Potential DNS Rebind attack detected on my local network

[johnpoz]

@stephenw10 yeah you would expect tardis. to fail with dig.. that is asking for just tardis and not fully qualified, that should always fail.

if your going to use nslookup and let the search suffix work you should set debug so you can see what it actually asks for.

Your ping there on windows that comes back without it fully qualified is most likely using something else to resolve mdns, llmns, wds - there are multiple methods of just resolving locally without dns. If it actually used dns to resolve that than the ping should show tardis.home.arpa, etc..

ash-4.4# nmblookup i9-win
192.168.10.9 i9-win<00>
192.168.9.100 i9-win<00>
172.29.64.1 i9-win<00>
ash-4.4# 

[comet424]

@johnpoz
@stephenw10

so not sure how to use the debug for for nslookup well properly the way you guys want me to type it in
as for domain name. i only have it set under general.

so its weird i always thought that as long as i could ping a hostname in windows that the dns was working but it used mdns llmns wds or so on.. always learn something new everyday no wonder i had probems 25 years ago witn WinGate trying to share internet was a program to share internet and dns server...

so i did a bunch of tests and screen shots of my static ip the dhcp of lan general... do you see anything i got set wrong that that dns resolver isnt working right.. does NAT have anything to do with it?
is there another place to look for domain name or page that the resolver isnt working.. i figured the extra PIA NATs i added duplicated of the WAN as i dunno i did a clean install last time i had issues and seems i got issues again lol its just just 1 check box or 1 rule that causes the dns not to work

[johnpoz]

@comet424 I am not sure what is going on but what does yours show when you go to the dns lookup under diagnostics?

what about dig right on pfsense?

[24.03-RELEASE][admin@sg4860.home.arpa]/root: dig nas.home.arpa

; <<>> DiG 9.18.20 <<>> nas.home.arpa
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41317
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;nas.home.arpa.                 IN      A

;; ANSWER SECTION:
nas.home.arpa.          3600    IN      A       192.168.9.10

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Mon Nov 25 15:33:39 CST 2024
;; MSG SIZE  rcvd: 58

[24.03-RELEASE][admin@sg4860.home.arpa]/root: 

What seems really odd to me is that SOA.. you shouldn't be getting that.

unbound is not an authoritative NS, it really shouldn't hand out SOAs for domain you have records for.. And have no idea where that is coming from.. If your stuff was being forward to any sort of public dns.. Then you should get back that

SOA prisoner.iana.org.

if you setup a reservation for this tardis IP via its mac, then on unbound register reservations/static

does pfsense.home.arpa resolve via dns diagnostic?

You can look in your unbound config.

[24.03-RELEASE][admin@sg4860.home.arpa]/var/unbound: cat host_entries.conf 
local-zone: "home.arpa." static
local-data-ptr: "127.0.0.1 localhost.home.arpa"
local-data: "localhost. A 127.0.0.1"
local-data: "localhost.home.arpa. A 127.0.0.1"
local-data-ptr: "::1 localhost.home.arpa"
local-data: "localhost. AAAA ::1"
local-data: "localhost.home.arpa. AAAA ::1"
local-data-ptr: "192.168.9.253 sg4860.home.arpa"
local-data: "sg4860.home.arpa. A 192.168.9.253"
local-data-ptr: "192.168.9.10 nas.home.arpa"
local-data: "nas.home.arpa. A 192.168.9.10"
local-data-ptr: "192.168.9.100 i9-win.home.arpa"
local-data: "i9-win.home.arpa. A 192.168.9.100"
local-data-ptr: "192.168.2.5 FlexHD.home.arpa"
local-data: "FlexHD.home.arpa. A 192.168.2.5"
local-data-ptr: "192.168.2.13 UC.home.arpa"
local-data: "UC.home.arpa. A 192.168.2.13"
local-data-ptr: "192.168.2.198 Johns-13.home.arpa"
local-data: "Johns-13.home.arpa. A 192.168.2.198"

Can you post up your /var/unbound/unbound.conf file? If your registering dhcp, and you have a client renew its lease you should see it listed in dhcpleases_entries.conf

[comet424]

@johnpoz

ok so i ran your tests did a couple extras and i did some comments

hope its helping as i dunno whats wrong from what i see compared to yours dns is not pointing internally but externally for internal ips

i ran this before i did the check box register dhcp button you had me do

now i checked the register box

now i did the dhcp releases one

now looking at the file i notice it doesnt have all the dhcp leases from the ARP table from diagnostics page.. unless it takes a bit or needs a reboot?

and dont tell me that one check box solves everything? but hope that info so far helps diginose whats going on and more tests i look forward to solve things

and i really appreciate you and stephens help

[stephenw10]

Note you have added the host in the static mapping as Tardis and linux/freebsd is case sensitive here. It should always be all lower case there: tardis.

[johnpoz]

@stephenw10 huh? dns is not case sensitive..

[stephenw10]

Mmm I confess I've never tried adding anything upper case as a hostname. But it sure makes me twitch seeing it like that.

Edit: I guess I'm twitching unnecessarily here. I would still never use an upper case character though!

[johnpoz]

@stephenw10 yeah I hear yeah, but when you actually do the dns query - it doesn't care.. Even an option for unbound to send the case all crazy like in my example.

https://datatracker.ietf.org/doc/html/draft-vixie-dnsext-dns0x20-00

so client can ask unbound for something.domain.tld and unbound will resolve it like sOmeTHing.dOmAin.tLd

[comet424]

@johnpoz
@stephenw10
i tested Tardis and tardis they both work and ubuntu can ping now by the register dhcp resesverations
why didnt it work before? i do notice raspberry pi can not ping like pump but ubuntu can ping it

its least working

do i need to enable Experimental bit 0x20 and what exactly it do

also i know i asked for help before etc
apparently my bell internet the dns goes down it connects and i can ping like 1.1.1.1 ip address's but not name servers like google.ca so that manes my site to site doesnt work and nore does my vpn as its name not and ip

the way i connecting right now is in general settings dns settings
i set 1.1.1.1 for wan_ppoe
as i tried the PIA VPN other 2 dns ips and i guess you need to be logged in to be able to use there dns servers.

but when i set it 1.1.1.1 wan_ppoe i can get connected and it leaks dns... is there no way to have 1.1.1.1 wan_ppoe
10.0.0.241 PIA_vpn

is there no way to have both and yet keep them seperated i tried the no_wan_egrees but no didnt didnt stop cloudfare for being on the PIA vpn so then its not secure

i know one of you said thats now how it works the way i thought where 1.1.1.1 would only be used for wan_ppoe and 10.0.0.241 would be used for PIA_vpn it doesnt keep it seperate
but right now with my dsl dns servers down for name thats how i get internet to work unless you know IP

is there another work around so i can set it for 1.1.1.1 as its not the first time my bell internet dns goes down for names but it connects and only ip address's work but names dont work

[johnpoz]

@comet424 resolving local resources that are listed in unbound be it via dhcp registration or static dhcp registration or host overrides has zero to do with any public dns service you would forward too.. They are not going to resolve your local resources, nor should they even i you put records up there because any ns you forward or that is not actually unbound itself that returns a rfc1918 address would be a rebind and is dangerous behavior.