Potential DNS Rebind attack detected on my local network

stephenw10

Ah Ok. In that case DHCP registration in the DNS server was not available in Kea at that point. If you switch back to ISC you can enable that and can then resolve other clients by hostname.

comet424

@stephenw10 so i flipped back to the ISC and enabled the dns registration... nothing happened so i rebooted everything pfsense switchs computers..
i still only can ping tardis from windows or unraid

ubuntu, raspberry pi,. and pfsense cant ping hostnames

and since ithe ISC is being depreciated the features in KEA will it get the ISC features when it gets released? like the hostname resolving you mentioned

stephenw10

Yes it's in the upcoming 24.11 Plus release.

But pfSense itself should certainly be able to resolve them if they appear in the DHCP leases table.

comet424

@stephenw10 maybe by morning it fix itself will see if not its werid as i can "ping pfsense" from ubuntu and it does it ok but i cant ping tardis and pfsense i cant ping either tardis or any local hostnames

is that a rule order issue or conflicting nat and not sure what 1:1 nat is really

stephenw10

How does the ping fail? What error is shown?

comet424

@stephenw10 so i left it and it didnt fix itself

so for pfsense i get

The following input errors were detected:

Host "tardis" did not respond or could not be resolved.

for ubuntu i get

and windows and unraid i can still ping host name fine

i checked the dns registration box

comet424

nslookup doesnt find anything in windows
but ping does
and no dig in windows command prompt

stephenw10

Ok. I expect though that host or nslookup works if you use the fqdn?: tardis.home.arpa

And ping Ubuntu?

It looks like you have a mismatch in the domain you're assigning or passing to clients somewhere. Windows appends it from something. Linux doesn't. or uses the wrong domain.

johnpoz

@stephenw10 yeah you would expect tardis. to fail with dig.. that is asking for just tardis and not fully qualified, that should always fail.

if your going to use nslookup and let the search suffix work you should set debug so you can see what it actually asks for.

Your ping there on windows that comes back without it fully qualified is most likely using something else to resolve mdns, llmns, wds - there are multiple methods of just resolving locally without dns. If it actually used dns to resolve that than the ping should show tardis.home.arpa, etc..

ash-4.4# nmblookup i9-win
192.168.10.9 i9-win<00>
192.168.9.100 i9-win<00>
172.29.64.1 i9-win<00>
ash-4.4#

comet424

@johnpoz
@stephenw10

so not sure how to use the debug for for nslookup well properly the way you guys want me to type it in
as for domain name. i only have it set under general.

so its weird i always thought that as long as i could ping a hostname in windows that the dns was working but it used mdns llmns wds or so on.. always learn something new everyday no wonder i had probems 25 years ago witn WinGate trying to share internet was a program to share internet and dns server...

so i did a bunch of tests and screen shots of my static ip the dhcp of lan general... do you see anything i got set wrong that that dns resolver isnt working right.. does NAT have anything to do with it?
is there another place to look for domain name or page that the resolver isnt working.. i figured the extra PIA NATs i added duplicated of the WAN as i dunno i did a clean install last time i had issues and seems i got issues again lol its just just 1 check box or 1 rule that causes the dns not to work

johnpoz

@comet424 I am not sure what is going on but what does yours show when you go to the dns lookup under diagnostics?

what about dig right on pfsense?

[24.03-RELEASE][admin@sg4860.home.arpa]/root: dig nas.home.arpa

; <<>> DiG 9.18.20 <<>> nas.home.arpa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41317
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nas.home.arpa.                 IN      A

;; ANSWER SECTION:
nas.home.arpa.          3600    IN      A       192.168.9.10

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Nov 25 15:33:39 CST 2024
;; MSG SIZE  rcvd: 58

[24.03-RELEASE][admin@sg4860.home.arpa]/root:

What seems really odd to me is that SOA.. you shouldn't be getting that.

unbound is not an authoritative NS, it really shouldn't hand out SOAs for domain you have records for.. And have no idea where that is coming from.. If your stuff was being forward to any sort of public dns.. Then you should get back that

SOA prisoner.iana.org.

if you setup a reservation for this tardis IP via its mac, then on unbound register reservations/static

does pfsense.home.arpa resolve via dns diagnostic?

You can look in your unbound config.

