Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    host over ride does not work on chrome

    Scheduled Pinned Locked Moved DHCP and DNS
    22 Posts 4 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      scorpoin
      last edited by scorpoin

      Hello to All,

      I'm using DNS Resolver along with Host Over Ride option . I've added some of my local web servers name in that list along with their respective ip address.

      Now issue is when I access any of those listed server via chrome browser I'm getting DNS rebinding attack message from pfsense but when using Firefox browser with name it does access it with out any issue. I could not figure out what's going on. Why do I get DNS rebind attack message using chrome browser .

      Regards

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        You prob get better help on site for chrome then.

        This has nothing to do with pfsense. If unbound returns a rfc1918 address for some fqdn.. And your browser says its a rebind.. That is on the browser, not on unbound. or pfsense.

        My guess would be chromes dns cache..

        Or if your doing dns redirection.. And chrome thinks it using 8.8.8.8 for example, and now for some fqdn, its now getting rfc1918 returned... Then yes that is a rebind..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • S
          scorpoin
          last edited by

          @johnpoz said in host over ride does not work on chrome:

          Or if your doing dns redirection.. And chrome thinks it using 8.8.8.8 for example, and now for some fqdn, its now getting rfc1918 returned... Then yes that is a rebind..

          along with dsn resolver I'm using pfblock as well , is this the case then how to over come this issue for local web servers?

          Regards

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            And again - what dns returns has nothing to do with rebind... Its your client saying its a rebind.. And the only reason they would do that is their own settings or cache and having seen a public for that IP..

            I set up an override.. If that is returned, what your client says or does with that is on the client.. There is nothing you can do in pfsense to change that..

            hostoverrride.png

            I pointed cnn to 192.168.1.100 with an override - if my browser says that is a rebind... That is on my browser, and nothing pfsense could do could change that.

            The only way your browser says that is a rebind, is if they know that cnn com is something else that is public ip and not rfc1918.. This is a setting on the client, this is cache on the client. etc.

            Flush your browsers cache, make sure its not using doh.. Are you redirecting dns on pfsense - so any dns on client goes to pfsense?

            The only thing you can do with rebind on pfsense/unbound is turn it off for when you forward or resolve with unbound, and it gets back rfc1918 - it would not return that to the client.. Only local resources in unbound, like host override or dhcp reservations can return rfc1918.. You can turn that off, or you can tell specific domains are ok to return rfc1918.. Say with plex.tv for example.. But your browser thinking some host override you setup is a rebind, is on the browser settings - not on pfsense.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • S
              scorpoin
              last edited by

              @johnpoz said in host over ride does not work on chrome:

              Flush your browsers cache, make sure its not using doh.. Are you redirecting dns on pfsense - so any dns on client goes to pfsense?

              yes redirect DNS query to pfsense . when I ping that name from any of my client it return the local ip address . On other end Firefox working great it does access local web via name.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Well if you redirect, and your browser cache doesn't match up - or again client settings thinking its using say 8.8.8.8 and gets back rfc1918.. Then that would be a rebind yes..

                Again - there is nothing you can do on pfsense to stop your browser from thinking what it gets back is rebind. That is on the browser..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • S
                  scorpoin
                  last edited by

                  @johnpoz said in host over ride does not work on chrome:

                  Again - there is nothing you can do on pfsense to stop your browser from thinking what it gets back is rebind. That is on the browser..

                  Well very strange I've observed when I remove the check from
                  Syste-->General Setup : DNS Server Override . My all clients unable to surf internet . I've one rule in LAN which I allow(Pass) all src and destination my firewall IP dst port 53 . on top of my rules . and block all lannet src not firewall IP and dst port 53 . The block rule does not have any impact .

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    @scorpoin said in host over ride does not work on chrome:

                    Syste-->General Setup : DNS Server Override

                    That allows dhcp from your isp to set dns on pfsense.. Again has ZERO to do with anything..

                    dnsoverride.png

                    Without that checkbox - dhcp from your isp would not be able to set dns on pfsense - for your forwarding..

                    That should really never be checked to be honest... Unless your forwarding and want to forward to your isp dns? And or if your resolving, and you want pfsense itself to be able to ask your isp dns if resolving fails. Which would have nothing to do with what clients get when asking pfsense.

