[solved] DNS root request - rootserver doesn't response via udp

andreas_at_work

Hey johnpoz,

it does not matter if its a client or the pfsense it self. This explicit (but valid) request seems to be the problem. I have tried from pfsense via drill or from a client (ubuntu) via dig.
In both scenarios it looks like the request is leaving the wan interface, but there is no answer.

ubuntu client:

dig @199.7.91.13 .

does not work.

dig @199.7.91.13 . +tcp

or

dig @199.7.91.13 de.

does work.

UDP is not blocked because

drill @199.7.91.13 de.

does work like expected from pfsense and client.

Pfsense does get a public ipv4 ip via PPPOE. In my first post it was '87.142.207.148'.

All i can imagine is, that the "network stack" or the network driver or my ISP discard the packet somehow. I cannot capture packets 'behind' the pppoe interface. Maybe i should set up a dns somewhere in the internet and perform the request towards this server.

greetings
Andreas

johnpoz

Can you query say 8.8.8.8 ?? This is a public dns server..

; <<>> DiG 9.9.5-3ubuntu0.5-Ubuntu <<>> @8.8.8.8 .
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57426
;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;. IN A

;; AUTHORITY SECTION:
. 318 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2015112700 1800 900 604800 86400

;; Query time: 39 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Nov 27 09:09:37 CST 2015
;; MSG SIZE rcvd: 103

andreas_at_work

nope.

Same problem. TCP (dig @8.8.8.8 . +tcp) does work, UDP (dig @8.8.8.8 .) does not.

johnpoz

So udp is blocked upstream from were your doing query from either pfsense nar router in front of pfsense or isp

andreas_at_work

UDP is not blocked, feel free to scroll up and take a look at my examples, i have posted two of them. Only the UDP request for "." does not work.

Derelict

It really does look like something upstream is jacking with your traffic. You see the packet going out and nothing comes back.

andreas_at_work

Yep. That seems to be the case.

I will do two steps now:

1. setup a DNS in the Internet and perform this request towards this server. Then i will be able to see, if or how the request really do leave my "internet access".
2. Post this case in the German subfolder because of the "non-starndard" configuration. I am using an IAD-Router as a pppoe modem. By using it in the "bridged mode" it do not forward the vlan tags. Maybe this might be somehow a problem.

Thanks anyway :)

johnpoz

"1. setup a DNS in the Internet and perform this request towards this server."

What do you think the query to 8.8.8.8 was?? There are plenty of public dns you could send your request too also, no need to setup anything..

Does your isp expect you to use their dns? Can you do anything UDP outbound? NTP for example? Query a public ntp server.. or just the ntp pool..

andreas_at_work

Dear johnpoz,

at the moment i am not able to check the logfiles of the google dns. This might change in the future, but is not possible yet… ;)

My idea is: As soon as i setup my own dns i will be able to see if this damn request reached the server or got caught somewhere between the pfSense and my own dns.

In this case i don't want to use the dns of my isp. The use case is to monitor malicious hostnames (means hostnames which where used for "bad stuff") and detect modifications. Based on this modifications it is sometimes possible to identify some hints about future attacks or attack vectors.

Outbound UDP is working without any problem. I will try to create very small ntp and snmp packets tomorrow.

Thanks
Andreas

andreas_at_work

Problem solved. Since i have replaced the vdsl modem and configured pfSense to use the vlans on wan interface the problem did not appear anymore.