Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox

    Scheduled Pinned Locked Moved
    DHCP and DNS
    19
    85
    34.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator @johnpoz
      last edited by

      @johnpoz said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

      I have a pm out of @BBcan177 asking if he plans on easy way of blocking these in pfblocker, if not will be working my own listing of them to use in firewall rules and host overrides to block queries for them.

      Some more details here for now until I add this officially to pfBlockerNG:

      https://www.reddit.com/r/pfBlockerNG/comments/d3p1gf/doh_server_blocklist/

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by johnpoz

        Thanks - but you the have the
        use-application-dns.net

        In there - that would not return an NX, so it wouldn't work per my understanding of how the firefox canary is suppose to work.. It has to get back a NX to not enable it from my understanding.

        I threw this together real quick this morning from list linked to earlier.

        local-data: "dns.adguard.com. 120 IN A 172.19.19.19"
local-data: "dns-family.adguard.com. 120 IN A 172.19.19.19"
local-data: "dns.google. 120 IN A 172.19.19.19"
local-data: "cloudflare-dns.com. 120 IN A 172.19.19.19"
local-data: "dns.quad9.net. 120 IN A 172.19.19.19"
local-data: "dns9.quad9.net. 120 IN A 172.19.19.19"
local-data: "dns10.quad9.net. 120 IN A 172.19.19.19"
local-data: "doh.opendns.com. 120 IN A 172.19.19.19"
local-data: "doh.cleanbrowsing.org. 120 IN A 172.19.19.19"
local-data: "dns.nextdns.io. 120 IN A 172.19.19.19"
local-data: "dns.dnsoverhttps.net. 120 IN A 172.19.19.19"
local-data: "doh.crypto.sx. 120 IN A 172.19.19.19"
local-data: "doh.powerdns.org. 120 IN A 172.19.19.19"
local-data: "doh-ch.blahdns.com. 120 IN A 172.19.19.19"
local-data: "doh-jp.blahdns.com. 120 IN A 172.19.19.19"
local-data: "doh-de.blahdns.com. 120 IN A 172.19.19.19"
local-data: "dns.dns-over-https.com. 120 IN A 172.19.19.19"
local-data: "doh.securedns.eu. 120 IN A 172.19.19.19"
local-data: "dns.rubyfish.cn. 120 IN A 172.19.19.19"
local-data: "doh-2.seby.io. 120 IN A 172.19.19.19"
local-data: "doh.seby.ie. 120 IN A 172.19.19.19"
local-data: "commons.host. 120 IN A 172.19.19.19"
local-data: "doh.dnswarden.com. 120 IN A 172.19.19.19"
local-data: "dns-nyc.aaflalo.me. 120 IN A 172.19.19.19"
local-data: "dns.aaflalo.me. 120 IN A 172.19.19.19"
local-data: "doh.appliedprivary.net. 120 IN A 172.19.19.19"
local-data: "doh.captnemo.in. 120 IN A 172.19.19.19"
local-data: "doh.tiar.app. 120 IN A 172.19.19.19"
local-data: "doh.dns.sb. 120 IN A 172.19.19.19"
local-data: "rdns.faelix.net. 120 IN A 172.19.19.19"
local-data: "doh.li. 120 IN A 172.19.19.19"
local-data: "doh.armadillodns.net. 120 IN A 172.19.19.19"
local-data: "doh.netweaver.uk. 120 IN A 172.19.19.19"
local-data: "jp.tiar.app. 120 IN A 172.19.19.19"
local-data: "doh.42l.fr. 120 IN A 172.19.19.19"

        Here is sample query for one of those.

        ;; QUESTION SECTION:
;doh.dns.sb.                    IN      A

;; ANSWER SECTION:
doh.dns.sb.             120     IN      A       172.19.19.19

        Simple add that to your custom box in unbound, then put a block log rule in place that logs anything that tries to go to my out of thin air IP that I do not use locally 172.19.19.19

        This way I can see if anything is trying to resolve this by just looking if any hits in the firewall rules, and then look into the logs to which IP tried and investigate what its trying to do exactly.

        Keep in mind, this could cause you some grief if any of those fqdn are serving up stuff other than doh that you might want to get to.. Some are on other ports other then 443, so I just made the block rule any..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.03 | Lab VMs 2.7.2, 24.03

        1 Reply Last reply Reply Quote 0
        • kiokomanK
          kiokoman LAYER 8
          last edited by

          bind9

          $TTL 60
@            IN    SOA  localhost. root.localhost.  (
                      2019091601
                      3H  ; refresh
                      1H  ; retry
                      1W  ; expiry
                      1H) ; minimum
              IN    NS    localhost.

