Host Overrides for forced safe search stopped working on 2.3 [solved]

aGeekhere

anyone else have this issue?

johnpoz

when you ping google or do a dns query for www.google.com.au what IP do you get back.. if you get back that IP, then host override is working. If you are getting results that are not "safe" then that is on google not host overrides, all a host override does is return a specific IP when asked for a specific name.

And what I can tell you is that is working just fine in 2.3.

aGeekhere

when you ping google or do a dns query for www.google.com.au what IP do you get back

It is not going to host overrides 216.239.38.120 but direct to google unsafe.

And what I can tell you is that is working just fine in 2.3

Was working fine for me in 2.2.6 after updating to 2.3 it stopped so I am a bit puzzled, how can I troubleshoot this issue?

johnpoz

dude when you query pfsense for that record do you get back that IP?? If so then host override is working..

Be it your safesearch is working or not has nothing to do with the host override working..

So when I query www.google.com.au normally I get this

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.google.com.au. IN A

;; ANSWER SECTION:
www.google.com.au. 300 IN A 64.233.177.94

When I create an override it returns what I put in the override = host override working.. Are you saying that is not working? Please show your override and your query to pfsense where this is not the case..

overrideworking.png_thumb

aGeekhere

pinging www.google.com

Pinging www.google.com [216.58.199.36] with 32 bytes of data:
Reply from 216.58.199.36: bytes=32 time=23ms TTL=55
Reply from 216.58.199.36: bytes=32 time=74ms TTL=55
Reply from 216.58.199.36: bytes=32 time=21ms TTL=55
Reply from 216.58.199.36: bytes=32 time=21ms TTL=55

Ping statistics for 216.58.199.36:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 21ms, Maximum = 74ms, Average = 34ms

nslookup www.google.com

nslookup www.google.com
Non-authoritative answer:
Name:    www.google.com
Addresses:  2404:6800:4006:803::2004
          216.58.199.36

DNS Resolver Host Overrides
see attachment

Google is not showing that safe search is enabled (because it is not going to 216.239.38.120) so the Host Overrides has stopped working for me after the update.

issue.jpg_thumb

johnpoz

and your host override is for www.google.com.au, and your pinging www.google.com so yeah not going to to return the IP you put in the override..

Ah So you have both ok… Where are you doing your query too, clearly its not pfsense.. Your nslook doesn't show what server you asked..

nslookup.png_thumb

aGeekhere

here it is

nslookup www.google.com
Server:  pfsense.myDomain.local
Address:  192.168.1.1

Non-authoritative answer:
Name:    www.google.com
Addresses:  2404:6800:4006:803::2004
          216.58.199.36

johnpoz

Well you sure you have your host override in the right place?? Seen this quite often users put override in forwarder section and running resolver, or have in resolver and using forwarder..

What I can tell you is that I am using the resolver on 2.3 and have lots and lots of overrides and all working just fine.. I would validate what is running on pfsense and its setup.. And that you have the overrides in the correct place.

aGeekhere

Well it was working before the update so if I had it miss configured then it would have never work.
I will go over my setup tomorrow to see if i can find anything that might have changed during the update.

By the way did you do an upgrade or fresh install?

johnpoz

I did an upgrade from 2.2.6 to snapshots before 2.3 actually released when they were on the RCs and then to the final 2.3 when that came out.

I had no issues with anything in the transition from 2.2 to 2.3 all my packages worked, my vpn worked.. It was smooth as you would expect from the pfsense team.. I did have a bit of an issue with it trying to continue on to the 2.3.1 dev line… So had to change that setting.

So how many overrides do you have? create a new test one - does that work.. If not then yeah you got something borked up..

testoverride.png_thumb

aGeekhere

So how many overrides do you have?

For now the ones I have shown.

create a new test one - does that work

Sorry to say no

If not then yeah you got something borked up

Looks to be the case, I see no errors in the logs saying something is wrong in the DNS resolver. I guess I could wait for 2.3.1 and see if that fixes anything as I do not want to reinstall pfsense at this time.

johnpoz

Are you even sure resolver is running?? Maybe you have the forwarder running.. Sorry to sound like I am treating you like a moron.. But normally that is the case around here..

If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place. Or your not even doing a query to pfsense..

aGeekhere

Are you even sure resolver is running??

DNS Resolver is runing

Maybe you have the forwarder running

I do have the forwarder running for the WPAD, but i never had any issue with that before see attachment

Sorry to sound like I am treating you like a moron.. But normally that is the case around here.

I hope that I am not making a moron of a mistake but it was all working perfectly before the update, when the update finished I notice straight away that the Host Overrides stopped working.

If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place. Or your not even doing a query to pfsense..

See attachments

dns.jpg_thumb

firewall.jpg_thumb

forwarder.jpg_thumb

johnpoz

Huh???

What is the point of forwarding anything to 53 to 53?? How about you turn off that and the forwarder and make sure resolver is working.. Which you don't even have doing dnssec so what is the point of it? Why do you think you need forwarder running for wpad?? On the proxy port?

When are you going to query the resolver?

aGeekhere

Fixed it by Diagnostics\States\States Reset States

Would have thought restarting the router would have done that, anyway.

I also Enabled DNSSEC Support.

What is the point of forwarding anything to 53 to 53?? How about you turn off that and the forwarder and make sure resolver is working.. Which you don't even have doing dnssec so what is the point of it? Why do you think you need forwarder running for wpad?? On the proxy port?

When are you going to query the resolver?

Well it works now and i do not want to break anything by changing something, thanks for the help

johnpoz

What is the point of forwarding 53 to loopback, you want to make sure some that does a query to 53 to something outside is redirected to pfsense??

And your forwarder is running on 3128 so when is that queried??

Break something - break what a pointless configuration?

aGeekhere

http://resources.infosecinstitute.com/hacking-clients-wpad-web-proxy-auto-discovery-protocol/

johnpoz

What does that have to do with running forwarder on 3128?? Yeah you can create a entry for wpad.yourdomain.tld to point to where the autoconfiguration script is.. What does that have to do with forwarder listening on 3128?? Which would be the same port your proxy is listening on normally??

aGeekhere

Ok just had a look I needed to use a port other than 53 because Resolver was using that port and when I was trying different methods to get the wpad working i tried the proxy port and it worked however I just changed the DNS Forwarder to something else and it also works fine.

So yeah there is no need to point the DNS Forwarder to the proxy port (just need to pick an unused one) learn something new everyday.

johnpoz

Not sure how you think that is working?? What do you think is doing a query to the forwarder for wpad??

Do you have some other redirection going on? Why do you need the forwarder? Why would you not just create a entry in resolver? You have a redirect to loopback.. What what is listing on loopback the forwarder or the resolver?

I am really confused what you think that is doing? And why you need both forwarder and resolver?