Domain override for .onion domains not possible

[Daniel Abrecht]

I have a tor service running on a vm in one of my subnets, which I use as default gateway & dns for all PCs and VMs in the same subnet in order to route all internet traffic through the tor network. The VM running the torservice uses the pfSense firewall as default gateway. Every other PC in that subnet is blocked from using the pfSense firewall as gateway using a firewall rule. I use tor this way in order to prevent any application from circumventing the tor socks proxy.

My LAN and DMZ networks are in a subnet different from the one containing those PCs and VMs. A lot of Linux distributions offer a .onion address for their repositories, debian and devuan for example. As I understand Tor, those services offer an anonymized end to end encrypted connection to those repositories. I therefore would like to use suche a connection for each of my server in order to make updates even more secure, especially since some apt-keys in debian use cyphers which aren't that secure anymore nowadays.

Therefore, aside from a few other things, I added a domain override to my DNS server for .onion domains, but it didn't work. Other TLDs work just fine, but I need that specific TLD in this case. I checked with tcpdump and dig if the DNS queries are sent from pfSense to the DNS Server, and it was only the case with TLD domain overrieds and TLDs other than .onion. This worked once with pfSense 2.2.x, and I think this behavior was introduced with pfSense 2.3. I suspect that this may have been in order to prevent DNS Leaking in case of .onion domains, which have been assigned as special use domain by iana. There is also rfc7686 which seams to be consistent with what pfSense does.

How can I let pfSense resolve .onion domains anyway?

[johnpoz]

yes unbound has defaults for onion and will just return

;; QUESTION SECTION:
;test.domain.onion.            IN      A

;; AUTHORITY SECTION:
onion.                  10800  IN      SOA    localhost. nobody.invalid. 1 3600 1200 604800 10800

You can override this with the statement
local-zone: "onion." nodefault

In your advanced custom box in the resolver.
Most likely you will need the
server:
Statement first if you don't already have it.  Then you can create your override for onion. in your domain override section.. So I did not want to spend the time to fire up an authoritative server for onion tld, etc.  But I did validate that unbound will then forward this query to where you say to query.. So I pointed that override to another IP on my network 192.168.9.40, he is not going to answer any dnsquery but you can see from a packet capture unbound sent the query there..

[Daniel Abrecht]

Thanks. It works like a charm.