How to block internet access for client operating system's DNS over HTTPS
-
Good day. How do I block internet access of users who enabled their operating system's DNS over HTTPS? Below is screenshot from firefox and chrome showing it bypassed pfBlockerNG if Windows Settings' DNS over HTTPS is enabled:
But if Windows Settings' DNS over HTTPS is not enabled the pfBlockerNG blocking is successful:
And also if Windows Settings' DNS over HTTPS is not enabled the pfBlockerNG blocking is still successful even when the browsers' secure DNS is enabled:
Only pfBlockerNG is in the floating rules:
Only the block bogon networks is in the WANs firewall rules:
This is the firewall rules for one of the VLANs:
It is set to fail over from WAN1 to WAN2 (starlink):
For the DNS Resolver: only the VLANs, LAN, and Localhost are selected in Network Interfaces. And only the WANs are selected in the Outgoing Network Interfaces:
This is the first part of DNS Resolver's Advanced Settings. Please let me know if I need to send the remaining entries:
pfBlockerNG > DNSBL > DNSBL SafeSearch > DoH/DoT/DoQ Blocking is enabled and every entry on the list are selected:
I learned that Windows Settings' DNS over HTTPS can bypass pfBlockerNG while testing the suggestions on my previous post (for a different problem) below, but I could not make the port forward work. If port forwarding is the solution please help what entries to add for multi VLAN and multi WAN setup. Please also help if the solution is other than port forwarding. I'm ok with just blocking if it will take fewer steps to do as compared to configuring pfsense so that users will always use its pfsense DNS whatever settings they may have. Thank you in advance for your suggestions
https://forum.netgate.com/topic/198862/should-failover-for-wan1-and-should-not-failover-for-wan2 -
@richardsago not sure what your wanting to block - specific things, or the internet completely?
Dns is blocking is normally used to block ads and bad sites.. I wouldn't use to block say apple.com, etc.
If you don't want the machine to have internet - just don't allow any internet.
But blocking doh servers - what doh server are they going to - just blocking going to those IPs. No more doh for them.
-
Thank you @johnpoz for the reply. I would like all users to get internet connection only if they will use pfsense DNS so that pfBlockerNG can block certain types of websites that the organization wants blocked. So that if they will configure their Windows Settings to use DNS over HTTPS they will not be able to connect to the internet (and bypass pfBlockerNG) like they can do now. Will this be possible, or all blocking is impossible if users will enable their Windows Settings' DNS over HTTPS?
-
Additional info: pfBlockerNG > IP is not used and these are the two blockings under DNSBL:
-
Additional information that may be useful:
These are the DNS Server Settings:
These are the monitor IP:
-
Why these :
if you are not forwarding to them (you are resolving) :
?
Also, for "DNS over HTTPS/TLS/QUIC Blocking" to work, you need to stop using the ancient 'unbound' method, and use the Python method : check this one :
and make sure this "DNSBL Mode" is set to 'Unbound Python mode' here as well :
IRC, it's the Python pfBlockerNG extension that handles DoH/DoT/DoQ Blocking.
Btw : when you switch from ISC DHCP to kea, you shouldn't use unbound mode anyway.
About the " Windows Settings' DNS over HTTPS" :
The DNS-hhtps server Windows is using - I'm not sure which one it is - must be part of the "pfBlockerNG" list :
edit :
Also : forget about this one :
as that page, generated by pfBlockerNG, to show the user that he wanted to visit a site that is blacklisted, only works for http site. Not for https sites, as you can't redirect https connection, as that will introduce a certificate fail.
So, use :
instead of
as there are no "http" sites anymore.
https sites that contain http adds pages / content will also be flagged as a massive ugly fail by the browser. The pfBlockerNG web server page won't get shown. -
Thank you @Gertjan for the reply. 1 of 4 ok) I have successfully enabled Services > DNS Resolver > General Settings > "Enable Python Module" and we did not experience internet problem
2 of 4 ok) I have successfully changed Firewall > pfBlockerNG > DNSBL > DNSBL > Logging/Blocking Mode to "Null Blocking (no logging)" and there's no internet problem. But there was no choice for "Null Block (logging)", not sure if this is because I did not set "DNSBL Mode" to "Unbound python mode" <-this is the next item 3 below
3 of 4 problem) When I set Firewall > pfBlockerNG > DNSBL > DNSBL Mode to "Unbound python mode" we lose internet connection so I returned it to "Unbound mode". This was also what happened when I tried this last month. Are there other settings that I need to change from this:
4 of 4 question) Do I understand correctly that because we have 2 WANS and the pfsense instruction is to ensure each WAN has a DNS entry in System > General Setup > DNS Server Settings, then I should enable Services > DNS Resolver > General Settings > "DNS Query Forwarding"?
-
@richardsago said in How to block internet access for client operating system's DNS over HTTPS:
But there was no choice for "Null Block (logging)"
"Null Block (logging)" works only when Python mode is enabled.
@richardsago said in How to block internet access for client operating system's DNS over HTTPS:
When I set Firewall > pfBlockerNG > DNSBL > DNSBL Mode to "Unbound python mode" we lose internet connection so I returned it to "Unbound mode"
That's not a normal situation at all. You have a DNS issue then.
Consider flipping everything back to default first.This is part of 'default' :
In a nearby future, 'unbound' mode might as well be removed.
You can see "python mode" as a plugin or addon to unbound.
It's a script file that unbound uses
Unbound uses 'python' as the interpreted script file language , and that's why we call it 'python mode'.
It could have been a shell script, LUA, or whatever.This Unbound Python script has now been tested a couple of multiples of trillions times (every DNS request executed by every pfSense using pfBlockerng out there).
It's a save bet that to say that there are no more known issues with it.About :
You might as well remove all these.
pfSense, the resolver, doesn't need any DNS servers (that you've assigned).
It doesn't use them.
Unbound is a resolver, which means it resolves using the official (root) DNS servers.
No need to use some commercial offer from anybody.8.8.8.8 and 8.8.4.4 are also revolvers btw. But why would you hand over your private DNS requests to these commercial entities ^? ^