[24.03-RELEASE][admin@sg4860.home.arpa]/var/unbound: cat host_entries.conf 
local-zone: "home.arpa." static
local-data-ptr: "127.0.0.1 localhost.home.arpa"
local-data: "localhost. A 127.0.0.1"
local-data: "localhost.home.arpa. A 127.0.0.1"
local-data-ptr: "::1 localhost.home.arpa"
local-data: "localhost. AAAA ::1"
local-data: "localhost.home.arpa. AAAA ::1"
local-data-ptr: "192.168.9.253 sg4860.home.arpa"
local-data: "sg4860.home.arpa. A 192.168.9.253"
local-data-ptr: "192.168.9.10 nas.home.arpa"
local-data: "nas.home.arpa. A 192.168.9.10"
local-data-ptr: "192.168.9.100 i9-win.home.arpa"
local-data: "i9-win.home.arpa. A 192.168.9.100"
local-data-ptr: "192.168.2.5 FlexHD.home.arpa"
local-data: "FlexHD.home.arpa. A 192.168.2.5"
local-data-ptr: "192.168.2.13 UC.home.arpa"
local-data: "UC.home.arpa. A 192.168.2.13"
local-data-ptr: "192.168.2.198 Johns-13.home.arpa"
local-data: "Johns-13.home.arpa. A 192.168.2.198"

Can you post up your /var/unbound/unbound.conf file? If your registering dhcp, and you have a client renew its lease you should see it listed in dhcpleases_entries.conf

comet424

@johnpoz

ok so i ran your tests did a couple extras and i did some comments

hope its helping as i dunno whats wrong from what i see compared to yours dns is not pointing internally but externally for internal ips

dns lookup.png dns lookup2.png dns lookup3.png

i ran this before i did the check box register dhcp button you had me do
dns lookup4.png

now i checked the register box
dns lookup5.png dns lookup6.png dns lookup7.png dns lookup8.png

now i did the dhcp releases one

dns lookup9.png dns lookup10.png

now looking at the file i notice it doesnt have all the dhcp leases from the ARP table from diagnostics page.. unless it takes a bit or needs a reboot?

and dont tell me that one check box solves everything? but hope that info so far helps diginose whats going on and more tests i look forward to solve things

and i really appreciate you and stephens help

stephenw10

Note you have added the host in the static mapping as Tardis and linux/freebsd is case sensitive here. It should always be all lower case there: tardis.

johnpoz

@stephenw10 huh? dns is not case sensitive..

stephenw10

Mmm I confess I've never tried adding anything upper case as a hostname. But it sure makes me twitch seeing it like that.

Edit: I guess I'm twitching unnecessarily here. I would still never use an upper case character though!

johnpoz

@stephenw10 yeah I hear yeah, but when you actually do the dns query - it doesn't care.. Even an option for unbound to send the case all crazy like in my example.

https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00

so client can ask unbound for something.domain.tld and unbound will resolve it like sOmeTHing.dOmAin.tLd

comet424

@johnpoz
@stephenw10
i tested Tardis and tardis they both work and ubuntu can ping now by the register dhcp resesverations
why didnt it work before? i do notice raspberry pi can not ping like pump but ubuntu can ping it

its least working

do i need to enable Experimental bit 0x20 and what exactly it do

also i know i asked for help before etc
apparently my bell internet the dns goes down it connects and i can ping like 1.1.1.1 ip address's but not name servers like google.ca so that manes my site to site doesnt work and nore does my vpn as its name not and ip

the way i connecting right now is in general settings dns settings
i set 1.1.1.1 for wan_ppoe
as i tried the PIA VPN other 2 dns ips and i guess you need to be logged in to be able to use there dns servers.

but when i set it 1.1.1.1 wan_ppoe i can get connected and it leaks dns... is there no way to have 1.1.1.1 wan_ppoe
10.0.0.241 PIA_vpn

is there no way to have both and yet keep them seperated i tried the no_wan_egrees but no didnt didnt stop cloudfare for being on the PIA vpn so then its not secure

i know one of you said thats now how it works the way i thought where 1.1.1.1 would only be used for wan_ppoe and 10.0.0.241 would be used for PIA_vpn it doesnt keep it seperate
but right now with my dsl dns servers down for name thats how i get internet to work unless you know IP

is there another work around so i can set it for 1.1.1.1 as its not the first time my bell internet dns goes down for names but it connects and only ip address's work but names dont work

johnpoz

@comet424 resolving local resources that are listed in unbound be it via dhcp registration or static dhcp registration or host overrides has zero to do with any public dns service you would forward too.. They are not going to resolve your local resources, nor should they even i you put records up there because any ns you forward or that is not actually unbound itself that returns a rfc1918 address would be a rebind and is dangerous behavior.