Potential DNS Rebind attack detected on my local network
-
@comet424 have no idea what your doing on your linux boxes.. But if the name was discovered via DNS, then it should come back fq
root@UC:/home/user# ping nas PING nas.home.arpa (192.168.9.10) 56(84) bytes of data. 64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=1 ttl=63 time=1.37 ms 64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=2 ttl=63 time=0.731 ms 64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=3 ttl=63 time=0.489 msthat is a linux box on my network. See I ping nas and it comes back nas.home.arpa - do you have host file on your linux box?
My resolv.conf on my linux box has search set for home.arpa
nameserver 127.0.0.53 options edns0 trust-ad search home.arpa -
@johnpoz
apparently i spoke too soon.. i had to reboot my unraid.. my other unraid can ping tardis thats rambo... but the ubuntu desktop it cant ping now
pinging from unraid to tardisroot@Rambo:~# ping tardis PING tardis (192.168.0.3) 56(84) bytes of data. 64 bytes from Tardis.local (192.168.0.3): icmp_seq=1 ttl=64 time=0.267 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=2 ttl=64 time=0.227 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=3 ttl=64 time=0.313 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=4 ttl=64 time=0.391 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=5 ttl=64 time=0.285 ms ^C --- tardis ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4089ms rtt min/avg/max/mdev = 0.227/0.296/0.391/0.054 mspinging from ubuntu to tardis
so i spoke too soon that everything working
-
It looks like you made it work by removing the search domain from the client so it really is trying to resolve just 'tardis'. But some (many?) devices won't allow that.
You should send the local domain via DHCP and then set the host overides using that domain.
In Ubuntu you may need to flash the local resolver cache:
sudo resolvectl flush-caches -
@stephenw10 ah ok so i set the dhcp server domain i put in home.arpa
and i rebooted the ubuntu desktop but still up able to ping tardis
i can ping www.google.ca that has no problem it cant ping locallyso you mean many devices wont allow you to ping tardis or like ping camera10
as example or all my ESP32 devices that run esphomeas for the host override... how do i blank host override to add domain and covers everything on the network.. as so far i only learned you can do like 1 ip address at a time
and i read about split dns and 1:1 nat but all i remember is when i defaulted a clean pfsense i could ping ubuntu and stuff but now where i added vpn and the 1::128 and all those other nats i also wondered if those conflict?
but so far i can ping from
raspberry pi
unraid
windows
pfsensebut i cant seem to ping from any of my ubuntu vms
and i thought if i set dns 192.168.0.1 and in the resolver i set it to all all for incomming and out going that it would resolve things but i guesss not
and even after the reboot and the sudo resolvectl flush-caches i still get same error temporary failture..
i did try this it also failed
if you can show with picture how my host override should look like that would cover everything be good as im a visual learner more over then words to understand things
-
so i tried these 2 different over rides but these didnt work
-
so with those 2 overrides i have i still can ping from
unraid
windowsbut
ubutunu
raspberry pigives me issues cant resolve it... is that what you ment many cant resolve tardis just hostname
but what i dont understand is
i tell dhcp that the dns 192.168.0.1 so all clients know pfsense is to dns resolve all the local hostnames... i dont understand why it doesnt do it least not from ubuntu and raspberry pi.. and now i said that the domain that 192.168.0.1 the dns resolver needs to resolve all but it doesnt seem to be workingand here the arpa list the ubuntu desktop doesnt have no .home.arpa.. or the example i gave hell.com so pfsense should be resolving the hostnames no matter what os im pinging from right? least thats how i thought it works
i tried custom options
server: private-domain: "home.arpa"that didnt help either
-
In the host override you have to add both the host and the domain. In your example you have added a hostoverride with no host!
Domain overrides point to a specific DNS server for the whole domain. You don't want that here.
Try using dig in ubuntu so you know it's actually querying Unbound in pfSense.
