Big DNS Problems *Illustrated*
-
@johnpoz
Hmm. No VPN clients. Yes, I had register DHCP leases in the DNS resolver.
@Gertjan Thanks for your answer. I do not understand why it would restart nor how DHCP leases in a DNS resolver works but I just unchecked it according to your advice! I hope it will fix my issues.
I have about 80 clients at home (Google home, smartphones, etc.) where 10 of my clients such as my Synology NAS, smart switches, and access points are on static ips. Are you talking about this or about DHCP related to DNS? -
I have a question. It may sound stupid but I just am trying to understand things correctly.
So, now I have this config:-
DNSSEC Support activated
-
Forwarding mode, DNS over TLS, and Register DHCP leases in the DNS Resolver deactivated
However, will my PFSense router be able to encrypt my DNS queries with DNS over TLS with my current config? I want to limit my ISP eavesdropping on me as much as possible. Moreover, I would like to ask if my PFsense router is using DNSSEC with Cloudflare's DNS servers? I just activated DNSSEC support. If it does not use DNSSEC and DNS over TLS, what could I do?
Thanks,
-
-
I miss read that.
If your resolving then no you can not do dns over TLS.. for that to work every single NS on the planet would have to be listening and support dns over tls.
If you think your ISP is watching your traffic - for what possible reason you can only imagine... What do they get from knowing that you asked for pfsense.org ? Or p0rn.tld -- then tighten up your tinfoil hat and run everything, even your dns queries through a vpn.
Because clearly those vpn services are way more trust worthy than your ISP... I mean they state it right on their website that they don't log <rolleyes> ;)
-
@johnpoz Hahah. Yes. I saw your previous message ;p. I understood the forwarding mode does not require me to do anything.
So... The only way to get DNS over TLS for me would be to forward all my requests to DNS servers that accept it such as Cloudflare ones?
-
If you want to use dns over tls, then yes you have to "forward" to a dns provider that supports it. You can not resolve over tls.
-
@johnpoz
Hahah yes. I actually am studying security so I just want to learn. That's not my aim to be fully secured and so on. My ISP won't learn much but they can guess a lot ! It is good for me if things like DNS over TLS and so on can be activated easily. PFsense has such amazing capacities and I am still learning. :) -
Do you really think your isp is taking the trouble to snff all dns traffic that goes across their network? Compile it and parse it and put it some database to where billy went on tuesday ;)
Its one thing if you just going to hand them all your queries directly by asking their dns servers... But when you resolve you talk to roots, and specific authoritative ns all over the planet for the domains you look for.
Keep in mind that if they really wanted to spy on you, they can just look to see what is in your http headers for where your going.. And even if using https, the sni is going to contain where you were going, simple enough to look in the client hello packet and see where you were going..
No need to sniff the dns ;)
If you think hiding your dns queries prevents your isp from knowing where your going.. No! All it does is make it a bit harder..
-
@johnpoz Thanks for all the help and knowledge you give me! That's for sure. I did not think about HTTP headers. I forgot they have access to that as my internet traffic goes to them.
However, do you think it would be a problem to activate DNS over TLS with my current configuration (means no forwarding mode activate). It will create unnecessary traffic as you stated and will only do DNS over TLS with servers that accept it, isn't it? Will it nevertheless be working? Will it be useless though?
Thanks,
-
Its only a couple of clicks to get dns over tls working in pfsense and unbound...
If you want to do that you HAVE to forward!!
Its not like unbound can ask every NS it has to talk to to find what your looking for if it supports tls, and if not just query over normal udp 53..
-
@johnpoz Yes, I will stick with no DNS over TLS to avoid problems.
I, however, noticed from the time I deactivated "Register DHCP leases in the DNS Resolver" that my DNS resolver does not restart (log from 6hours). However, I often get: ERR_CONNECTION_TIMED_OUT
DNS PROB STARTED
DNS_PROBE_FINISHED_NXDOMAIN
I also get very slow DNS responses even on known domains such as Google.com. It is very strange... I rebooted everything but still the same problem. Websites with forwarding mode got loaded in about 2-3 seconds and now it is about 10 seconds. So it gets very slow... Do you have any idea, guys?Thnks
-
@skalyx said in Big DNS Problems *Illustrated*:
I do not understand why it would restart nor how DHCP leases in a DNS resolver works but I just unchecked it according to your advice! I hope it will fix my issues.
I have about 80 clients at home (Google home, smartphones, etc.) where 10 of my clients such as my Synology NAS, smart switches, and access points are on static ips. Are you talking about this or about DHCP related to DNS?When you check "DHCP Registration" in the the Resolver setup page, every new lease that comes will get inserted in the DNS cache. This way you can address that device with it's name instead of its IP.
