pfBlocker inconsistent on LAN port

garyn

Hi pfSense Team!

I'm having difficulty with my pfBlocker setup. I'm running a SG-5100 on 2.4.4-RELEASE-p3 and package pfBlockerNG-dev 2.2.5_23.

My system looks like this:
igb0 - WAN
igb1 - LAN
ix0 - WIFI
ix1 - vpnOnly

I do not have any bridges, VLAN, wireless interfaces setup, but I do have openVPN setup.

My test site is adspeed.net which is always correctly blocked to 10.10.10.1 on the WIFI and vpnOnly legs. However, LAN is flaky and seems to have access to some other DNS server. Sometimes it works correctly and sometimes it does not. If I turn off the last LAN rule (picture below) and flush the local DNS cache, then adspeed consistently resolves to 10.10.10.1 as desired.

System->general DNS is set to 127.0.0.1.

WIFI rules look like this (devices connecting via WIFI can reach only the WAN port):
![alt text]( image url)

LAN rules look like this:
![alt text]( image url)

firewall -> pfblocker -> ip looks like this:
![alt text]( image url)

I suspect that allowing LAN access to * (WAN, WIFI, openVPN, or vpnOnly) is somehow the culprit. I thought I had fixed the issue by blocking DNS (port 53) and by switching to only IPv4 addresses to all my devices, but that seems to have been a red herring.

I'm a pfSense novice so I appreciate your pointers and suggestions on firewall rule changes or other settings that I should check.

Thank you in advance!

Gary

garyn

Crickets!

Does my problem description make sense? Did I leave out some useful/critical information? Maybe, should I have posted this on firewall rules?

I'm not sure where/what in my setup to check. I did forget to mention above that all interfaces are set to give out only IPv4 addresses to the client nodes.

JeGr

What devices specifically are you talking about that behave the wrong way? As you talk about Wifi much I suspect mobiles?

What DNS settings do the clients have? Have you checked that they have pfSense as DNS server and not something external? Mobiles like android etc. are notorious for using Google's DNS even if DHCP would indicate a local one. As quite a few clients now know how to use DNS over TLS or HTTPS (tcp/853 or tcp/443) it could get a bit difficult to find the culprit. Perhaps not blocking the external DNS via block of udp/53 but redirecting it to pfSense will work better in your case? And setting up DNS resolver to also answer clients on DoT port (852) and redirecting those to external sources, too?

If your test-site is sometimes blocked and sometimes not, it seems the client either used an external source -> so check the clients DNS settings - or something was wrong with unbound/DNS resolver -> you could check that in DNS resolver or pfBlocker logs at the time you are checking it.

garyn

JeGr

No luck, but thanks for taking a crack at this. I would still like to solve the problem.

I'm having almost the opposite problem that you described: the wifi devices are mostly well behaved and the LAN devices (mostly W7 boxes) are evading ubound. It's like W7 has an alternate DNS path.

A failing LAN device looks like this:

Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
Link-local IPv6 Address . . . . . : fe80::915<snip>
IPv4 Address. . . . . . . . . . . : 192.168.2.202
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.1
Tunnel adapter isatap.localdomain:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : localdomain
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

The gateway is pointing to pfsense, 192.168.2.1 (nslookup shows this too). Google search says isatap and Terdo are Windows for IPv6 over IPv4. This box was recently booted. I do not know why it is getting a IPv6 address? The interface is set to give out IPv4 addresses only.

I could not find a useful ubound log showing its status while attempting to look up adspeed.net. Are there better logs than pfsense system logs -> system -> dns resolver? I do see ubound messages, but nothing useful about what sites are begin resolved. I did ipconfig/flushdns before watching logs for nslookup adspeed.net.

JeGr

@garyn said in pfBlocker inconsistent on LAN port:

This box was recently booted. I do not know why it is getting a IPv6 address? The interface is set to give out IPv4 addresses only.

fe80:: are local adresses. Every IP6 capable box has one/gets one for itself. That's normal.

Teredo tunneling could be a problem but seems off here. But what does DNS tell you on that box? Where does DNS point to? nslookup for example shows which server? Try

nslookup adspeed.net

@garyn said in pfBlocker inconsistent on LAN port:

I do see ubound messages, but nothing useful about what sites are begin resolved.

You can raise the log level in the DNS Resolver configuration. Just set it higher and it will log which name has been requested etc.

johnpoz

@garyn said in pfBlocker inconsistent on LAN port:

A failing LAN device looks like this:
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
Link-local IPv6 Address . . . . . : fe80::915<snip>
IPv4 Address. . . . . . . . . . . : 192.168.2.202
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.1
Tunnel adapter isatap.localdomain:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : localdomain
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :

That doesn't show any DNS - so that box wouldn't be able to look up anything, be it blocked or not.