-
@stephenw10
ok so remove the host and domain override.. i did the domain and pointed it to 192.168.0.1 so it would do all local hostnames least thats how i thoughtwhat about that private-domain i added too how does that work?
as for ubuntu and dig command these are the screen shots
i thought once u tell dhcp dns is 192.168.0.1 all OSs would be resolved by pfsense
-
@comet424 that is not what he meant by a dig..
dig tardis.home.arpa
Your linux is using a local cache, that is why it points to127.0.0.53, if you want to know where that points.
user@UC:~$ resolvectl status Global Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported resolv.conf mode: stub Link 2 (ens3) Current Scopes: DNS Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported Current DNS Server: 192.168.3.10 DNS Servers: 192.168.3.10 DNS Domain: home.arpa user@UC:~$Private-domain sets a domain so that if you forward for that domain it will turn off rebind protection
You are making this so freaking difficult.. Out of the box dhcp will hand out the domain is set in general setup, ie home.arpa for example.. Your client may or may not use that..
When you query for dns, it has to be fully qualified, so either query the fqdn - ie tardis.home.arpa or make sure your client is using search suffix and will auto add it for you.
-
@johnpoz
sorry not trying to make it complicated.. all i thought is once you set it up in pfsense under dhcp server
your gate way and dns.. then pfsense did all the resolving of the local hostnames for any operating system.. i not familar with ubuntu alot so i just noticed i cant ping ill have to look up what a fqdn isand all i want is once dhcp server shells out the ip then it doesnt matter what os... just be able to ping and access by the hostname in the arpa table so whatever i have to do to make it auto work like it auto works in unraid and windows.. but then you mention windows does its own thing
as for the dig and resolvectl this is the result
-
Try:
dig @192.168.0.1 tardis.home.arpa.In that example:
tardisis a hostnamehome.arpais a domaintardis.home.arpais a fully qualified domain name (fqdn). -
@comet424 did you leave that domain forward in there - that is pointless, and prob going to break it.
Unless your register dhcp or static reservations. Unbound doesn't have a clue about other hosts you have on your network.
So you would either need to do one of those or both, and or just create a host override..
is 192.168.0.1 pfsense IP? Or some other NS?
Unbound wouldn't normally return a SOA like that.
-
@johnpoz
so i removed that domain and host override yesterday... only thing for domain i left i guess i should remove isserver: private-domain: "home.arpa"i can delete that
192.168.0.1 is pfsense 192.168.0.3 is the tardis
so host overide.. so i have to manaully enter then 200+ ips for ubuntu to be able to access them then ? like i always though under the ARP table the host name you could always ping or access the device by the hostname thats how i do it in unraid or windows like my 30+ ESP devices or all my IOT devices just access them by the Hostname through windows browser or ssh etc..what is a SOA?
@stephenw10
this is the result of the dig @192.168.0.1 tardis.home.arpa.
-
@comet424 SOA is a record saying hey have no record of that - you should prob go ask the SOA (source of authority).. Out of the box unbound wouldn't return that record.. you would of had to create it.
If in the default transparent mode and you ask for anything.home.arpa and there is no record it would try and resolve it upstream, and that wouldn't return that soa either.
for home.arpa that you tried to resolve and had no record of and got sent upstream the soa would be
;; QUESTION SECTION: ;fsljfdsdf.home.arpa. IN A ;; AUTHORITY SECTION: home.arpa. 3600 IN SOA prisoner.iana.org. hostmaster.root-servers.org. 1 604800 60 604800 604800what do you have in the custom box of unbound? Do you have some host overrides setup.. domain overrides? unbound would not return that nobody soa
-
@comet424 said in Potential DNS Rebind attack detected on my local network:
@stephenw10
this is the result of the dig @192.168.0.1 tardis.home.arpa.Sorry that last . was outside the quote! Muscle memory forced me to type it.
The command should be:
dig @192.168.0.1 tardis.home.arpa -
@stephenw10 that wouldn't matter, and dig does it by default anyway unlike nslookup
-
Given the presence of Nord and PIA do you have Unbound in forwarding mode to other upstream servers over the VPN?
None of that should matter though, Unbound should still respond with hostoverrides in place.
