Potential DNS Rebind attack detected on my local network

johnpoz

@comet424 that really should have zero to do with it..

but now when you ping tardis, does it comeback tardis.localdomain? does it comeback without a domain? If so then dns was was not used. And your client used some other method to find tardis, be it mdns, or just a broadcast, etc.

Do you have registration of dhcp clients set in unbound? Are you using isc or kea dhcp server?

comet424

@johnpoz
when i ping it no i dont get localdomain i get

C:\Users\mike>ping tardis

Pinging tardis [192.168.0.3] with 32 bytes of data:
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.0.3:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Users\mike>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Windows11-Gaming-Desktop
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : localdomain

Ethernet adapter 10Gig Nic:

   Connection-specific DNS Suffix  . : localdomain
   Description . . . . . . . . . . . : Intel(R) 82599 10 Gigabit Network Connection
   Physical Address. . . . . . . . . : 98-B7-85-1F-A0-B1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a570:4985:f868:8d21%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.151(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Friday, November 22, 2024 11:16:38 AM
   Lease Expires . . . . . . . . . . : Friday, November 22, 2024 1:16:37 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 714651525
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2D-34-A3-5E-C8-7F-54-55-89-B8
   DNS Servers . . . . . . . . . . . : 192.168.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Users\mike>

the way it originally worked

im using kea dhcp as i learned pfsense said the other is depreciating
i dont know what isc unless thats the old dhcp and no dhcp clients in the custom override if thats what u mean by unbound

although i set in dhcp server lan i static set tardis to be 192.168.0.3

comet424

and if that solves my issue i was having and i use dyndns for my domain name
by changing domain to localdomain under general

just curiousity when do you use domain under general to be like the hell.com as display pupose example
is that for when you have a big company... or something as i always trying to learn stuff new everyday so curious when and when you dont use that

johnpoz

@comet424 not sure why anyone would use an actual public domain in pfsense. Unless you were using that internally - but that normally is idea that comes with many issues.

now if you owned hell.com and used hell.net internally where hell.net did not resolve on the public internet that would be one thing. But trying to leverage public domain externally and internally at the same time runs into problems. And is not really a suggested setup.

The 2 approved domains to use internally these days is home.arpa and .internal

I would suggest you use one of those..

Kea is not as yet at feature parity with isc (older dhcp server).. And it is missing features.. I would not suggest you use it currently unless you have the most basic requirements of a dhcp server. There are some good strides to bring it to parity with isc in the 24.11 release..

Since tardis did not come back fq in your ping - that really points to just windows finding it with some other method where dns isn't even involved.

comet424

@johnpoz
ok i changed localdomain to home.arpa

as for dhcp settings all i set is
192.168.0.50-254 as range
dns 192.168.0.1
gateway 192.168.0.1 and i do the same for my vlans
so dns 192.168.10.1 and gateway for cameras and so on
so if thats basic then ya i set my up basic

and ubuntu and my other unraid boxes can now ping tardis and get the same results
no domain name added... do they use other methods then too

always learning something new everyday.. and the 24.11 release is that pfsense being released this month i know i had issues when i had 2.7.1 it didnt even know there was an update and when i transitioned to 2.7.2 there was a bunch of glitches in the config file and such that... so i manually re set up everything so entering in all manually so its glitch free.. so hope next upgrade no issues

johnpoz

@comet424 have no idea what your doing on your linux boxes.. But if the name was discovered via DNS, then it should come back fq

root@UC:/home/user# ping nas
PING nas.home.arpa (192.168.9.10) 56(84) bytes of data.
64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=1 ttl=63 time=1.37 ms
64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=2 ttl=63 time=0.731 ms
64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=3 ttl=63 time=0.489 ms

that is a linux box on my network. See I ping nas and it comes back nas.home.arpa - do you have host file on your linux box?

My resolv.conf on my linux box has search set for home.arpa

nameserver 127.0.0.53
options edns0 trust-ad
search home.arpa

comet424

@johnpoz
apparently i spoke too soon.. i had to reboot my unraid.. my other unraid can ping tardis thats rambo... but the ubuntu desktop it cant ping now
pinging from unraid to tardis

root@Rambo:~# ping tardis
PING tardis (192.168.0.3) 56(84) bytes of data.
64 bytes from Tardis.local (192.168.0.3): icmp_seq=1 ttl=64 time=0.267 ms
64 bytes from Tardis.local (192.168.0.3): icmp_seq=2 ttl=64 time=0.227 ms
64 bytes from Tardis.local (192.168.0.3): icmp_seq=3 ttl=64 time=0.313 ms
64 bytes from Tardis.local (192.168.0.3): icmp_seq=4 ttl=64 time=0.391 ms
64 bytes from Tardis.local (192.168.0.3): icmp_seq=5 ttl=64 time=0.285 ms
^C
--- tardis ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4089ms
rtt min/avg/max/mdev = 0.227/0.296/0.391/0.054 ms

pinging from ubuntu to tardis
cant ping.png

so i spoke too soon that everything working

stephenw10

It looks like you made it work by removing the search domain from the client so it really is trying to resolve just 'tardis'. But some (many?) devices won't allow that.

You should send the local domain via DHCP and then set the host overides using that domain.

