Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    DNS over TLS with CloudFlare not working for LAN hosts

    DHCP and DNS
    18
    27
    2484
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rdlugosz last edited by

      A few of us appear to be having a similar issue and started a thread here with some error logs: https://forum.pfsense.org/index.php?topic=146207.0

      I'm guessing we're all experiencing the same problem.

      1 Reply Last reply Reply Quote 0
      • ivor
        ivor last edited by

        We're seeing it as well. While we're investigating this issue, it seems to work with quad9 so I suggest you try it.

        1 Reply Last reply Reply Quote 0
        • wgstarks
          wgstarks last edited by

          @ivor:

          We're seeing it as well. While we're investigating this issue, it seems to work with quad9 so I suggest you try it.

          What changes need to be made to use quad9?

          1 Reply Last reply Reply Quote 0
          • ivor
            ivor last edited by

            We will be updating the blog post with that information, for now just replace the Cloudflare IP's with Quad9 ones (9.9.9.9 and 149.112.112.112).

            1 Reply Last reply Reply Quote 0
            • wgstarks
              wgstarks last edited by

              @ivor:

              We will be updating the blog post with that information, for now just replace the Cloudflare IP's with Quad9 ones (9.9.9.9 and 149.112.112.112).

              Thanks. That worked.

              I’ve seen similar reports on other forums regarding cloudflare’s primary server not working. Hopefully whatever the issue is will get resolved soon.

              1 Reply Last reply Reply Quote 0
              • NeoDude
                NeoDude last edited by

                Also had this issue with CloudFlare's DNS servers. Using Quad9 until someone can figure out what's going on.

                1 Reply Last reply Reply Quote 0
                • G
                  gsmornot last edited by

                  Not that its needed but, same here. First thing this morning no DNS service. Quick fix but strange, worked well all day yesterday.

                  Apr 4 09:28:42 unbound 15056:0 error: SSL_read syscall: Connection reset by peer

                  1 Reply Last reply Reply Quote 0
                  • ivor
                    ivor last edited by

                    We have updated the blog post with Quad9 settings https://www.netgate.com/blog/dns-over-tls-with-pfsense.html

                    1 Reply Last reply Reply Quote 0
                    • dem
                      dem last edited by

                      @ivor:

                      We will be updating the blog post with that information, for now just replace the Cloudflare IP's with Quad9 ones (9.9.9.9 and 149.112.112.112).

                      Ivor, I see you've updated the instructions in the blog post to be closer to what I suggested here. However I still don't think you need the server: line.

                      Also I suggest against recommending people mix and match DNS providers since that could result in inconsistent results as the various providers block different sets of phishing and malware sites.

                      Finally it might be easier to confirm DNS over TLS is working by filtering States by :853 and :53.

                      Thanks.

                      1 Reply Last reply Reply Quote 0
                      • jimp
                        jimp Rebel Alliance Developer Netgate last edited by

                        You need the "server:" line because you cannot guarantee that the unbound config will still be in the "server:" context by the time it adds in the custom options. Depending on whatever else the user has configured in the resolver it may be in another section and break.

                        1 Reply Last reply Reply Quote 0
                        • dem
                          dem last edited by

                          Good to know, thanks Jim.

                          1 Reply Last reply Reply Quote 0
                          • T
                            T5000 last edited by

                            Doesn't work well, for me anyway. I have DNSBL enabled and my options look like this:

                            server:include: /var/unbound/pfb_dnsbl.*conf
                            forward-zone:
                            name: "."
                            forward-ssl-upstream: yes
                            forward-addr: 1.1.1.1@853
                            forward-addr: 1.0.0.1@853
                            

                            many websites don't load at all or very slow (some are ok), iOS Appstore won't work either.

                            1 Reply Last reply Reply Quote 0
                            • jimp
                              jimp Rebel Alliance Developer Netgate last edited by

                              Cloudflare 's 1.1.1.1 server has been flaky for some people since it launched, try adding a line for 9.9.9.9 instead of 1.1.1.1

                              1 Reply Last reply Reply Quote 0
                              • R
                                Ralphys last edited by

                                @T5000:

                                Doesn't work well, for me anyway. I have DNSBL enabled and my options look like this:

                                server:include: /var/unbound/pfb_dnsbl.*conf
                                forward-zone:
                                name: "."
                                forward-ssl-upstream: yes
                                forward-addr: 1.1.1.1@853
                                forward-addr: 1.0.0.1@853
                                

                                many websites don't load at all or very slow (some are ok), iOS Appstore won't work either.

                                Cloudflare 1.1.1.1 and 1.0.0.1 is having issues with TLS atm. A Cloudflare team member mentioned that they will be releasing an update soon to correct it but there is no eta yet.

                                Try the following:

                                server:
                                include: /var/unbound/pfb_dnsbl.*conf
                                ssl-upstream: yes
                                do-tcp: yes
                                forward-zone:
                                name: "."
                                forward-addr: 9.9.9.9@853
                                

                                That's Quad9 for the moment… you can reverse back to Cloudflare DNS once the issue has been resolved.

                                1 Reply Last reply Reply Quote 0
                                • C
                                  CiscoX last edited by

                                  Hi,

                                  Strange, when i use forward-addr: 9.9.9.9@853 is working, but when I change to forward-addr: 1.1.1.1@853 or forward-addr: 1.0.0.1@853 i lose my Internet.

                                  Any idea?

                                  Thanks

                                  1 Reply Last reply Reply Quote 0
                                  • jimp
                                    jimp Rebel Alliance Developer Netgate last edited by

                                    Cloudflare has a problem with Unbound right now, they are not handling how it sends requests properly with tls. They say it's going to be fixed soon.

                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      gsmornot last edited by

                                      @jimp:

                                      Cloudflare has a problem with Unbound right now, they are not handling how it sends requests properly with tls. They say it's going to be fixed soon.

                                      Read on their Community this morning the update related to Unbound was released overnight. Testing here I still have an issue with 1.1.1.1 but 1.0.0.1 is fine. The issue covered here they created overnight a night ago with Unbound has been addressed though. No errors in my log. Now I just need to looking what is using 1.1.1.1 already.

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tnovy last edited by

                                        I think they have solved it - it started working for me.

                                        1 Reply Last reply Reply Quote 0
                                        • NeoDude
                                          NeoDude last edited by

                                          Yep, working for me now too.

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            renegade last edited by

                                            For me resolution does not work always.
                                            I use MultiWAN with failover and it seems that if one gateway is down, resolution hangs.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post

                                            Products

                                            • Platform Overview
                                            • TNSR
                                            • pfSense
                                            • Appliances

                                            Services

                                            • Training
                                            • Professional Services

                                            Support

                                            • Subscription Plans
                                            • Contact Support
                                            • Product Lifecycle
                                            • Documentation

                                            News

                                            • Media Coverage
                                            • Press
                                            • Events

                                            Resources

                                            • Blog
                                            • FAQ
                                            • Find a Partner
                                            • Resource Library
                                            • Security Information

                                            Company

                                            • About Us
                                            • Careers
                                            • Partners
                                            • Contact Us
                                            • Legal
                                            Our Mission

                                            We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                                            Subscribe to our Newsletter

                                            Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                                            © 2021 Rubicon Communications, LLC | Privacy Policy