-
@stephenw10
@johnpoz
so for custom options in dns resolver i haveserver: local-zone: "windowsupdate.com" redirect local-data: "windowsupdate.com 86400 IN A 192.168.0.32" server: local-zone: "microsoft.com.edgesuite.net" redirect local-data: "microsoft.com.edgesuite.net 86400 IN A 192.168.0.32" server: local-zone: "update.microsoft.com" redirect local-data: "update.microsoft.com 86400 IN A 192.168.0.32" server: local-zone: "do.dsp.mp.microsoft.com" redirect local-data: "do.dsp.mp.microsoft.com 86400 IN A 192.168.0.32" server: local-zone: "dl.delivery.mp.microsoft.com" redirect local-data: "dl.delivery.mp.microsoft.com 86400 IN A 192.168.0.32" server: local-zone: "cdn.blizzard.com" redirect local-data: "cdn.blizzard.com 86400 IN A 192.168.0.32" server: private-domain: "home.arpa" server:include: /var/unbound/pfb_dnsbl.*confmy host over ride is
the
dig @192.168.0.1 tardis.home.arpa command without the extra .
dns resolver i set to all all so i can then do the bypass routing policy on Lan
i disabled NordVPN and switched over to PIA they do different things... like no proper video for PIA but one had NAT just 192.168.0.0 and another used the pia for 1::128 and those other generated in NAT table so i dubbed them like i read in a PIA setup tutorial.. its like there is different ways to set up there vpn..
i dont use the DNS forwarder... as it wasnt part of the setup of PIA or norvpn in the past.. and i think i read or watched you cvan have dns resolver and forwarder same time?
only other VPN i use is Site to Site to my sisters Pfsense so i can access her network like it was here.. and i have to re add remote access...
and this is my LAN rules
any other screen shots you need.. -
@comet424 said in Potential DNS Rebind attack detected on my local network:
server:
private-domain: "home.arpa"that is not needed, like I said that tells unbound hey if I forward home.arpa to some other NS or get an answer from some other ns and the answer is rfc1918 its ok.. But in no scenario that I can think of should that soa be returned for anything in home.arpa domain - unless you created the local record for it.
Or your forwarding to some other NS that has that soa setup or returns that soa for its local records... Unbound sure and the hell does not do that out of that box.
; <<>> DiG 9.16.50 <<>> @192.168.9.253 home.arpa SOA ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31045 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;home.arpa. IN SOA ;; Query time: 0 msec ;; SERVER: 192.168.9.253#53(192.168.9.253) ;; WHEN: Sat Nov 23 12:36:13 Central Standard Time 2024 ;; MSG SIZE rcvd: 38You can see there is no SOA record for home.arpa That tells me unbound is asking something else for home.arpa - or your client isn't actually asking unbound. Or you have a local-data record setup your not showing. You don't have bind package running do you on pfsense?
And if you did ask the public internet for home.arpa or any normal NS on the public internet for something in home.arpa it should return that prisioner soa, because home.arpa has been set aside for private local use only.
Also that you would ever get back a rebind tells me unbound did not return what it had in its local records.. But asked/forwarded to someone else.. A rebind is when unbound asks some other NS and the answer is rfc1918.. That is by definition a rebind.
-
@johnpoz ok ill remove that server private domain then
as for NS thats Name Server right...
and only dns is pfsense minus 192.168.0.32 but thats the lancache for Windows updates and some games.. as my internet is only like 2 megabit and pay 100 bucks a month for internet thats not always stable.. but thats the only DNS stuff i setupnow the only local data setup i setup i guess is under the dhcp server i set static IPs like tardis.. but i set the Tardis hostname and ip of 192.168.0.3 and the DNS 192.168.0.1 and gateway of 192.168.0.1 so i dont do anything fancy
do you need a full display of NAT table.. or my PIA vpn right now i disabled the Nordvpn interface so i was able to shut off the openvpn client...
but ill remove the private domain and do a reboot of pfsense so its fresh.. i sometimes find pfsense works better after a reboot
