I need HELP on DNS RESOLVER!
-
@johnpoz Synology is NAS brand my nas is checking something randomly. Wrong time wrong place ?
-
So your asking Roots - and NOT getting any answers... I looked up the first 2 there those are root servers... So where are you answers??
Ask roots for that A record you should get back the NS for .net
C:\>dig @a.root-servers.net cs71.wac.edgecastcdn.net ; <<>> DiG 9.12.2-P1 <<>> @a.root-servers.net cs71.wac.edgecastcdn.net ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32949 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 27 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;cs71.wac.edgecastcdn.net. IN A ;; AUTHORITY SECTION: net. 172800 IN NS e.gtld-servers.net. net. 172800 IN NS f.gtld-servers.net. net. 172800 IN NS m.gtld-servers.net. net. 172800 IN NS i.gtld-servers.net. net. 172800 IN NS j.gtld-servers.net. net. 172800 IN NS b.gtld-servers.net. net. 172800 IN NS a.gtld-servers.net. net. 172800 IN NS c.gtld-servers.net. net. 172800 IN NS k.gtld-servers.net. net. 172800 IN NS h.gtld-servers.net. net. 172800 IN NS l.gtld-servers.net. net. 172800 IN NS g.gtld-servers.net. net. 172800 IN NS d.gtld-servers.net. ;; ADDITIONAL SECTION: e.gtld-servers.net. 172800 IN A 192.12.94.30 e.gtld-servers.net. 172800 IN AAAA 2001:502:1ca1::30 f.gtld-servers.net. 172800 IN A 192.35.51.30 f.gtld-servers.net. 172800 IN AAAA 2001:503:d414::30 m.gtld-servers.net. 172800 IN A 192.55.83.30 m.gtld-servers.net. 172800 IN AAAA 2001:501:b1f9::30 i.gtld-servers.net. 172800 IN A 192.43.172.30 i.gtld-servers.net. 172800 IN AAAA 2001:503:39c1::30 j.gtld-servers.net. 172800 IN A 192.48.79.30 j.gtld-servers.net. 172800 IN AAAA 2001:502:7094::30 b.gtld-servers.net. 172800 IN A 192.33.14.30 b.gtld-servers.net. 172800 IN AAAA 2001:503:231d::2:30 a.gtld-servers.net. 172800 IN A 192.5.6.30 a.gtld-servers.net. 172800 IN AAAA 2001:503:a83e::2:30 c.gtld-servers.net. 172800 IN A 192.26.92.30 c.gtld-servers.net. 172800 IN AAAA 2001:503:83eb::30 k.gtld-servers.net. 172800 IN A 192.52.178.30 k.gtld-servers.net. 172800 IN AAAA 2001:503:d2d::30 h.gtld-servers.net. 172800 IN A 192.54.112.30 h.gtld-servers.net. 172800 IN AAAA 2001:502:8cc::30 l.gtld-servers.net. 172800 IN A 192.41.162.30 l.gtld-servers.net. 172800 IN AAAA 2001:500:d937::30 g.gtld-servers.net. 172800 IN A 192.42.93.30 g.gtld-servers.net. 172800 IN AAAA 2001:503:eea3::30 d.gtld-servers.net. 172800 IN A 192.31.80.30 d.gtld-servers.net. 172800 IN AAAA 2001:500:856e::30 ;; Query time: 31 msec ;; SERVER: 198.41.0.4#53(198.41.0.4) ;; WHEN: Fri Sep 14 15:20:00 Central Daylight Time 2018 ;; MSG SIZE rcvd: 846Your just asking and asking and asking and not getting back anything... Why? That will explain why you can not resolve for sure.
-
@johnpoz I did packet capture again. And these are results. 0_1536956837326_packetcapture (3).zip
I execute ""dig @a.root-servers.net cs71.wac.edgecastcdn.net"" this command on pfsense cmndprmpt
edit:which program using for looking cap files ?(ok I installed wireshark)
-
Sorry i went for beers wont be able to view til get home did u get anwser?
-
@johnpoz No problem mate. Thanks for all of these responses. Take "Efe's" if avalible.
-
So same thing dude your asking
But you get NO response?? Something upstream of you filtering dns? There should be no reason that I can think of why if you ask a root server your not getting a response. You can see other queries there where you ask root and get answers..
