What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?

johnpoz

@RobbieTT said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Queries are scattered across 4 servers, are not retained by Quad9, privacy addresses are in use

What do you mean scattered across 4 servers? quad9 would have access to all of your queries be it you ask only 1 of their servers or 4 different ones. And since they are anycast - just because you say use 4 different Ips for their servers - it quite likely is just going to whatever the closest "server(s)" to you.

privacy addresses? Not sure what you mean by that..

As to if they retain them or not, who knows for sure? Clearly they are getting some sort of data from the queries that are sent to them - what exactly they do with it, how they monetize it? But clearly all of these services that provide public dns services are getting something out of it. They are for sure not providing public dns to the planet out of the goodness of their hearts ;)

RobbieTT

@johnpoz

John, you have posted your antipathy to my reasoning a few times now, so I am aware of your thoughts and your chosen configuration.

️

tictag

@johnpoz said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Huh? it does cache the resolution. Do you think only forwarding mode caches results?

This comment related to DNSSEC DNS resolution, which, it is my understanding, on its first pass resolves the DNS query, then, on its second pass, confirms the PKI encrypted hash of the query back up the resolution tree to the root. Only once it has the query response together with an unbroken cryptographically secure resolution chain does it provide a 'secure resolution' back to the querying application. If pfSense did this, then cached the result so that the next query would be delivered from that cache instead of requiring the second pass, this would speed up DNS resolution overall. But I doubt this actually happens because it is only supported with Forwarding Mode active, which means that each query is forwarded, so each query will have to go through the first and second passes, as described.

I agree with all your other points. pfSense is currently providing my Firewall, DHCP, PPPoE gateway (yes, I know...) and will likely be providing 802.1Q and 802.1X services in the future (homelab), and probably more, I'm just not 100% sure, considering I also use Ad Guard, whether there are sufficient benefits to using it for DNS resolution. And, hence this post!

johnpoz

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

But I doubt this actually happens because it is only supported with Forwarding Mode active

Huh? Again if you forward - asking for any dnssec anything is pointless and only going to create more queries that do nothing.

If you forward, where you forward, there is always a resolver at the end of the chain. They are doing dnssec or they are not..

If I query something lets say www.domain.tld, and it passes the dnssec checking.. And 1.2.3.4 is given to the client.. If another client asks for www.domain.tld - no dnssec check is required.. 1.2.3.4 is just handed to the client asking..

tictag

@RobbieTT
I've heard some good things about Quad9, particularly their base in Switzerland, that has some of the world's most restrictive data privacy legislation - much more restrictive than the EU's GDPR. Of course, @johnpoz is right in that we can't possibly know what they do 'behind the scenes' but I'll put good money on the fact they'll want to comply with their own country's privacy legislation. It's an indicator of privacy, not an assurance.

For me this is more about functional performance, but with a healthy dollop of security and privacy. If I can get what I need by, for example, forcing all network devices to use Google's DNS servers (or Quad9's) and that works at least as well if not better than pfSense's DNS Resolver, then I'll force that out via DHCP - I certainly wouldn't want to match my pfSense DNS Resolver performance (running on a cheap NUC etc.) against Google's DNS infrastructure.

tictag

@johnpoz said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

If I query something lets say www.domain.tld, and it passes the dnssec checking.. And 1.2.3.4 is given to the client.. If another client asks for www.domain.tld - no dnssec check is required.. 1.2.3.4 is just handed to the client asking..

I defer to your knowledge, my assumption was that if a DNSSEC query was requested (I technically do not know how this is done, some sort of flag?), each and every query would go through the same down'n'up process before the response was provided back to the application. I believe what you are saying is that, yes this does happen, but all resolvers, pfSense or otherwise, would then provide subsequent resolution from cache, within the original TTL. So pfSense would indeed provide resolution from cache, if it is able to, so Forwarding Mode is irrelevant.

bmeeks

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

I defer to your knowledge, my assumption was that if a DNSSEC query was requested (I technically do not know how this is done, some sort of flag?), each and every query would go through the same down'n'up process before the response was provided back to the application. I believe what you are saying is that, yes this does happen, but all resolvers, pfSense or otherwise, would then provide subsequent resolution from cache, within the original TTL. So pfSense would indeed provide resolution from cache, if it is able to, so Forwarding Mode is irrelevant.