Output ipconfig /all from the box!

garyn

I checked the DNS and here are two outputs:

C:>ipconfig /all | findstr /R "DNS\ Servers"
DNS Servers . . . . . . . . . . . : 192.168.2.1

C:>nslookup
Default Server: router.localdomain
Address: 192.168.2.1

johnpoz

@garyn said in pfBlocker inconsistent on LAN port:

C:>ipconfig /all | findstr /R "DNS\ Servers"

That is not going to show you more than the 1st one!! if you have more than 1..

as you see I on purpose set 2

$ ipconfig /all                                                                     
                                                                                    
Windows IP Configuration                                                            
                                                                                    
   Host Name . . . . . . . . . . . . : i5-win                                       
   Primary Dns Suffix  . . . . . . . : local.lan                                    
   Node Type . . . . . . . . . . . . : Hybrid                                       
   IP Routing Enabled. . . . . . . . : No                                           
   WINS Proxy Enabled. . . . . . . . : No                                           
   DNS Suffix Search List. . . . . . : local.lan                                    
                                                                                    
Ethernet adapter Local:                                                             
                                                                                    
   Connection-specific DNS Suffix  . :                                              
   Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller           
   Physical Address. . . . . . . . . : 00-13-3B-2F-67-62                            
   DHCP Enabled. . . . . . . . . . . : No                                           
   Autoconfiguration Enabled . . . . : Yes                                          
   IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)                     
   Subnet Mask . . . . . . . . . . . : 255.255.255.0                                
   Default Gateway . . . . . . . . . : 192.168.9.253                                
   DNS Servers . . . . . . . . . . . : 192.168.9.253                                
                                       192.168.3.10                                 
   NetBIOS over Tcpip. . . . . . . . : Enabled

Now I do your command..

And it only lists the 1st one

$ ipconfig /all | findstr /R "DNS\ Servers
   DNS Servers . . . . . . . . . . . : 192.168.9.253

Also wanted to see if you had any other connections, etc. etc. post the full output!

garyn

C:>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : <snip, looks correct>
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : localdomain <<<=== is this an issue???

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : Intel(R) Ethernet Connection (2) I218-V
Physical Address. . . . . . . . . : F0-79<snip>
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::<snip>%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.2.202(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Saturday, July 13, 2019 7:10:12 AM
Lease Expires . . . . . . . . . . : Saturday, July 13, 2019 12:10:12 PM
Default Gateway . . . . . . . . . : 192.168.2.1
DHCP Server . . . . . . . . . . . : 192.168.2.1
DHCPv6 IAID . . . . . . . . . . . : 25<snip>29
DHCPv6 Client DUID. . . . . . . . : 00-01-<snip>-4D
DNS Servers . . . . . . . . . . . : 192.168.2.1
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.localdomain:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

That's the whole output with some parts of the physical addresses snipped (I wasn't sure if that was/wasn't needed).

johnpoz

@garyn said in pfBlocker inconsistent on LAN port:

DNS Suffix Search List. . . . . . : localdomain

so if you look for name.. You will query name.localdomain if you query say www.cnn.com you could also ask for www.cnn.com.localdomain

You really have to be specific on what pfblocker is not blocking - if pfblocker blocks something it will return an address 10.10.10 - which isn't going anywhere, etc. Other than the vip running on pfsense.

But your box doesn't have more than 1 dns server listed. So its always going to ask pfsense for dns, unbound (pfblocker)

garyn

@johnpoz - about two days ago I made the following change and, I think, things are running a little more consistently:

Services -> DNS Resolver -> General Settings:
![alt text]( image url)

I limited Network interfaces to just LAN, WIFI, VPNONLY (the three in-house rails/ports), and localhost and set Outgoing Network Interface to just WAN. Previously, these were both set to ALL (the default).

Does this change seem like it would have an effect on the issue? This should be limiting where DNS Resolver is supplying IP translations to, ... correct?

johnpoz

Yeah that will limit who can query it - but that would also be done by firewall rules. For example - you don't have 53 open on your wan do you?

You are running pfblocker - so maybe you do, depending... It has a nasty habit of creating an any rule.. I have brought it up multiple times..

But queries to it wouldn't stop it from working..

Again your going to have to be specific in what exactly your problem is, or why you think its not working all the time.. A simple dig or nslookp for the fqdn will tell you if blocked or not blocked.

Grimson

Also remember things like: https://forum.netgate.com/topic/133679/heads-up-be-aware-of-trusted-recursive-resolver-trr-in-firefox

johnpoz

Valid point!!! You never knows these days your application might be doing dot or doh to circumvent your local dns.. Bastards!!!

BBcan177

@johnpoz said in pfBlocker inconsistent on LAN port:

You are running pfblocker - so maybe you do, depending... It has a nasty habit of creating an any rule.. I have brought it up multiple times..

Stop trolling:
https://github.com/pfsense/FreeBSD-ports/pull/641

johnpoz

Not trolling - have no idea version user is using. And I was gone for the whole month of June.. And just back last week or so.. So have not really kept up with "everything" while gone.

Glad to see such a fix finally.. Thanks!