                    And again - what your "client" thinks is a rebind or not has zero to do with pfsense or unbound, or pfblocker on pfsense.. ZERO.. What you use for dns on pfsense be it you resolve, be it you forward.. None of that has anything to do with what your client thinks is a rebind or not - period!!

                    If you setup a host override for some fqdn to resolve 192.168.1.100 for example.. And pfsense returns that when you ask it via a dns query.. If your client thinks that is a rebind - that is on your client.. And there is NOTHING you can do in pfsense to change that..

                    rebind protection comes into play when unbound or dnsmasq for that example are forwarding or resolving and they ask some other dns server for anything.. .If that anything is returned as rfc1918 then its a rebind.. But in such a case pfsense would not return the address to the client asking for some fqdn.. Unless you disable rebind protection or set the domain in question as private so that unbound/dnsmasq would return the rfc1918 address to the client.

                    None of that has anything to do with a host override.. Are you actually doing a domain override? Rebind protection on pfsense would not return a rfc1918 address if it did a domain override - unless you again set the domain as private or disabled rebind on pfsense.

                    But none of that has anything to do with anything when you do a host override.

                    As per my example - do a dig, or host, or nslookup to pfsense for whatever fqdn you set a host override for - did you get back rfc1918 address?? If so then pfsense is doing what you told it - if your client thinks that is a rebind - that is on your client! Period!!

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • S
                      scorpoin
                      last edited by

                      @johnpoz said in host over ride does not work on chrome:

                      That should really never be checked to be honest... Unless your forwarding and want to forward to your isp dns?

                      @johnpoz thanks for your prompt response , I have static IP and I;ve added manual DNS in

                      Settings-->General Setup --> DNS Servers

                      Tick DNS Server Override.

                      Onther end DNS Resolver

                      Services DNS Resolver General Settings.png

                      If I remove check of DNS Override from Setting General setup my client internet stop working :/ .

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        It seems you have no understanding of how any of this works at all.

                        Your in forwarding mode, you have dnssec enabled (pointless while forwarding) and you also want to use dns over tls.. But you also haven't set any dns in general? And just let your isp hand you theirs? Which sure and the F are not going to work for dns over tls..

                        None those settings make any sense..

                        Do you want to forward? To where? google, quad9, cloudflare? You want to use dns over tls?

                        Or is it your just randomly clicking shit you do not understand in a hope to get something working?

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire
                          last edited by

                          @scorpoin said in host over ride does not work on chrome:

                          getting DNS rebinding attack message from pfsense

                          A screenshot might help but I'm going to guess your browser is connecting to pfSense and not the web server, in which case this message is because pfSense sees you connecting via an unexpected URL. (System->Advanced->Alternate Hostnames)

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          S 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            ^ possible.. That could be that he is hitting web gui vs his public IP for whatever fqdn he is looking up..

                            What is the fqdn your trying to set an override for - do you get back the local IP you put in the override for this when you do a query to pfsense?

                            See the above example I did for cnn

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            S 1 Reply Last reply Reply Quote 0
                            • S
                              scorpoin @SteveITS
                              last edited by

                              @teamits

                              I guess you are right but thing is those names are not for pfsense itself , those are suppose to be local web server on LAN.

                              Regards

                              1 Reply Last reply Reply Quote 0
                              • S
                                scorpoin @johnpoz
                                last edited by scorpoin

                                @johnpoz

                                You are right I'm doing DNS forwarder here is Setting-->General Setup

                                System General Setup.png

                                And DNS Resolver Config Screen

                                Services DNS Resolver General Settings.png

                                I've a static IP from ISP . When I remove the check of DNS Server Override in General Setup . Internet on client side stop working and unable to resolve any thing : / . Although on DHCP Server DNS list I've added my Pfsense IP as primary and seconday google-DNS .
                                Regards

                                Regards

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  Fix your dns.. Problem solved.

                                  Although on DHCP Server DNS list I've added my Pfsense IP as primary and seconday google-DNS .

                                  That setup is borked out of the gate.. You don't control what dns a client uses if you give them more than 1. If they don't both resolve the same thing, then you have no idea what a client might be able to resolve or not..

                                  If you want to forward to google, then do that.. But your clients should only get pfsense for their dns, if you ever expect a client to resolve local resources.

                                  Also if your going to forward, dnssec is pointless to have checked.