Just to be sure you understand- DNSSEC is not about encrypting the DNS traffic at all. It is simply used to validate the endpoint DNS server is who he says he is. Here is the description straight from Google Cloud:

The Domain Name System Security Extensions (DNSSEC) is a feature of the Domain Name System (DNS) that authenticates responses to domain name lookups. It does not provide privacy protections for those lookups, but prevents attackers from manipulating or poisoning the responses to DNS requests.

DNSSEC really has nothing at all to do with privacy directly. It only is a way for validating a host is who it portrays itself to be.

DoT (DNS over TLS) is geared more towards privacy as it encrypts the actual DNS communications session between the two hosts.

johnpoz

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

so Forwarding Mode is irrelevant.

Correct does not matter if you forward or resolve - once something is cached, any other queries for that record would be served from cache for life of that ttl that is cached.

Which brings up a point, when you resolve you always get the full ttl of whatever you resolved.. When you forward, it will return what it has in its cache with the ttl of what is left on its cached

So lets say something had a ttl of 2 hours. While you will always get that 2 hour ttl if you asked authoritative NS for www.domain.tld, when you forward to say google or quad.. Maybe its ttl only had 30 seconds left? So you would only be able to cache that for 30 seconds until you had to query for it again. Now you might get something closer to the 2 hours next time, you might also get only 45 seconds because a different server answered with a different cache value

example..

$ dig @8.8.8.8 www.cnn.com                                               
                                                                         
; <<>> DiG 9.16.42 <<>> @8.8.8.8 www.cnn.com                             
; (1 server found)                                                       
;; global options: +cmd                                                  
;; Got answer:                                                           
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 62151                
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1     
                                                                         
;; OPT PSEUDOSECTION:                                                    
; EDNS: version: 0, flags:; udp: 512                                     
;; QUESTION SECTION:                                                     
;www.cnn.com.                   IN      A                                
                                                                         
;; ANSWER SECTION:                                                       
www.cnn.com.            151     IN      CNAME   cnn-tls.map.fastly.net.  
cnn-tls.map.fastly.net. 25      IN      A       151.101.3.5              
cnn-tls.map.fastly.net. 25      IN      A       151.101.67.5             
cnn-tls.map.fastly.net. 25      IN      A       151.101.131.5            
cnn-tls.map.fastly.net. 25      IN      A       151.101.195.5            
                                                                         
;; Query time: 19 msec                                                   
;; SERVER: 8.8.8.8#53(8.8.8.8)                                           
;; WHEN: Sat Aug 19 11:11:19 Central Daylight Time 2023                  
;; MSG SIZE  rcvd: 140                                                   
                                                                         

$ dig @8.8.8.8 www.cnn.com

; <<>> DiG 9.16.42 <<>> @8.8.8.8 www.cnn.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16433
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.cnn.com.                   IN      A

;; ANSWER SECTION:
www.cnn.com.            82      IN      CNAME   cnn-tls.map.fastly.net.
cnn-tls.map.fastly.net. 6       IN      A       151.101.3.5
cnn-tls.map.fastly.net. 6       IN      A       151.101.67.5
cnn-tls.map.fastly.net. 6       IN      A       151.101.131.5
cnn-tls.map.fastly.net. 6       IN      A       151.101.195.5

;; Query time: 9 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sat Aug 19 11:11:21 Central Daylight Time 2023
;; MSG SIZE  rcvd: 140

Notice those queries to 8.8.8.8 are only 2 seconds apart.. But I got completely different ttls back.. That for sure are more than 2 seconds different in their length.

If I query the actual NS for that fqdn, I always get back the full TTL.

$ dig  cnn-tls.map.fastly.net @ns1.fastly.net                            
                                                                         
; <<>> DiG 9.16.42 <<>> cnn-tls.map.fastly.net @ns1.fastly.net           
;; global options: +cmd                                                  
;; Got answer:                                                           
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63836                
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 1     
;; WARNING: recursion requested but not available                        
                                                                         
;; OPT PSEUDOSECTION:                                                    
; EDNS: version: 0, flags:; udp: 1232                                    
;; QUESTION SECTION:                                                     
;cnn-tls.map.fastly.net.                IN      A                        
                                                                         
;; ANSWER SECTION:                                                       
cnn-tls.map.fastly.net. 30      IN      A       146.75.79.5              
                                                                         