This is what should look like - you ask, and get answer of all the NS for .net
-
@johnpoz I dont know why. Im on my home know There isnt any linux with me now. In my house Im using diffrent ISP. How can I check response on windows devices ?
64.53.public is a dns fake root ? Am I understand right.
-
198.41.0.4 is root - I just edit in wireshark what my public IP resolves too ;) Not a fan of posting my public IP on forums - especially when I have ticked off a few people here that might do something with that info - hehehe
You can install dig on your windows machine.. Just download bind from iSC and say install tools only... I run dig on windows all the time..
-
@johnpoz said in I need HELP on DNS RESOLVER!:
I run dig on windows all the time..
I should have known this one human life before. Nuking nslookup from orbit right now.
Thanks. -
hehhe - nslookup is a joke of a tool compared to dig..
edit: BTW - newer versions you might have to set resolv.conf pointing to your nameserver in the etc folder it creates if don't want to have to use @ namserver in the cmdline all the time... Unless they fixed that? I think starting with 9.12 it was failing to pull NS from the OS..
let me check
yeah - if you don't have a resolv.conf file in the etc folder dig 9.12.2-p1 atleast does not pull NS its suppose to use..
So create a resolv.conf and put in
namserver ipaddressThat you want to use with dig so you don't have to always call it out.
-
@johnpoz I dont understand how to install that any tutorial ?
-
Run the install - pick tools only..
The only issues is if you don't want to have to tell dig which NS to use every time you run it - then you need to create a resolv.conf file in the etc folder it creates when you install it..
Put in nameserver you want it to use.. then when you run dig it will default to using that ns..
-
@johnpoz hehe. Damn TTNET they are modifying our dnses.
Yeah the first dig command with TTNET nameserver(Office ISP)
Second one is taken with KABLONET nameservers(Home ISP)And both of tested from home In KABLONET I cannot resolve hostname with TTNET dnses. But I can resolve it with default KABLONET dnses.
I dont know how to capture packets without pfsense. If you know tell me pls. I can send capture from house network too. Maybe it can help.
And other question. HOW WE CAN PASTHROUGH THIS BLOCKING ? -
@emirefek said in I need HELP on DNS RESOLVER!:
HOW WE CAN PASTHROUGH THIS BLOCKING ?
Try this : https://www.netgate.com/blog/dns-over-tls-with-pfsense.html
-
@gertjan Cloudflare DNS is blocked in my country. Is DNSoverTLS forcing to use quad9 servers. Dosent work with roots?
-
forwarding is not resolving... The only way to get past a block without forwarding is vpn.. So you can talk to whoever you want via the vpn connection.
-
@johnpoz yeah VPN connection is nice choise but can we fix that without it? I can solve domains with other dns servers. With other dns servers I can reach sites. But My ISP modifying roots. I think DNSoverTLS is good choice for this. I dont know how its working clearly but. Can ISP replicate DSN TLS's too?
edit: I dont want vpn becuse we are using too much goverment websites in office and we need that. In turkey no one sells vpn its pointless(our goverment blocking everything)
edit: oh sorry now I understand your post. I will try to use it. Can I use pfblocker with forwarding?
-
you don't need to send your traffic down the vpn.. If you want to just be able to resolve then fire up a vps somwhere, create vpn tunnel to it and run your dns through that connection.
Or just run resolve on it - and then run tls forwarding to that.. That vps is under your control and resolving - so forwarding to that inside a tls tunnel is pretty much just like running your own resolver.
You can fire a vps pretty much anywhere on the planet that is not behind some gov restrictions.. I run multiple vps all over the glob as low as $15 USD for a year.. You just need something low end to do dns for you..
-
@johnpoz ohh thanks mate I cannot think that nice idea. Any ideas for integrating vpn to pfsense dns resolver? Tutorial or etc.
-
You would just pick your vpn interface as the outgoing interface in the resolver...
But would be easier to just run the resolver on the box, set it up for tls - and then forward via tls..
So here I have a vpn always running to one of my vps - so when I do a dns leak test you can see it shows my public IP becuase its directly resolving from there.. Then I change unbound to only use my vpn interface to my vps - and it shows the vps IP