                                  Why are you forcing pfsense dns out some gateway?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    scorpoin
                                    last edited by

                                    That was an optional and I've removed it as well . Now issue is when I remove the check from DNS Overide in General Setup or from DNS Resolver configuration all of sudden clients are unable to access internet :/ which I could not figure it out yet . where am I doing wrong in configuration .

                                    Regards

                                    GertjanG 1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @scorpoin
                                      last edited by Gertjan

                                      @scorpoin said in host over ride does not work on chrome:

                                      Now issue is when I remove the check from DNS Overide in General Setup

                                      This one :

                                      47ac37df-314f-454b-aeb0-296ce7346b17-image.png

                                      ?

                                      That was a practice in the past, somewhere in the last century I guess, when users had to use the DNS of their ISP.
                                      The ISP boxes forward to the DNS of the ISP - and the box handles all it's clients DNS requests, who forwarding it upstream with some caching facilities.

                                      I guess this option still exist for historical reasons.
                                      pfSense, when you unpack it, is set up for perfect DNS handling. If there are DNS issues, the issue is upstream. => Ditch your ISP.

                                      @scorpoin said in host over ride does not work on chrome:

                                      Now issue is when I remove the check ..... from DNS Resolver configuration all of sudden clients are unable to access internet

                                      What check where on that page ?

                                      These settings :

                                      cb0c6822-5746-4892-a793-ba637e6e62e3-image.png

                                      are default and perfect.

                                      ( Note that I also use pfBlockerNG 3.0.0.3, so two options are set accordingly.

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      S 1 Reply Last reply Reply Quote 0
                                      • S
                                        scorpoin @Gertjan
                                        last edited by

                                        @gertjan

                                        Thanks I've tried selecting python mode but I'm unable to find any thing in drop down list.

                                        Python Module Script :

                                        there was not any thing like pf-unbound or such .

                                        Regards

                                        GertjanG 1 Reply Last reply Reply Quote 0
                                        • GertjanG
                                          Gertjan @scorpoin
                                          last edited by

                                          @scorpoin said in host over ride does not work on chrome:

                                          I've tried selecting python mode but I'm unable to find any thing in drop down list.

                                          Because :

                                          @gertjan said in host over ride does not work on chrome:

                                          Note that I also use pfBlockerNG 3.0.0.3, so two options are set accordingly.

                                          AND

                                          I activated unbound + python mode in pfBlockerNG 3.0.0.3 - and after this you'll see
                                          407c8318-f087-4d9f-a746-0c40b11eb1cc-image.png

                                          because unbound uses this python module to do "pfBlockerNG " stuff.

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by johnpoz

                                            Lets forget pfblocker until you actually have dns working and working for your host overrides.

                                            Where do you want to forward too?

                                            202.143.112.206

                                            206.112.143.202.in-addr.arpa. 86400 IN  PTR     ftth-112-206.satcomm.pk
                                            

                                            Is that your ISP dns? Do they support dns over TLS? I doubt it to be honest..

                                            If your going to use dns over tls, you have to set the host name for the dns to be used.. So the cert will work.. While it still might work - you can run into issues where it wont even work.. If your going to use dot, you really should have hat that set correctly for the dot server your going to use.

                                            https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html

                                            The hostname is technically optional but dangerous to omit. The DNS Resolver must have the hostname to validate that the correct server is providing a given response. The response is still encrypted without the hostname, but the DNS Resolver has no way to validate the response to determine if the query was intercepted and answered by a third party server (Man-in-the-Middle attack).

                                            I would suggest you get basic forwarding working.. Before you try and move to dns over tls.

                                            So either go back to default setup, where unbound just resolves. Or start with basic forwarding, then move to over tls.

                                            Be it your forwarding or resolving works or doesn't work has nothing to do with a host override, because that is just a local resource.. if unbound is running, it would return any host overrides it has setup.

                                            So do a simple query to an IP that pfsense is listening for dns on, by default this is all.. And do a query for your host override.. If that works.. Then ANYTHING that does not return that be it chrome or firefox or some pc, laptop or phone, etc.. is NOT USING pfsense as its dns.. If it was - then it would return the IP you setup in your host override..

                                            I showed an example of this.. So use your fav dns tool, nslookup, dig, host, etc. and do the query.. What do you get?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            S 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.