Quad9 and DNS Resolver
-
I have a WAN rule called - Easy Rule: Passed from Firewall log view - says it was created by Easy Rule .
Trying to figure out what it is -
Protocol: IPv4 TCP
Source: ISP IP addres
Destination: 104.25.242.31
Port: 80(HTTP)Destination IP is Carrier: cloudflare
Confused?
-
@cburbs said in Quad9 and DNS Resolver:
Easy Rule
Yes it is, :-).
did you add it this? with this? (https://docs.netgate.com/pfsense/en/latest/firewall/adding-rules-with-easyrule.html) -
It has a date from almost a year ago. Could have as I think that is when I was looking at snort but was having all sorts of issues so I disabled it all.
So I probably don't need that rule - I won't do anything with it now but remove it later today.
-
Do you use squidguard on your system? That was the next thing I was going to implement.
-
@cburbs said in Quad9 and DNS Resolver:
squidguard
I use HA proxy I think for my purposes more appropriate, Squid is problematic among MITM, so SquidGuard doesn't work for me either
But I strongly recommend installing Suricata/Snort and pfblockerNG-devel -
Delete the rule for said http 80 port because it is unnecessary!
I didn’t investigate all the way through, but it points to a Cloudflare CDN -
Yeah snort and pfblocker are on my list. I played with these a while back but it broke many things and haven't got back to them.
-
@cburbs said in Quad9 and DNS Resolver:
Yeah snort and pfblocker are on my list. I played with these a while back but it broke many things and haven't got back to them.
Before you jumping into these IPS / IDS, DNSBL, etc. things, I highly recommend Bill Meeks (alias: bmeeks) posts Snort / ÍSuricata and BBcan177 on the topic of pfblockerng