;; AUTHORITY SECTION:                                                    
fastly.net.             7200    IN      NS      ns1.fastly.net.          
fastly.net.             7200    IN      NS      ns2.fastly.net.          
fastly.net.             7200    IN      NS      ns3.fastly.net.          
fastly.net.             7200    IN      NS      ns4.fastly.net.          
                                                                         
;; Query time: 9 msec                                                    
;; SERVER: 23.235.32.32#53(23.235.32.32)                                 
;; WHEN: Sat Aug 19 11:15:42 Central Daylight Time 2023                  
;; MSG SIZE  rcvd: 139

Another possible advantage to resolving vs forwarding. Is you should always get back from the authoritative NS the best geographically IP for where your query came from. When you forward to some anycast NS.. While it should be the one closest to you, and then hand over the best IP, but maybe the one that answers not really all that close to you.. Maybe it has a different geographically based IP for different region. With the use of ECS via EDNS.. Its "possible" that where you forward has something cached for www.domain.tld that is not really the best IP for you to talk to from where your at.. Because the person that queried that before that it had to be resolved was not all that close to where your at.

I prefer to always ask the actual authoritative NS for what I am looking for.. From my actual source IP.

To running your own local dns that either resolves or forwards - also allows you to adjust for min ttl.. Not a fan of 30 second or 60 second ttls that many sites love to hand out for stuff. I have my local dns set to use a min of 3600 seconds (1 hour) I have never yet run into any issue in doing this.. For the years and years have been doing it. This can drastically reduce the amount of queries that have to go out my internet connection, because I cache stuff for min of 1 hour once I have looked it up.

It is normally not good practice to alter a ttl, but then again - its not efficient to set such low ttls on records, unless you were in the process of getting ready to change the IP that record is going to point too.. But more and more your seeing very low ttls, which I believe is a way to help track how long your on a site.. Because like every 30 seconds your on that site a new query would be done..

RobbieTT

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

@RobbieTT
...but I'll put good money on the fact they'll want to comply with their own country's privacy legislation. It's an indicator of privacy, not an assurance.

Yes, it has been thoroughly audited but it has also survived a court-ordered investigation that was based (incorrectly, as it turned out) on the idea that they (surely!) retained more than they claimed. That governments have come to expect that Quad9 is a bit of a dead-end for information has, no doubt, them fishing for data elsewhere but it adds an additional layer of reassurance to the end-users.

There are always skeptics who think Quad9 must be up to something nefarious, rather than operating 'out of the goodness of their hearts' as a non-profit. They are funded, of course, but by companies and by donations, including from those most technically able to test and audit their activities.

But, skeptics do their thing. Which is good for the rest of us.

️

JKnott

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

I am trying to understand what the benefits are to using pfSense for DNS resolution, either using the DNS Resolver, the DNS Resolver in Forwarding Mode or the DNS Forwarder services when compared to say, using Google or Cloudflare’s public DNS recursive resolvers.

One reason is for accessing my local devices that have private addresses, either RFC1918 on IPv4 or Unique Local on IPv6. No point on having those on a public DNS.

Another reason is to provide my own address for a certain service. For example, my notebook computer is configured to use pool.ntp.org and when I'm away from home, that's what it uses. However, when at home, I want to use my own NTP server, so I use my DNS to send NTP to my own server.

johnpoz

@RobbieTT said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

skeptics who think Quad9 must be up to something nefarious

Even if they are the cleanest most moral dns provider on the planet - which they very may well be.. I still wouldn't forward.. There are too many advantages to doing my own resolving..

Other people might have other opinions - they are free to forward to whoever they want to forward.. There are plenty of providers to choose from that is for sure - I find it unlikely that they are all squeaky clean ;)

There can be advantages as well to forwarding, don't get me wrong - they can provide some safety in filtering - but they also could filter stuff that you don't want filtered, etc. They just recently blocked a site..

