DNS forwarder - Domain override not working

Bagpuss

Hi All,

Just wondering if someone can help me.
I'm running pfSense 2.1.3, and am trying to setup domain overrides for netflix.com and netflix.net.

I have a Private Internet Access account, and have four VPN connections configured (2 x UK, 1 x Netherlands and 1 x US-East).
I have 2 aliases, BYPASSVPN and PORTFORWARD.
Machines whose IP are in the BYPASSVPN alias direct their traffic through my normal WAN connection.
Machines whose IP are in the PORTFORWARD alias route via the PIA Netherlands.
Machines who are in neither route their traffic via one of the two UK VPN connections. This achieved by having a 'UKGateways' group which contains both UK VPN gateways. That way, if one UK gateway fails, traffic is routed via the other.

All of this works perfectly.

Currently, I use the DNS forwarder, and under general settings I have the following DNS servers configured:
209.222.18.222 - PIA DNS
208.67.220.220 - OpenDNS 1
208.67.222.222 - OpenDNS 2

My clients get their configuration via DHCP, and use 192.168.0.1 as their DNS resolver (pfSense local IP).

Again, this all works just fine.

There is a second PIA DNS server whose address is: 209.222.18.218

I have configured a domain override for netflix.com and netflix.net to use this second PIA DNS as authoritative DNS server.
I have also checked 'Query DNS Servers sequentially'.

Basically, I want to create a configuration where DNS requests for Netflix are sent only to 209.222.18.218, and that traffic is sent via the PIA US East VPN connection.
I am hoping that this will fool Netflix into believing I am in the US, and remove the need for something like unblock-us.

In my attempts to achieve this, I have created a new firewall rule this:

I've turned logging on for this rule, and can see that when I ping 209.222.18.218, or do a DNS lookup
with 'nslookup bbc.co.uk 209.222.18.218' that the traffic is passing through the US gateway.

With that working, I created two domain overrides. One for netflix.com and one for netflix.net.

In doing so, my theory was that any requests from clients in my network to resolve netflix.com or netflix.net should then be directed to 209.222.18.218. This traffic would be sent via my US East VPN, and thus it would appear to Netflix that I am in the US.

However, the domain overrides simply don't work.
I've tried every possible source IP I can think of, as I'm aware that this is an issue with VPN connections.
At first I tried 192.168.0.1. which is the local LAN IP for my pfSense box. I then tried my public VPN IP address for the US East gateway, as well as it's gateway address, and nothing works.

I then configured one client machine to bypass the VPN, and use my WAN connection. I also removed the source IP entry in the override.
Still, the overrides are ignored.

At this point, I'm stumped, and was wondering if anyone can offer some suggestions on what to try next.

Thanks,

Andy.

Bagpuss

I've now removed the VPN from the equation completely, and still this doesn't work.

I cannot get the override to happen, no matter what I do.
Can anyone suggest possible ways to troubleshoot this?
Is there any extra logging I can enable for dnsmasq?

Any help would be much appreciated.

johnpoz

"In doing so, my theory was that any requests from clients in my network to resolve netflix.com or netflix.net should then be directed to 209.222.18.218. This traffic would be sent via my US East VPN, and thus it would appear to Netflix that I am in the US. "

Your client wouldn't be doing the query on a domain over ride, pfsense would..

so I created a override for testdomainoverride.tld to 1.2.3.4, so when my client asks pfsense for www.testdomainoverride.tld

It (pfsense) sends a query to 1.2.3.4

08:52:42.366731 IP 24.13.xx.xx.56991 > 1.2.3.4.53: UDP, length 55
08:52:47.366091 IP 24.13.xx.xx.56991 > 1.2.3.4.53: UDP, length 55

So I would validate that pfsense can query that IP.. Validate with a simple sniff on pfsense where pfsense is sending that query.. This is the point of the source in the domain over ride you can tell which interface the query should go..

Bagpuss

Thanks for your help, John.

Didn't consider the idea that the request would appear to be coming from the pfsense box.
Once I got that into my head, I could see where I was going wrong.

Only trouble I have now is that the source IP has to be the IP that my VPN connection has been assigned.
As this is dynamic, the source IP is going to change periodically, thereby breaking the override.

Oh well, I guess I'll have to script that somehow, and modify the override if the source IP changes.

johnpoz

Your other option is to just not use over rides, and set the IP of the dns server you want your client to use directly on the client. Then your policy routing would work for the query.