Dns leaks really bad

[micropone]

i did many dns leak tests.. all going to google  74.125.80.14 and HE 64.62.134.130. I dont want any google or HE dns servers..

shows

127.0.0.1
64.6.64.6
192.228.79.201 –root server google doesn't own.

gateway on each is set to NONE... i have comcast

whats gives

thanks in advance

[johnpoz]

192.228.79.201 is  b.root-servers.net
64.6.64.6 is recpubns1.nstld.net

Not sure exactly what dns leak test your using.. But if your using pfsense out of the box with unbound, its going to resolve not forward..  So yeah root servers and authoritative servers for the domain your looking for are going to be asked directly..

[micropone]

dnsleaktest.com
dnsleak.com

using unbound.. i believe that is affecting  pfblockerng on reboot the blocker works 1 hr later stops working..

do I need to turn unbound  off and use forwarder…

TIA

[johnpoz]

Unbound with dnssec is the best choice for dns most all the time.. Only if your isp was blocking 53 to lots of places, or your internet connection really sucked - ie sat or something would I say forwarding.

Unbound using dnssec is going to be your best option by far.

If you ask me - sending all your dns queries to same place would be more of a security issue if your tin foil hat is that tight.  You know make it easy for someone to see what your dong queries for.  While asking roots and then the authoritative servers spreads your queries all over the place.. Unless you think the guys in the black helicopters are watching for your IP on the roots ;)

Its quite possible that pfblocker if your blocking access to networks where the authoritative NS for what your looking up are located could cause you grief sure.

[micropone]

comcast has been known to do this… per their fourms...

thanks johnpoz for all your help buddy...

i cant redirect traffic to local dns server.. doesn't work at all... always say 0/0 for state B

all the info says per lan interface lan address target 127.0.0.1 doesn't work

but what about the WAN?


[johnpoz]

why are you trying to redirect dns??  Have you client use pfsense for its dns.. If you don't want client the ability to use outside dns - then just block it.. I never really get the need to do this??  So you don't want some appliance asking googledns for stuff.. Chromecast sort of device that hards code dns?

What are the rules on your lan?  You created the firewall rule association

From the doc's
"If DNS requests to other DNS servers are blocked, such as in the Blocking DNS queries to external resolvers example, ensure the rule to pass DNS to 127.0.0.1 is above any rule that blocks DNS."

You do have unbound listening on loopback right?  Or no its not going to work.

[micropone]

im trying to redirect all clients because 3 different pc's aren't using pfsense's dns… they're using google and HE.. which all 3 machines are set DHCP ONLY --- i will set static dhcp in the morning with pfsense's dns to see thoses machines force to use dns pfsense ONLY

i'm not sure which interface you want to see for the rules... my WAn or lan's

LOL all i want is all clients to be on pfsense dns servers listed in general setup.. thats it nothing fancy but its not the case. like i said different pc's are using different dns server's that I never listed in general setup...

and Yes unbound is listening on ALL

[johnpoz]

"they're using google and HE.. which all 3 machines are set DHCP ONLY"

Huh… Why would your standard dhcp setting not hand out pfsense?

Your LAN rules!!  This was clearly asked..
"What are the rules on your lan?"  Your forward is on the lan interface is it not - so why would you have created any rules on your wan.. But sure post them up if you want and we can take a look.

"LOL all i want is all clients to be on pfsense dns servers listed in general setup"

This is not how it works out of the box..  Unbound as resolver is the default.. Pfsense will point to itself ie 127.0.0.1.. This is ALL pfsense needs - no settings from anywhere in general or from dhcp on its wan..  You turn on dhcp server on an interface be it lan, optX, some vlan.. And pfsense will hand out its IP on that interface to its dhcp clients..

I am not sure what you have done or why you setup anything in general for dns.. Pfsense using unbound out of the box is in resolver mode!!  So it talks from roots down to the authoritative server for the domain your looking for - and then asks that server directly..  All dhcp clients will talk to pfsense for dns - unless you mucked with the config..

As to your redirect - this works as in the docs.. So I tested this.. I set my dns google 8.8.8.8, I then asked google for something it wouldn't know ie pfsense.local.lan and as it should I get back SOA.. I then setup the redirect on lan for anything to 53 to redirect to unbound running on pfsense on loopback.  And again ask what client thinks is google, but now I get back answer for pfsense.local.lan - and you can see it only took 4 ms.. Which that is pretty freaking fast for asking google ;)

[micropone]

man johnpoz you tha MAN…

thanks for all your help----I'd buy you a beer...

first off I switched my kids computers to there own lan.. then using dhcp server i assigned opendns's dns servers... which is working great.... 1 thing solved..

here are my rules..

i did remove all dns's from general then rebooted system and get the root.server see attached.. the reason I set dns servers in general is comcast dns server's are slow and half the time doesn't work or fire's at the headend (sf) etc.. so using dns bench.. i found better and faster with dnscryt support..

im lost with the rules re: dns redirect... I just figured out it's an NAT port forward rule NOT a rule attached to a LAN.. i'm unable is copy what you did... Im missing something!




[johnpoz]

You have admin open to the public internet - wow a horrible IDEA!!  Just horrible - and you worried about dns leakage ;)

You do understand every rule on your lan below the any any are completely pointless!!!

Rules are evaluated top down as they enter the interface, first rule to fire wins - no other rules are evaluated.

You have a dns setup telling pfsense to use external.. So how and the F would it resolve its own stuff.. Though you didn't like comcast dns because they spy on you??

[micropone]

I get your point about the admin page nothing happened yet!! ;D

i gotta fix the rules and report back…

my dns setup.. I will clear the general setup dns servers.. comcast dns servers is just slow to me.. spying aren't all isp working for the ...? I will clear all dns then reboot..

and report back... thanks

[johnpoz]

"nothing happened yet!!"

That you know of ;)  Like saying hey I leave my front door unlocked and nothing has happened.  For you all know some homeless person has been taking a dump every morning in your bathroom after you leave for work and cleaning himself with your toothbrush ;)

[micropone]

he will be at room temp…. i wish he would  ;)

[dennypage]

@johnpoz:

"nothing happened yet!!"

That you know of ;)  Like saying hey I leave my front door unlocked and nothing has happened.  For you all know some homeless person has been taking a dump every morning in your bathroom after you leave for work and cleaning himself with your toothbrush ;)

I gotta remember to lock my front door…