$ dig @9.9.9.9 canna-power.to                                           
                                                                        
; <<>> DiG 9.16.42 <<>> @9.9.9.9 canna-power.to                         
; (1 server found)                                                      
;; global options: +cmd                                                 
;; Got answer:                                                          
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 37350              
;; flags: qr rd ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1    
;; WARNING: recursion requested but not available                       
                                                                        
;; OPT PSEUDOSECTION:                                                   
; EDNS: version: 0, flags:; udp: 1232                                   
;; QUESTION SECTION:                                                    
;canna-power.to.                        IN      A                       
                                                                        
;; Query time: 12 msec                                                  
;; SERVER: 9.9.9.9#53(9.9.9.9)                                          
;; WHEN: Sat Aug 19 12:51:51 Central Daylight Time 2023                 
;; MSG SIZE  rcvd: 43

$ dig canna-power.to

; <<>> DiG 9.16.42 <<>> canna-power.to
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 60008
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;canna-power.to.                        IN      A

;; ANSWER SECTION:
canna-power.to.         3600    IN      A       46.148.26.245

;; Query time: 88 msec
;; SERVER: 192.168.3.10#53(192.168.3.10)
;; WHEN: Sat Aug 19 12:52:00 Central Daylight Time 2023
;; MSG SIZE  rcvd: 59

As to them always sticking to their word - well clearly on their FAQ they state

No. Quad9 will not provide a censoring component and will limit its actions solely to the blocking of malicious domains around phishing, malware, and exploit kit domains.

Yet the above site is blocked by them due to a lawsuit by German arm of Sony Music. Maybe they should add to that faq, or if someone asks us too block something ;)

Now personally I have no use for that site - but if they are blocking that one, what other sites are they blocking? People all about privacy of their PI and and anonymity just hand over all their dns on a silver platter to a company that says - hey trust us, we are the good guys all the time.. Which they all say, so why should I trust any of them, when I can just do my own resolving thank you very much..

nimrod

You cant trust anyone.

RobbieTT

@johnpoz said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Which they all say, so why should I trust any of them, when I can just do my own resolving thank you very much..

Yet you 'trust' everyone in the chain that links you to all the different upstream domain registries and you do so with all queries unencrypted at every stage. It works for you and you are comfortable with but it is an odd position to be in and question the level of trust with services such a Quad9.

As we understand it, you doubt that Quad9 is secure and may in fact be insecure. Ok, we can see your logic or at least acknowledge your opinion. But as a countermeasure to that potential risk you knowingly chose to run all your external DNS queries as insecure traffic, to all the various upstream root nameservers and below, wherever they reside in the world, under whatever government and by whatever route needed.

My point is that you made a choice; it does not mean those who choose differently are either wrong or fail to understand your point of view. We have simply made a different choice to you.

️

johnpoz

@RobbieTT said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

et you 'trust' everyone in the chain that links you to all the different upstream domain registries

Those are all root and gtlds. That guess what who you forward too uses as well.. ;) the internet doesn't work if those are not there..

Domain registries? Do you not actually understand how dns works?

Sure I register domain.tld, that registar that I use to register that places the NS I will use for that domain, in the gltd NS pointing to NS for my domain, etc.

Kind of hard not to trust ICANN and IANA, since for one they are the only game in town..

Lets just agree you can do what you want, and I can do what I want.. You don't have to agree with mine, and I don't have to agree with yours.. But when it comes to trusting, you are the one that are laying all your trust in some company that says, hey trust us with all your dns.. I am not..

Your wanting billys phone number, but instead of asking billy, your asking sam.. I feel better asking billy directly ;)

RobbieTT

@johnpoz said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Your wanting billys phone number, but instead of asking billy, your asking sam.. I feel better asking billy directly ;)

Exactly, I discreetly ask Sam and Sam discreetly answers my question.

You shout across everyone to someone who knows a bit about Billy but not everything and on you go shouting down the line to get the final detailed answer you seek.

Everyone now knows that you want Billy's number, they also all get yours and Billy's number along the way.

️

Bob.Dig

I just did the following: I use forwarding in the resolver via DoT. I use two "independent" DoT Server (not google or cloudflare) in General Setup via VPN-gateways. I also forced Unbound to only use the VPNs for outgoing and blocked DNS and DoT on WAN.
I think this will be as good as it gets.

tictag

@johnpoz said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Which brings up a point, when you resolve you always get the full ttl of whatever you resolved.. When you forward, it will return what it has in its cache with the ttl of what is left on its cached

That seems like a valid point for DNS Resolver, the longer the TTL, the fewer the DNS queries. I had no idea TTLs were so short. My hosting provider's DNS management interface always defaults to a 24 hour TTL for new records, and I usually just accept this, though I do drop that to 1 hour for records I know might change e.g. MX, SPF etc. Shorter than hour makes no sense to me, but seconds!?

