haven't seen any malvertizing blocked using my iPhone's mail app where it was doing it before.
@SteveITS I haven't overlooked your response to this being the Linux systemd "DNS Resolver daemon".
-
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
I'm reading on this page [https://medium.com/@davetempleton/setting-up-dns-over-tls-on-pfsense-bd96912c2416] that I should be blocking port 53
Several conditions mus be valid when you want to use TLS over DNS.TLS over DNS to a "TLS over DNS capable server (resolver) ": unbound must be in forwarding mode.
Select a TLS over DNS capable server, like 1.1.1.1.First, set :
Set these two options :
And test, using https://1.1.1.1/help
Done
To use TLS over DNS on your local network :
Activate :
and now visit each device on your network, and make it use DNS over TLS using port 853.
For example, out of the box : Windows 10 can't do "TLS over DNS" (you need to install extra software). I've 'heard' that Windows 11 Pro can do it.
My iPhone : dono, I should look that up. Other pHones : never used them.
Great !
You've considered using this rule :
it always works, for everything.
About DJCP server settings :
For example, my WLAN network (my captive portal network) :
I'm using 192.168.2.1 as a DNS server, like you.
I've set 192.168.2.1 for good manners, but I presume We don't even need to do this.
As the DHCP server is set up to run on the 192.168.2.x network, it will include it's own IP as the DNS server, as my resolver listens to 192.168.2.1 (I've select 'All' interfaces on the resolver settings page) -
@gertjan Ok. So I have everything configured for unbound resolving now -
In System > General Setup > DNS Server Settings, I've removed all DNS server IP addresses.
In Services > DHCP Server > LAN & WLAN tabs > Servers > DNS Servers, I've removed the .1.1 and .2.1 DNS server IP addresses that I listed previously.
In Services > DNS Resolver > General Settings, I have set the below, however, I did not intentionally enable the Python Module - I don't know how it was checkmarked unless pfSense somehow checkmarked it for me for some reason. I'm not sure it should even be checkmarked. Any ideas???
When all of these settings were initially set and applied, pfBlockerNG wasn't blocking any iPhone mail app email malvertizing. A pfSense reboot solved that issue. This is back to normal.
For my LAN using Firefox, there must be some setting I'm missing that's allowing the malvertizing through. I'm not sure what that setting would be though.
The one thing I didn't want to do was use my ISP's DNS servers or the Google's DNS servers. That's why I was using Cloudflare DNS servers and forwarding. Cloudflare seems more secure to me. I don't know what Verizon can see with my internet traffic using unbound resolving???
-
Resolver settings :
Clear also the second one :
But harmless as firawarings want activated.
Set this one :
As static leases don't influence unbound, they are read in when the system boots, or when you you add a static lease, which is rare.
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
The one thing I didn't want to do was use my ISP's DNS servers
Normally, you don't use the DNS obtained by a WAN DHCP lease, as this settings is unchecked :
If the DHCP WAN lease from an upstream ISP router, or if the your ISP gives you a WAN DHCP lease, unchecking this option will pfSEnse discard DNS servers.
Are you sue ? pool with a dash ? ( pool- )
Use the default : Select "All".
-
@gertjan The pool with a dash (pool-) was me redacting my WAN IP address right after the dash.
I've checked all of my settings we've discussed for unbound resolver in pfSense. My pfSense should be good now.
I'm not sure what Firefox settings should be enabled/disabled for malvertizing to be blocked on my LAN. I may just have to live with it.
I'm still not sure how the Python Module was enabled in the Services > DNS Resolver > General Settings. I didn't enable it. What should I do with this setting?
-
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
I'm still not sure how the Python Module was enabled in the Services > DNS Resolver > General Settings. I didn't enable it. What should I do with this setting?
It should be set to 'active' (checked).
pfBlockerNG-devel works 'better' when using Python mode. -
@newuser2pfsense said in pfBlockerNG-devel Not Blocking Malvertizing on LAN:
not sure what Firefox settings should be enabled/disabled for malvertizing to be blocked on my LAN
For Firefox specifically see https://support.mozilla.org/en-US/kb/dns-over-https-doh-faqs#w_will-users-be-able-to-disable-doh but since nslookup using 127.0.0.53 bypasses the block it would seem that's not Firefox related, and DNS on the computer is bypassing pfSense.
There are also feeds in pfBlocker to block DoH, and a choice on its "DNSBL SafeSearch" tab. I used a feed because I found out the Dish (satellite TV) "on demand" feature uses only DoH even though the rest of the DVR uses DNS, so I had to allow that device out.
-
@Gertjan
Firewall > pfBlockerNG > DNSBL
Services > DNS Resolver > General Settings
@SteveITS
Thanks for the response. A little further research has found that my Linux Mint 21 Cinnamon OS has the 127.0.0.53 in the resolv.conf file for whatever reason. I'm trying a fix I found on the interwebs from this URL and it worked:
https://askubuntu.com/questions/1012641/dns-set-to-systemds-127-0-0-53-how-to-change-permanently
I'm now able to get my 192.168.1.1 DNS server IP when running an nslookup. However, it hasn't resovled the issue of removing malvertizing images from my LAN gmail emails.
