Setup DNS over TLS on pfSense 2.4.4 p2 - Guide

musicwizard

@johnpoz Im not using Cloudflare but Quad9 they might not be better but ok.

do you know if there will be a option in pfsense to do the encrypted DNS intern and not longer rely on other parties?

johnpoz

@musicwizard said in Setup DNS over TLS on pfSense 2.4.4 p2 - Guide:

pfsense to do the encrypted DNS intern

Huh??? That makes zero sense... You want to do encrypted dns from your local client to your local NS?

musicwizard

@johnpoz No to the root servers.

jimp

For it to work in resolver mode, that would require the roots and every other authoritative DNS server to support DNS over TLS. I'm not aware of any plans to make that happen.

musicwizard

@jimp Thank you that what i was wondering about.

johnpoz

There is no way that could ever happen to be honest, since every single authoritative NS on the planet for ever single domain would have to be listening on TLS..

Plus it would just be horribly slow as F!!!

Its been how many years since dnssec.. 2010 was when roots enabled it.. So 10 years, and have to be honest a very low deployment... For TLS to be deployed to every single authoritative NS it would be 20, 30, 40 years ;) sort of thing...

AudiAddict

Thanks for this guide! Four questions:

Can somebody confirm if you need Disable DNS Forwarder checked or unchecked in the general page? The confusing part is the guide has it checked in the beginning and later in screenshots in this topic I see it unchecked.

alt text

Under DNS resolver settings I followed the guide but I was wondering how this would work if I would to check Register DHCP leases in the DNS resolver and Register static mappings in the nds resolver. Would it try to register it with cloudflare (and thus not work) or would it cache it localy? For use in graphs / stats I would like to register my workstations and devices in the DNS if possible to make lookup easier. hostname.mynetwork.lan

alt text

Do you agree that I leave my dns settings blank at my DHCP page? Or should I put in my pfsense host or cloudlfare dns here?

alt text

I use ubiquiti Accesspoints and cloud key. I assign them with static IP's. So these are not getting DHCP leases. Would you recommend using the cloudlfare DNS as a setting in the ubiquiti gear to prevent any issues when pfsense is down? Primary DNS pfsense ip / 2nd cloudlfare? gateway pfsense? suffix ? no idea? home.lan (pfsense.home.lan)?

alt text

Thanks in advance for your help!

johnpoz

If you check "do not use Forwarder/Resolver for the firewall" then pfsense will not ask itself to then be either forwarded or resolved.. It will ask directly the NS you have listed in the general setup. It will not be able to resolve any local resources you have setup in either dnsmasq or unbound, or even if your using bind package. And it would not be able to do any sort of dot or doh.. It would just be normal dns query to what you have listed, or what NS you got from your isp via dhcp.

The only reason you might set that option is if you want pfsense to use some other NS.. Say your not really using dns on pfsense at all for your clients.. And you want pfsense to be able to check for packages or upgrades, etc.

That should pretty much always be unchecked..

AudiAddict

Perfect @johnpoz ! I will leave it unchecked.

Can you also help with my other questions?

johnpoz

no they would never try and register with clouldflare - dhcp registration has proved for many to be problematic since it restarts unbound anytime there is lease update.

Just use static reservation, and this will populate unbound with the names and IPs you put in your dhcp reservations.. If you have other devices that are setup static on the device you can just put in host overrides for them to resolve.

Default is dhcp running on pfsense to point clients to pfsense IP address for dns, this common setup. You normally never have to put something in there unless you want to point dhcp clients to something specific other than pfsense.
No I would not recommend pointing them to anything other than pfsense. For you to resolve them, must either setup a reservation for them, even if they do not use it.. So the names will be put into unbound via register static dns reservation check box. Or just setup a host override for them.

phil80

Hi,

Thank you for this great reference.

However, I did not find a really best practice exact guide to setup firewall rules to properly redirect external clients DNS requests, (53 and DOT). I understand DOH needs custom options in the unbound DNS resolver

I would need an advice about my firewall rules:

Are the two bottom deny rules really needed when we redirect with the 2 rules above them ?

Also, I added these entries to my custom options Unbound DNS resolver:

# Block DNS over HTTPS (DOH) client requests so that they are redirected to pfSense
server:
local-zone: "use-application-dns.net" always_nxdomain
local-zone: "cloudflare-dns.com" always_nxdomain
local-zone: "dns.google" always_nxdomain
local-zone: "dns.quad9.net" always_nxdomain
local-zone: "dns9.quad9.net" always_nxdomain
local-zone: "dns10.quad9.net" always_nxdomain
local-zone: "dns.adguard.com" always_nxdomain
local-zone: "dns-family.adguard.com" always_nxdomain

I tested with Firefox and also by setting a custom DNS server in Windows 10 and it seems to block properly the DNS requests and redirect them to my DOT setup in pfSense

Hope any one can answer about the rules

Best regards

johnpoz

Those rules are not needed.. Unless your wanting to allow downstream not lan net to be forwarded.

Rules are evaluated top down, first rule to trigger wins, no other rules evaluated. Your top rules allows any any, so no need for the allow to 53 on loopback.. Already allowed by rule above it.

What are your port forwards?

The problem with redirecting doh or dot, is your server your redirecting to is not going to have the correct cert.. You would have to know where the client is going, and then your dns would have to use cert with that fqdn on it, and your client would have to trust it.

Your reject rules would never be seen, again because you have a rule that allows any any above them... Unless you were trying to block something that is not lan net, how would non lan net source be on your lan? Do you have downstream networks? And there is a default deny anyway.. So while rejects can be useful, that traffic would be blocked anyway if not allowed somewhere above.

How is serving up nx, going to get them to talk to your pfsense? Again for redirected doh or dot to ever work, your NS would have to have the correct cert to use.. Which how have you done that?

jimp

The most up-to-date info is not in this thread, it's in the docs:

https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html
https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html
https://docs.netgate.com/pfsense/en/latest/recipes/dns-block-external.html