Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Need help with my VLAN firewall rules to make sure they do what I think they do

    Scheduled Pinned Locked Moved Firewalling
    69 Posts 5 Posters 4.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User @bingo600
      last edited by A Former User

      @bingo600 OK, ummmm. I guess... I can think of other ways to do that... Are they doing two things at once. That the box can resolv some domain and getting the list of supported OS's in one go. Why...

      johnpozJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator @A Former User
        last edited by

        Looking into a bit deeper something about MS dns not supporting cookie options.. But looks to me like the suggested work around was to just set +nocookie in the dig command.

        No matter what lame reasoning they came up with - doing a directed query like that is not the way to do it if you ask me.

        You could offer it up as a solution if the normal query failed, etc. But doing it in the background not a fan of.. Other option was to hard code the supported OS versions.. which would of been better options I think as well.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        ? bingo600B 2 Replies Last reply Reply Quote 0
        • ?
          A Former User @johnpoz
          last edited by

          @johnpoz Just go after some list they host somewhere on pi-hole.net.

          1 Reply Last reply Reply Quote 0
          • bingo600B
            bingo600 @johnpoz
            last edited by

            @johnpoz
            Did you find the git PR that shows the cookie issue ?
            I had a brief look , but didn't find any.

            /Bingo

            If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

            pfSense+ 23.05.1 (ZFS)

            QOTOM-Q355G4 Quad Lan.
            CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
            LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

            1 Reply Last reply Reply Quote 0
            • bingo600B
              bingo600
              last edited by bingo600

              Ahh think it's this one

              (Win SRV 2008R2) , that is even out of support ... Grrrrr
              https://github.com/pi-hole/pi-hole/issues/3578

              That leads to this one
              https://github.com/pi-hole/pi-hole/issues/3595

              That even contains

              Try with dig +nocookie -t txt versions.pi-hole.net
              

              Sigh .... Redmond again šŸ¤’

              If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

              pfSense+ 23.05.1 (ZFS)

              QOTOM-Q355G4 Quad Lan.
              CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
              LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @bingo600
                last edited by

                Yeah and it was with 2008r2 that is DEAD... full end of life was jan 2020, so why would they be doing something to work around an issue with that in july of 2020?

                All seems a bit stupid to me..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                I bingo600B 2 Replies Last reply Reply Quote 0
                • I
                  imthenachoman @johnpoz
                  last edited by

                  @johnpoz @bingo600 A lot of what y'all are saying is going way over my head. I am trying to decode/translate for myself. It sounds like y'all are talking about something specific to pi hole -- is that right? Just so I can better understand the conversation...

                  bingo600B 1 Reply Last reply Reply Quote 0
                  • bingo600B
                    bingo600 @imthenachoman
                    last edited by

                    @imthenachoman
                    Yes .. We're talking about pi-hole , and DNS blocking.
                    And that pi-hole won't update if you block DNS to anything but the pfSense.

                    If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                    pfSense+ 23.05.1 (ZFS)

                    QOTOM-Q355G4 Quad Lan.
                    CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                    LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                    I 1 Reply Last reply Reply Quote 0
                    • I
                      imthenachoman @bingo600
                      last edited by

                      @bingo600 I see. Interesting. Thanks!

                      1 Reply Last reply Reply Quote 0
                      • bingo600B
                        bingo600 @johnpoz
                        last edited by bingo600

                        @johnpoz

                        I just got a new update for my pihole, i suppose you ought to see it too

                        This time i tried

                        PIHOLE_SKIP_OS_CHECK=true sudo -E pihole -r
                        

                        Selected repair , and the update went through wo. opening for ns1

                        But damm annoying 😠 šŸ‘Ž

                        If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                        pfSense+ 23.05.1 (ZFS)

                        QOTOM-Q355G4 Quad Lan.
                        CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                        LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @bingo600
                          last edited by johnpoz

                          Looks like an update to FTL.. lets see what happens.. I have these rules in place..

                          blockdns.png

                          For the vlan that my pihole sits on..

                          Yeah this is nonsense...

                           [āœ—] Retrieval of supported OS list failed. dig failed with return code 9. 
                                Unable to determine if the detected OS (Raspbian 10) is supported
                                Possible causes for this include:
                                  - Firewall blocking certain DNS lookups from Pi-hole device
                                  - ns1.pi-hole.net being blocked (required to obtain TXT record from versions.pi-hole.net containing supported operating systems)
                                  - Other internet connectivity issues
                          

                          This is zero issue with grabbing that info.. Other that you forcing a direct query to ns1.. Gawd this just pisses me off that they do nonsense like this.. Arrrghh.. Why are people so freaking stupid?????

                          root@pi-hole:/home/pi# dig versions.pi-hole.net txt
                          
                          ; <<>> DiG 9.11.5-P4-5.1+deb10u2-Raspbian <<>> versions.pi-hole.net txt
                          ;; global options: +cmd
                          ;; Got answer:
                          ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16772
                          ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
                          
                          ;; OPT PSEUDOSECTION:
                          ; EDNS: version: 0, flags:; udp: 4096
                          ;; QUESTION SECTION:
                          ;versions.pi-hole.net.          IN      TXT
                          
                          ;; ANSWER SECTION:
                          versions.pi-hole.net.   3600    IN      TXT     "Raspbian=9,10 Ubuntu=16,18,20 Debian=9,10 Fedora=31,32 CentOS=7,8"
                          
                          ;; Query time: 356 msec
                          ;; SERVER: 127.0.0.1#53(127.0.0.1)
                          ;; WHEN: Sat Dec 26 19:21:24 CST 2020
                          ;; MSG SIZE  rcvd: 127
                          
                          root@pi-hole:/home/pi# 
                          

                          So they fixed working with some antiquated dns windows server 2008??? That is EOL!!! By just bypassing it. To break everyone else that would be filtering dns other than their own.. Ie pretty much every pihole user on the planet ;) This is just some of the stupidest shit ever.. WTF!!!

                          While I am a fan of pihole - this is just borked.. Same goes with some of the nonsense they are trying to do with dnssec.. If your going to forward, dnssec is pointless - he doesn't get that either.. Maybe we should fork their code ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          bingo600B 1 Reply Last reply Reply Quote 0
                          • bingo600B
                            bingo600 @johnpoz
                            last edited by

                            @johnpoz said in Need help with my VLAN firewall rules to make sure they do what I think they do:

                            While I am a fan of pihole - this is just borked..

                            Totally agree .. Fix for an old outdated OS , and "bork" everyone else.

                            Same goes with some of the nonsense they are trying to do with dnssec.. If your going to forward, dnssec is pointless - he doesn't get that either..

                            I thought they wouldn't touch DoH at all as "PH is not a security product"

                            Maybe we should fork their code ;)

                            He..He
                            Intriquing , but i doubt i have time for that.

                            /Bingo

                            If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                            pfSense+ 23.05.1 (ZFS)

                            QOTOM-Q355G4 Quad Lan.
                            CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                            LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.