Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Hows Google getting past my alias lists?

    Scheduled Pinned Locked Moved General pfSense Questions
    30 Posts 9 Posters 7.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      firewalluser
      last edited by

      Well with an explicit block and having double checked things in firefox like send back telemetry is switched off, no history etc, the firewall log shows google is probably using some amazon cloud servers if the port numbers are anything to go by but surprising google would also be using amazon cloud severs. In another test the default deny rule is showing up with my isp's ip addresses when trying to access google, which is beginning to make me wonder just how much of the web google is not connected to.

      Feb 2 21:29:33 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60532   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1000000103 Feb 2 21:29:32 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60531   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1422911107
      Feb 2 21:29:31 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60533       62.24.155.232:443 TCP:S
      block/1000000103
      Feb 2 21:29:30 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60532   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1000000103
      Feb 2 21:29:29 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60531   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1422911107
      Feb 2 21:29:19 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60524       62.24.155.217:443 TCP:S
      block/1000000103
      Feb 2 21:29:18 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60523   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1422911107
      Feb 2 21:29:13 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60524       62.24.155.217:443 TCP:S
      block/1000000103
      Feb 2 21:29:12 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60523   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1422911107
      Feb 2 21:29:10 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60524       62.24.155.217:443 TCP:S
      block/1000000103
      Feb 2 21:29:08 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60523   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1422911107
      Feb 2 21:28:57 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60518       62.24.155.221:443 TCP:S
      block/1422911107
      Feb 2 21:28:57 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60517       62.24.155.221:443 TCP:S
      block/1000000103
      Feb 2 21:28:56 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60516   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1000000103
      Feb 2 21:28:56 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60515   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1422911107
      Feb 2 21:28:51 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60518       62.24.155.221:443 TCP:S
      block/1422911107
      Feb 2 21:28:51 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60517       62.24.155.221:443 TCP:S
      block/1000000103
      Feb 2 21:28:50 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60516   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1000000103
      Feb 2 21:28:50 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60515   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1422911107
      Feb 2 21:28:48 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60518       62.24.155.221:443 TCP:S
      block/1422911107
      Feb 2 21:28:48 opt1 USER_RULE opt1 to google com Aliases (1422911107) 192.168.2.1:60517       62.24.155.221:443 TCP:S
      block/1000000103
      Feb 2 21:28:47 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60516   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S
      block/1000000103
      Feb 2 21:28:47 opt1 Default deny rule IPv4 (1000000103) 192.168.2.1:60515   54.186.10.229:443
      ec2-54-186-10-229.us-west-2.compute.amazonaws.com TCP:S

      Anyway still testing as I need to find out how google got out earlier but not now.

      Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

      Asch Conformity, mainly the blind leading the blind.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        That's pretty cool.  :) Even if not perfect it going to stick a sufficiently large spanner in most peoples browsing they'll probably give up and do something useful instead.

        Edit: Ooops. Referring to BBcan177's suggestion.

        Steve

        1 Reply Last reply Reply Quote 0
        • S
          Supermule Banned
          last edited by

          This is EXACTLY why Layer7 is needed in pfSense….

          Unless we are talking https traffic, then you need some sort of domain blacklist or IP range as BBcan17 is saying...

          1 Reply Last reply Reply Quote 0
          • H
            heper
            last edited by

            @Supermule:

            This is EXACTLY why Layer7 is needed in pfSense….

            Unless we are talking https traffic, then you need some sort of domain blacklist or IP range as BBcan17 is saying...

            almost all popular webservices use https … layer7 won't help, nor will squid without being an evil admin.

            1 Reply Last reply Reply Quote 0
            • F
              firewalluser
              last edited by

              Have to say, if you do block all of googles ip addresses, you'll find most web pages painfully slow to load as it takes the browser a long time to timeout when its pulling code or stuff from google.

              When a webpage has something to do with google beit using their ajax, google apis or what have you, a webpage can easily take a few minutes to load destrying any user experience, the delay depends on how many links to google there are, the more links the longer the delay.

              If Google went off line, you'd have a riot on your hands with people getting fed up waiting for web pages to load and lots of businesses could suffer as well, but their techniques to make their services work irrespective of how badly configured a network maybe is quite illuminating when considering ways to tackle malware thats not been identified by any major AV company.

              I've yet to analyse how many websites use google services of sorts, but I suspect Western countries are very heavy users of their services compared to other parts of the world not neccesarily english speaking.

              Referring to BBcan177's suggestion, it looks like mismatches will occur as the sources might not be up to date with whatever resolver might have got from the various gTLD servers.

              Still havent figured out how this came to be though.
              Feb 2 20:06:30    unbound: [63509:0] info: response for pfmechanics.com.MyDomainNameWhichWillRemainPrivate. A IN

              I've not created a "pfmechanics.com" subdomain for my domains  so trying to find out why pfsense is doing this? Any ideas?

              TIA

              Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

              Asch Conformity, mainly the blind leading the blind.

              1 Reply Last reply Reply Quote 0
              • GruensFroeschliG
                GruensFroeschli
                last edited by

                Alternatively you could block this at DNS level on the pfSense itself.

                Create an NAT rule on your LAN interface with destination any, port 53. Redirect destination 127.0.0.1, port 53.
                –> This will force all DNS lookups no matter to which DNS server to your pfSense.

                In the DNS forwarder config you can add something like:
                address=/google.com/127.0.0.1

                This will resolve for all google.com domains and subdomains to 127.0.0.1.
                Replace 127.0.0.1 with a local server and you will see on it when something is sent to it.

                See also: https://doc.pfsense.org/index.php/Wildcard_Records_in_DNS_Forwarder

                We do what we must, because we can.

                Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  @firewalluser:

                  Have to say, if you do block all of googles ip addresses, you'll find most web pages painfully slow to load as it takes the browser a long time to timeout when its pulling code or stuff from google.

                  It's for this reason that most popular adblockers replace the requests with some locally served data instead.

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • K
                    kejianshi
                    last edited by

                    I like GruensFroeschli's suggestion.  I'd consider it the default method of controlling DNS queries because It doesn't even matter if people on your net manually configure alternate DNS servers on their machines, it will still only get pfsense DNS.  (unbound or whatever you are running)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Supermule Banned
                      last edited by

                      Something like this??

                      LAN_NAT.PNG
                      LAN_NAT.PNG_thumb

                      1 Reply Last reply Reply Quote 0
                      • F
                        firewalluser
                        last edited by

                        @GruensFroeschli:

                        See also: https://doc.pfsense.org/index.php/Wildcard_Records_in_DNS_Forwarder

                        Thanks for highlighting this! I'm using the resolver at the moment as its now the default dns method in pfsense2.2, but I'll see if I can use what you have highlighted in the resolver someway as it seems like the windows lmhost/host file trick but running on pfsense.

                        Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

                        Asch Conformity, mainly the blind leading the blind.

                        1 Reply Last reply Reply Quote 0
                        • GruensFroeschliG
                          GruensFroeschli
                          last edited by

                          @Supermule:

                          Something like this??

                          You need to set the interface to the one on which the DNS requests arrive.
                          In most cases this is the LAN interface or whatever your clients are connected to.

                          See attached image.

                          dns-override.png
                          dns-override.png_thumb

                          We do what we must, because we can.

                          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.