; Make TRR unavailable
dns.adguard.com 120 IN CNAME  .
dns-family.adguard.com 120 IN CNAME  .
dns.google 120 IN CNAME  .
cloudflare-dns.com 120 IN CNAME  .
dns.quad9.net 120 IN CNAME  .
dns9.quad9.net 120 IN CNAME  .
dns10.quad9.net 120 IN CNAME  .
doh.opendns.com 120 IN CNAME  .
doh.cleanbrowsing.org 120 IN CNAME  .
dns.nextdns.io 120 IN CNAME  .
dns.dnsoverhttps.net 120 IN CNAME  .
doh.crypto.sx 120 IN CNAME  .
doh.powerdns.org 120 IN CNAME  .
doh-ch.blahdns.com 120 IN CNAME  .
doh-jp.blahdns.com 120 IN CNAME  .
doh-de.blahdns.com 120 IN CNAME  .
dns.dns-over-https.com 120 IN CNAME  .
doh.securedns.eu 120 IN CNAME  .
dns.rubyfish.cn 120 IN CNAME  .
doh-2.seby.io 120 IN CNAME  .
doh.seby.ie 120 IN CNAME  .
commons.host 120 IN CNAME  .
doh.dnswarden.com 120 IN CNAME  .
dns-nyc.aaflalo.me 120 IN CNAME  .
dns.aaflalo.me 120 IN CNAME  .
doh.appliedprivary.net 120 IN CNAME  .
doh.captnemo.in 120 IN CNAME  .
doh.tiar.app 120 IN CNAME  .
doh.dns.sb 120 IN CNAME  .
rdns.faelix.net 120 IN CNAME  .
doh.li 120 IN CNAME  .
doh.armadillodns.net 120 IN CNAME  .
doh.netweaver.uk 120 IN CNAME  .
jp.tiar.app 120 IN CNAME  .
doh.42l.fr 120 IN CNAME  .

          i can change the dot to some "out of thin air ip" if i want to log, reporting NX for the moment

          laboratorio@server:/$ dig @127.0.0.1 doh.crypto.sx

; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> @127.0.0.1 doh.crypto.sx
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 10547
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: dda6e2c23949f6cda855e6485d7fa7fddeb8459af20d8f8b (good)
;; QUESTION SECTION:
;doh.crypto.sx.                 IN      A

;; ADDITIONAL SECTION:
overrides.              60      IN      SOA     localhost. root.localhost. 2019091601 10800 3600 604800 3600

;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Mon Sep 16 17:19:25 CEST 2019
;; MSG SIZE  rcvd: 129

          ̿' ̿'\̵͇̿̿\з=(◕_◕)=ε/̵͇̿̿/'̿'̿ ̿
          Please do not use chat/PM to ask for help
          we must focus on silencing this @guest character. we must make up lies and alter the copyrights !
          Don't forget to Upvote with the 👍 button for any post you find to be helpful.

          1 Reply Last reply Reply Quote 1
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by johnpoz

            Only reason pointed it to an IP, is I normally don't log dns queries - there are so freaking many of them it can be information overload to weed through... I only enable dns query logs when wanting to troubleshoot a specific issue.

            Figured if I point it to a specific IP, I can log any attempted access to that odd IP so can see at a glance in the firewall interface if any hits to it. And then investigate..

            Multiple ways to skin the cat is best, so no matter what what users are using specific in there setups they have a easy way to skin this one..

            These little devices could bypass these method with a direct query to the IP.. So prob need to put together an alias that lists the actual public IPs and blocks.. This is going to turn into such a shit show..

            Uncontrolled circumvention of a local networks controls is not by any stretch of the imagination good for anyone!

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.03 | Lab VMs 2.7.2, 24.03

            1 Reply Last reply Reply Quote 0
            • JeGrJ
              JeGr LAYER 8 Moderator
              last edited by

              Was just shown this by colleague: https://bsd.network/interact/102767562311572315
              Had to laugh ;)

              Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

              If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

              1 Reply Last reply Reply Quote 4
              • R
                Repo
                last edited by

                This resolver now points to https://mozilla.cloudflare-dns.com/dns-query instead of https://cloudflare-dns.com/dns-query

                1 Reply Last reply Reply Quote 0
                • JeGrJ
                  JeGr LAYER 8 Moderator
                  last edited by

                  @JeGr said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

                  canary

                  But the canary stayed the same, so that should already disable it.