@johnpoz said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Another possible advantage to resolving vs forwarding. Is you should always get back from the authoritative NS the best geographically IP for where your query came from.

Another valid, if somewhat surprising point. Considering that most websites these day are served from a CDN (even my own hosting provider enables CDN distribution by default), I figured every query would be resolved to the most local IP, I mean that is literally the CDNs primary purpose, to be served from cache defeats the purpose. Definitely a plus for local recursive resolution if true, though.

@JKnott said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

One reason is for accessing my local devices that have private addresses, either RFC1918 on IPv4 or Unique Local on IPv6. No point on having those on a public DNS.

A good point but already covered - using pfSense DNS Resolver host/domain overrides, or a local hosts file, or AD Guard DNS Rewrites seem to be equally valid solutions for local device DNS resolution.

@JKnott said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

However, when at home, I want to use my own NTP server, so I use my DNS to send NTP to my own server.

Another good point, though not strictly a benefit of pfSense DNS Resolver when other comparable services exist.

@johnpoz said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Which they all say, so why should I trust any of them, when I can just do my own resolving thank you very much..

It's weird! How can I take umbrage at the fact that a DNS service provider might sinkhole an IP based on some arbitrary decision (per your Quad9 example) - I'm being censored!!! - whilst at the same time purposefully installing Ad Guard that blocks thousands of IPs, none of which I know anything about or have any control over!! I think you either have to either accept DNS censorship and get on with your 'ad/malware-free' day, or be the Internet purist and suffer ads/malware/phishing. Anyway, for the weird shit, there's always ToR.

@Bob-Dig said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

I think this will be as good as it gets.

This thread is about the benefits of the pfSense DNS Resolver over traditional forwarding so, whilst your config suggestion certainly has value, particularly from a privacy/security perspective, by forwarding, you are also having to compromise on some of the benefits described within this thread. I'm not saying that's a bad thing, only that it is a thing.

Does anybody know why DoT is only supported in DNS Resolver Forwarding Mode? I mean, if it can do it at all (pfSense), why can't it recursively resolve using DoT? I am assuming that DoT is simply a standard DNS request encapsulated inside a TLS encrypted packet, technologies it clearly supports.

RobbieTT

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

Does anybody know why DoT is only supported in DNS Resolver Forwarding Mode? I mean, if it can do it at all (pfSense), why can't it recursively resolve using DoT? I am assuming that DoT is simply a standard DNS request encapsulated inside a TLS encrypted packet, technologies it clearly supports.

DoT & DoH are not supported by the root servers as using them in this way was never anticipated. Indeed, individual use of the root servers is discouraged as they were designed on the premiss that DNS providers would provide the service to users.

I've no idea why pfSense does not support DoH as well as DoT though.

️

johnpoz

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

why can't it recursively resolve using DoT?

Because for that to work every single NS on the planet would have to be setup for dot, and you would have to create new tls connections whenever you wanted to talk to a different NS during the resolve process.

Not saying something like that couldn't happen.. Maybe someday that will be a thing where something like quic is used to talk to NSers as you resolve. But its been what 20 some years trying to get IPv6.. And look how slow of an adoption that has been.

Look at how slow it is moving to tls 1.3 from 1.0, 1.1 or 1.2. or even just https for all sites.. When moving to 1.3 from 1.2 should be a simple thing.

Look at dnssec, another option that you would think should be on everything.. And overall has a very low deployment % for how long its been around. Not even every tld has it.. And some registrars don't even support it, even though its been a requirement to be an accredited registrar for years and years. And some registrars that say they support it, either it doesn't work or is pure PITA to get working.. I moved some of my domains to different registrar because of this years ago..

And many domains that do have it deployed are broken in when you look at the rfcs to how it should be deployed. You see warnings like this

RRSIG cdc.gov/A alg 7, id 22544: DNSSEC specification recommends not signing with DNSSEC algorithm 7 (RSASHA1NSEC3SHA1).

That is on a gov site..

Change is slow when it comes to the internet.

johnpoz

@tictag said in What Are The Benefits Of Using pfSense DNS Resolver/Forwarder Services?:

whilst at the same time purposefully installing Ad Guard that blocks thousands of IPs, none of which I know anything about or have any control over!!

You blocking stuff on your own local dns - you do have control over. You can determine which lists you use to block, you can view everything in that list that is blocked if you want. You can edit that list as you see fit, etc.