DNS Resolver Leaking and DHCP addresses
-
This post is deleted! -
@Gertjan Hi, I have the resolver to redirect 1.1.1.1:80 to 127.0.0.1 and I use pfBlockerNG to block the aliases to 1.1.1.1:443 and as you saw, Data is still trying to get through, so I had to add the 1.1.1.1 block rule.
That is the whole issue, why is any device able to bypass Resolver and pfBlockerNG!
Adding the block rule is a good patch for now. But shouldn't we be worried that we even need a Patch!
Hopefully I am doing something wrong or pfsense needs to be tweaked to fix the leak.
-
@disgrun said in DNS Resolver Leaking and DHCP addresses:
That is the whole issue, why is any device able to bypass Resolver and pfBlockerNG!
what part do you not understand that its not asking for any dns, its just going to 1.1.1.1
Lets see your redirection, lets see what you have setup in pfblocker - is it creating a firewall rule that includes 1.1.1.1 as an IP and blocking it.. Lets see the table it creates for this rule, and where is the firewall rule? is it on your floating tab, because it sure isn't on your office interface.
-
-
@disgrun and again that is not blocking IP, its blocking the resolution of that fqdn, that is all..
Where is the table it creates with IPs in that are in your rules.. See that table in your floating tab pfb_PRI1_v4 - go into diagnostic tables, and look in that table do you see 1.1.1.1 ?
If not then no that firewall rule is noting going to block access to 1.1.1.1
-
-
@johnpoz The resolver and pfblockerng are indeed redirecting and blocking everything as they are supposed to.
I am an amateur at this so i can't explain how they are doing this without rules or diagnostic tables.
I can assure you that if i try to set my browser or phone to 1.1.1.1:443, pfSense stops ME immediately. It works great for Everything except for this one instance.
I can even recreate it, so perhaps you can duplicate it on your system and see why it is happening. Perhaps the website is doing it somehow?
Go to https://one.one.one.one/help/
That makes it happen.
-
@disgrun because you created a firewall rule that blocks 1.1.1.1..
Again - look in that table pfb_ in your diagnostic menu.. Do you see 1.1.1.1 in it, if so then it would be blocked.. But it doesn't so its not.
btw - hiding rfc1918 addresses is pretty pointless.. And you missed one there at the bottom.. what do you think anyone could do with a 192.168 address, they do not route on the internet, they say nothing about even what ISP your using, etc. etc.. This is like saying hey I live on a street with address 123.. Well yeah pretty much every street on the planet will have numbers as addresses on them. But knowing that its 123 on some street doesn't help you find the actual address ;)
-
@johnpoz as you can see pfsense does block the website
but when the website is blocked 1.1.1.1:443 or 1.1.1.1:80 try to get through.
Is this normal?
-
@disgrun not sure what your not understanding how dns works?
pfblocker and unbound can be set to not resolve something, or send you a wrong IP so you can't actually get there. But this is only the resolution of the fqdn to the IP.. This does not stop actual traffic to the IP.. Only a firewall rule will do that, and for the firewall rule to block, it has to trigger..etc..
Do yourself a favor and look in that pf_ table in your floating tabs in tables under the diagnostic menu..
remove your block rule you created on your office interface and go to https://1.1.1.1 vs the name one.one.one.one
-
-
@disgrun exactly - so what part are you not getting.. see that NXdomain, that says that one.one.one.one did not resolve...
So what part are you not getting? you understand that some fqdn like www.netgate.com has to resolve to an IP to actually talk to it right.. But if you know the IP you can talk to that IP without having to look up the ip via dns.
If your client says hey I want to use doh with site called one.one.one.one and it doesn't resolve it can't get there, but if it just goes to the actual IP 1.1.1.1 unbound, ie resolving that fqdn is not involved.. Only firewall rules that actually block to IP or port would be involved.
That is why when you created a firewall that blocks access to 1.1.1.1 it fails, doesn't matter if the client looks it up from one.one.one.one or googledns or clouddns.org or whatever - you ain't talking to that IP.
-
@johnpoz Hi, Ok, I think i got it . Everything is working great, the 1.1.1.1 i am seeing is NOT a dns, entry it is a website address. So the DNS is being redirected but I am seeing the 1.1.1.1 since it is the address of the website. I think that solves it!
Thank you! Your help was greatly appreciated!
Hopefully you can give me an answer to my second part of the post.
Why do I see ipv6 address for all my devices even though ipv6 is off. I always thought pfsense handed out all the addresses to my devices.
Some devices even have more than one ipv6 address.
Thanks!
-
@disgrun what IPv6 address?
Like this?
Pretty much any modern device will have those, unless you on purpose disable IPv6 on it - like this
Yes an actual GUA would come from pfsense, be it via dhcpv6 or slaac
-
@johnpoz Is there no way to stop/disable them with pfSense?
Or can i do it via Terminal screen in linux?
How is netflix getting an iPV6 address from me?
-
@disgrun hiding the IP address doesn't help me determine if that is link local or not.. just the first part does it start with fe80, then its link local and doesn't route on the internet.
If you have IPv6 on pfsense, dhcpv6 is not the only way clients get IPv6 - look up slaac
And yes one of the things about IPv6 is clients using multiple addresses.
Your clients could get address all day, but if you don't allow them out then they are not going anywhere with it.
Delete this rule on your office for example
But notice the 0/0 B there on its left - that means its never been evaluated. So nothing on your office network has used IPv6 to go anywhere out on the internet.
-
I deleted the ipv6 rules and some of the ipv6 addresses went away. But as seen in pic, why is this device still getting an ipv6 address, even if it is a local one since pfsense did not lease one out?
Thanks,
-
@disgrun that is link local, as I mentioned pretty much any modern OS or device that supports IPv6 will always have those..
https://en.wikipedia.org/wiki/Link-local_address
Almost impossible to make those go away on some OSes or Devices, even if you on purpose disable its ipv6 support
-
@johnpoz Thank you for your help, I learned alot! Take are.
