Squid/SquidGuard NONE/409 and DNS issue

[JonathanLee]

@shawn8888 have you tried to creat a NAT rule to force all users to use the firewall for DNS?

Like this ??

After it doesn't matter what the devices try to use the firewall choses the DNS just change it to what your DNS server is and forget about it.

[JonathanLee]

@jonathanlee make a alias with DNS ports

[JonathanLee]

@jonathanlee also set WPAD up on the firewall

[proggggger]

maybe a bit late answer but i also find such problem. And little exploring gives me a good solution.

(We a talking about Transparent Proxy + Splice all SSL mode)

So, first of all, the reason of such problem is one different addresses returned by DNS server

So, first of all Proxy should use the same DNS server as clients, so best way to do it is to use our firewall as DNS server (DNS Resolver turned on), so by DHCP we are setting primary DNS address of our firewall, also will be good to redirect all DNS requests to firewall address and block DoH (here article about DNS redirection "Redirecting Client DNS Requests"

And after this step lot of people says that it does not help, but why? the answer is simple, DNS RoundRobin, we are getting random ip address fore some websites even if we are using cache you can simply check it, if nslookup (for example for google.com, or twitch.tv or some other site which is not working) gives every time different address you will get 409 error.

So how to fix this part? we need to go to DNS Resolver settings, open custom options and add rrest-roundrobin:no which disables randomization of DNS entries. (it should be disabled by default but on pfsense looks like it's enabled)

[JonathanLee]

@proggggger

Thanks for the reply,

I just tested this and I got a error,

Just to confirm rrest-roundrobin:no inside of the custom area.

This is the error I got kicked back.

[JonathanLee]

@proggggger Another fix to issues with devices that have no option to configure a proxy is to configure DHCP option 252
This hands the proxy out also when it hands out the dhcp ip addresses. Make sure you have the proxy set up on wpad for this to work.
Example:

https://192.168.1.1:8080/wpad.dat

is handed out with the dhcp address again if your wpad is set up to also hand out the dns server this fixes a lot of issues.

[proggggger]

@proggggger said in Squid/SquidGuard NONE/409 and DNS issue:

open custom options and add rrest-roundrobin:no which disables randomization of DNS entries.

@proggggger @jonathanlee Oh, sorry, i've misstyped a little of course command is rrset-roundrobin:no, (i've also misstyped first time and get this error, here is detailed description of all options (Unboud conf man)

@jonathanlee said in Squid/SquidGuard NONE/409 and DNS issue:

This is the error I got kicked back.
thanks for noticing this

[JonathanLee]

@proggggger Thanks for the reply, I have also read online that roundrobin is enabled by default because it is more secure, what are your thoughts about the security concerns that roundrobin addresses?

[proggggger]

@jonathanlee of course roundrobin can have some security and reliability impact, and one o it's main goals is to distribute load between different servers but for not big networks i think this impact will be minimal (if you check the rr algorithm, you'll se it just randomizes order of addresses). (maybe it's need to be tested, but for now i don't have possibility to rebuild a network, so i only planing and exploring functions with virtual machines0

[michmoor]

@proggggger After disabling roundrobin the amount of /409 errors did decrease significantly. I will monitor for a bit more and if its resolved then im going to submit a redmine for a documentation update. This is a long standing problem.