                  Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                  If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                  1 Reply Last reply Reply Quote 0
                  • NollipfSenseN
                    NollipfSense
                    last edited by

                    I have been reading this thread and have added the list found in the link that BBcan177 provided above to DNSBL. However, where is the about:config mentioned by Jim so I can set network.trr.mode to 5? This is what I saw in Firefox preference:
                    Screen Shot 2019-10-06 at 1.05.22 PM.png

                    pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                    pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      in the about:config section

                      aboutconfig.png

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                      NollipfSenseN 1 Reply Last reply Reply Quote 1
                      • NollipfSenseN
                        NollipfSense @johnpoz
                        last edited by

                        @johnpoz Thanks John for responding...it seems that Macs don't have that options...I am using Firefox 69.0.2...

                        Screen Shot 2019-10-06 at 2.33.59 PM.png

                        pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                        pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by johnpoz

                          I don't have a mac to test with.. But your at about:preferences not about:config?

                          No you wouldn't find it there - see I went there in my windows firefox

                          firefoxpref.png

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                          NollipfSenseN 1 Reply Last reply Reply Quote 0
                          • NollipfSenseN
                            NollipfSense @johnpoz
                            last edited by

                            @johnpoz Found it John...one has to type about:config in the URL bar and accept the risk...thank you!

                            Screen Shot 2019-10-06 at 3.01.32 PM.png

                            pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                            pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                            1 Reply Last reply Reply Quote 0
                            • H
                              HuskerDu
                              last edited by HuskerDu

                              I've just tried the unbound custom option... it seems Firefox keeps asking for its DoH stuff, Suricata seeing some associated traffic.

                              1	TCP	A Network Trojan was Detected	10.X.X.X 51133	104.16.249.249 443	1:2027695 ET POLICY Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)
                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                Did you set TRR in firefox to 5? Without some details of what you actually did there is little anyone can do to help you find out what you did wrong.

                                You need to make sure unbound return NX..

                                nx.jpg

                                I watch this like a hawk and have rules in place to log any sort of doh to any of the know ns doing doh, and block tos - and have not seen any hits on the rules at all.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                                1 Reply Last reply Reply Quote 0
                                • H
                                  HuskerDu
                                  last edited by

                                  The purpose was to test the usage that Firefox makes of its canary domain and if it obey their published rules.

                                  First of all, the status is NOERROR not NXDOMAIN

                                  ; <<>> DiG 9.10.6 <<>> use-application-dns.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 27411
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;use-application-dns.net.	IN	A

;; ANSWER SECTION:
use-application-dns.net. 60	IN	A	10.10.10.1

;; Query time: 45 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Tue Nov 26 21:31:02 CET 2019
;; MSG SIZE  rcvd: 68

                                  TRR was 2 as it was the intend of that quick test.

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Well that is not how canary is meant to work - so yeah it would fail... It needs to return NX..

                                    https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet

                                    You returned no error and A record... So yeah its going to be able to use doh.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      HuskerDu
                                      last edited by HuskerDu

                                      I've changed

                                      local-zone: "use-application-dns.net" static

                                      to

                                      local-zone: "use-application-dns.net" always_nxdomain

                                      And it now works

                                      ; <<>> DiG 9.10.6 <<>> use-application-dns.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 58414
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;use-application-dns.net.	IN	A

;; Query time: 37 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Wed Dec 04 20:16:56 CET 2019
;; MSG SIZE  rcvd: 52

                                      Well kind of, Suricata keeps logging the same alert (ET POLICY Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI))

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by

                                        @HuskerDu said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

                                        cloudflare-dns .com in TLS SNI)

                                        Who says that is firefox? That could be some malware/trojan you have on your network.

                                        I see zero hits to 1.1.1.1 or 1.0.0.1, so firefox wouldn't doing it.. Unless your client not using pfsense for dns, and not seeing the nx for the canary..

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                                        1 Reply Last reply Reply Quote 0
                                        • H
                                          HuskerDu
                                          last edited by HuskerDu

                                          This only happens when I launch Firefox from the machine which generates an alert in Suricata. No worms/trojans and co, it only happens when :

                                          • Firefox is set to use DNS over HTTPS
                                          • Firefox is launched

                                          My firewall rules only allow DNS to pFsense (including NATing 8.8.8.8:53 towards the firewall for Android devices.... whatever you are telling them, they keep checking "Internet connectivity" on that).

                                          Interestingly, it is not hitting 1.1.1.1 but 104.16.249.249. Maybe the anycast IP is used for marketing purposes but not always used in real life traffic ?

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            @HuskerDu said in HEADS UP: Be aware of Trusted Recursive Resolver (TRR) in Firefox:

                                            104.16.249.249

                                            https://community.cloudflare.com/t/dns-over-https-using-https-104-16-249-249-dns-query

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post