To do this, the DHCP server process (actually, a sub program, called dhcpleases) will signal unbound the resolver. This is done by a restart, so unbound will re read all its config files again.
Unchecking DHCP Regsitratio stops the unbound restarts related to new DHCP leases. -
@Gertjan
Thanks for the explanation!
Deactivating it could cause some issues? Is it the reason why I have these issues:
I, however, noticed from the time I deactivated "Register DHCP leases in the DNS Resolver" that my DNS resolver does not restart (log from 6hours). However, I often get: ERR_CONNECTION_TIMED_OUT
DNS PROB STARTED
DNS_PROBE_FINISHED_NXDOMAIN
I also get very slow DNS responses even on known domains such as Google.com. It is very strange... I rebooted everything but still the same problem. Websites with forwarding mode got loaded in about 2-3 seconds and now it is about 10 seconds. So it gets very slow... Do you have any idea, guys? -
simple dig command for the domains your trying to access, nslookup even.
You understand that NX domains, means what you were locking for doesn't exisit..
It is impossible to troubleshoot with such info... You have to give us the actual domain you were trying to go too.. Let us see an actual output of the lookup.
$ dig www.google.com ; <<>> DiG 9.14.1 <<>> www.google.com ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3890 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;www.google.com. IN A ;; ANSWER SECTION: www.google.com. 2824 IN A 172.217.4.196 ;; Query time: 1 msec ;; SERVER: 192.168.3.10#53(192.168.3.10) ;; WHEN: Tue May 28 05:30:25 Central Daylight Time 2019 ;; MSG SIZE rcvd: 59 -
@johnpoz Hello, thanks for the reply.
I actually get these DNS error messages for a while but then it reloads and works! So I can access the website after the error message but it takes about 8 seconds. This is the case with any domain (cloudflare.com, youtube.com, reddit.com, netgate.com, etc.). It sometimes happens (like every 30min) and then everything gets back to normal. I cannot see anything in my log but I will reply to the post whenever the problem happens again with detailed logs. -
Bring on encrypted SNI!
-
@stephenw10 sorry Steve. I do not know what you are talking about hahaha
-
Its an up and coming protocol so that as you saw in my posted client hello you could easy see the fqdn connecting too.. With encrypted sni, you will not be able to do that ;)
https://blog.cloudflare.com/encrypted-sni/
To be honest only and when that is actually common does it make any sense to try and hide dns. Until then - hiding your dns is more like when small child closes their eyes and think you can not see them ;)
There are many so called security practice that do really nothing but give the user of said practices a "false" sense of security ;)
-
@johnpoz I see, John. Thanks for the explanation.
Do you have any idea about what I could do to fix my issue?
Thanks,
-
@skalyx said in Big DNS Problems *Illustrated*:
Do you have any idea about what I could do to fix my issue?
Not without you providing some actual useful info..
Lets see a dig query to pfsense when you say you have problem resolving suff. Did you bump logging in unbound, did you set it to actually log queries and answers? This can be done in the options box.
Have you looked to see what unbound shows for where it would lookup domainx.tld that your having problems with..
This will show you the stats for unbound talking to a specific NS that it uses to query for domainx.tld, etc.
If you don't want to try and troubleshoot the actual problem, then use forwarding mode, or use dnsmasq on pfsense (forwarder) vs unbound. Or have your clients point directly to some outside dns, etc. One slick thing with dnsmasq as forwarder vs unbound as one - is dnsmasq can ask multiple dns at the same time and use the fastest response.. So you could have say 4 different NS listed from 4 different dns services and it would ask all of them - and use the one that responds first.
You say your on some "amazing" 4G connection.. Ok sure - what are the response times? What does the quality graph on pfsense show for this connection... Maybe its not as "amazing" as you think... As mentioned already high latency lines are not going to be good option for resolving.
-
@johnpoz
Thanks for the answer and sorry for the late reply. I got some personal issues.Yes, I looked at the logs and I could not see anything weird with my knowledge. I, then, activated forwarding mode without DHCP lease last morning and from that time I do not see any problem. Very weird. Maybe DHCP lease was what caused problems to me. My internet experience is much faster even with DNS over TLS enabled. No DNS problems so far. I will, however, look into Dnsmasq. It really looks amazing.
My DNS responses time based on DIG results look kind of similar to my neighbors VDSL connection. He gets better responses time but pays 15 times more than me. Regarding my ping, I get 12ms on average according to speedtest.net whereas he gets 7ms.
EDIT: I just looked into DNSmasq and it looks like it is enabled by default when forwarding mode is activated. Thus, I would like to ask you if having 4 dns servers in General Setup is better than 2 according to what you said: " So you could have say 4 different NS listed from 4 different dns services and it would ask all of them - and use the one that responds first." Will it query these 4 DNS servers?