In Ubuntu you may need to flash the local resolver cache: sudo resolvectl flush-caches

comet424

@stephenw10 ah ok so i set the dhcp server domain i put in home.arpa
and i rebooted the ubuntu desktop but still up able to ping tardis
i can ping www.google.ca that has no problem it cant ping locally

so you mean many devices wont allow you to ping tardis or like ping camera10
as example or all my ESP32 devices that run esphome

as for the host override... how do i blank host override to add domain and covers everything on the network.. as so far i only learned you can do like 1 ip address at a time

and i read about split dns and 1:1 nat but all i remember is when i defaulted a clean pfsense i could ping ubuntu and stuff but now where i added vpn and the 1::128 and all those other nats i also wondered if those conflict?

but so far i can ping from
raspberry pi
unraid
windows
pfsense

but i cant seem to ping from any of my ubuntu vms

and i thought if i set dns 192.168.0.1 and in the resolver i set it to all all for incomming and out going that it would resolve things but i guesss not

and even after the reboot and the sudo resolvectl flush-caches i still get same error temporary failture..
i did try this it also failed

if you can show with picture how my host override should look like that would cover everything be good as im a visual learner more over then words to understand things

comet424

so i tried these 2 different over rides but these didnt work

comet424

so with those 2 overrides i have i still can ping from
unraid
windows

but
ubutunu
raspberry pi

gives me issues cant resolve it... is that what you ment many cant resolve tardis just hostname

but what i dont understand is
i tell dhcp that the dns 192.168.0.1 so all clients know pfsense is to dns resolve all the local hostnames... i dont understand why it doesnt do it least not from ubuntu and raspberry pi.. and now i said that the domain that 192.168.0.1 the dns resolver needs to resolve all but it doesnt seem to be working

and here the arpa list the ubuntu desktop doesnt have no .home.arpa.. or the example i gave hell.com so pfsense should be resolving the hostnames no matter what os im pinging from right? least thats how i thought it works

i tried custom options

server:
private-domain: "home.arpa"

that didnt help either

stephenw10

In the host override you have to add both the host and the domain. In your example you have added a hostoverride with no host!

Domain overrides point to a specific DNS server for the whole domain. You don't want that here.

Try using dig in ubuntu so you know it's actually querying Unbound in pfSense.

comet424

@stephenw10
ok so remove the host and domain override.. i did the domain and pointed it to 192.168.0.1 so it would do all local hostnames least thats how i thought

what about that private-domain i added too how does that work?

as for ubuntu and dig command these are the screen shots
i thought once u tell dhcp dns is 192.168.0.1 all OSs would be resolved by pfsense

johnpoz

@comet424 that is not what he meant by a dig..

dig tardis.home.arpa

Your linux is using a local cache, that is why it points to127.0.0.53, if you want to know where that points.

user@UC:~$ resolvectl status
Global
       Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub

Link 2 (ens3)
    Current Scopes: DNS
         Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 192.168.3.10
       DNS Servers: 192.168.3.10
        DNS Domain: home.arpa
user@UC:~$

Private-domain sets a domain so that if you forward for that domain it will turn off rebind protection

You are making this so freaking difficult.. Out of the box dhcp will hand out the domain is set in general setup, ie home.arpa for example.. Your client may or may not use that..

When you query for dns, it has to be fully qualified, so either query the fqdn - ie tardis.home.arpa or make sure your client is using search suffix and will auto add it for you.

comet424

@johnpoz
sorry not trying to make it complicated.. all i thought is once you set it up in pfsense under dhcp server
your gate way and dns.. then pfsense did all the resolving of the local hostnames for any operating system.. i not familar with ubuntu alot so i just noticed i cant ping ill have to look up what a fqdn is

and all i want is once dhcp server shells out the ip then it doesnt matter what os... just be able to ping and access by the hostname in the arpa table so whatever i have to do to make it auto work like it auto works in unraid and windows.. but then you mention windows does its own thing

as for the dig and resolvectl this is the result

stephenw10

Try: dig @192.168.0.1 tardis.home.arpa.

In that example:

tardis is a hostname

home.arpa is a domain

tardis.home.arpa is a fully qualified domain name (fqdn).

johnpoz

@comet424 did you leave that domain forward in there - that is pointless, and prob going to break it.

Unless your register dhcp or static reservations. Unbound doesn't have a clue about other hosts you have on your network.

So you would either need to do one of those or both, and or just create a host override..

is 192.168.0.1 pfsense IP? Or some other NS?

Unbound wouldn't normally return a SOA like that.

comet424

@johnpoz
so i removed that domain and host override yesterday... only thing for domain i left i guess i should remove is

server:
private-domain: "home.arpa"

i can delete that

192.168.0.1 is pfsense 192.168.0.3 is the tardis
so host overide.. so i have to manaully enter then 200+ ips for ubuntu to be able to access them then ? like i always though under the ARP table the host name you could always ping or access the device by the hostname thats how i do it in unraid or windows like my 30+ ESP devices or all my IOT devices just access them by the Hostname through windows browser or ssh etc..

what is a SOA?

@stephenw10
this is the result of the dig @192.168.0.1 tardis.home.arpa.

johnpoz

@comet424 SOA is a record saying hey have no record of that - you should prob go ask the SOA (source of authority).. Out of the box unbound wouldn't return that record.. you would of had to create it.

If in the default transparent mode and you ask for anything.home.arpa and there is no record it would try and resolve it upstream, and that wouldn't return that soa either.

for home.arpa that you tried to resolve and had no record of and got sent upstream the soa would be

;; QUESTION SECTION:
;fsljfdsdf.home.arpa.           IN      A

;; AUTHORITY SECTION:
home.arpa.              3600    IN      SOA     prisoner.iana.org. hostmaster.root-servers.org. 1 604800 60 604800 604800

what do you have in the custom box of unbound? Do you have some host overrides setup.. domain overrides? unbound would not return that nobody soa

stephenw10

@comet424 said in Potential DNS Rebind attack detected on my local network:

@stephenw10
this is the result of the dig @192.168.0.1 tardis.home.arpa.

Sorry that last . was outside the quote! Muscle memory forced me to type it.

The command should be:

dig @192.168.0.1 tardis.home.arpa