Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    pfSense, Unbound & Netflix = No go...

    DHCP and DNS
    5
    22
    504
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wardex last edited by

      After you switch to resolver mode I would check to see if there are any residual states that still point to 8.8.8.8 and delete them. The Netflix app does make direct connections to 8.8.8.8 with a very short TTL. Those states may still be active from before your config changes.

      F 1 Reply Last reply Reply Quote 0
      • S
        SteveITS Rebel Alliance @furom last edited by

        @furom If using forwarding disable DNSSEC. Per Quad9 it can cause false failures. I noticed no issues in multiple routers in 22.05 and earlier.
        https://support.quad9.net/hc/en-us/articles/4433380601229-Setup-pfSense-and-DNS-over-TLS

        Only install packages for your version, or risk breaking it. If yours is older, select it in System/Update/Update Settings.
        When upgrading, let it finish. Allow 10-15 minutes, or more depending on packages and device speed.
        Upvote ๐Ÿ‘ helpful posts!

        1 Reply Last reply Reply Quote 1
        • F
          furom @johnpoz last edited by furom

          @johnpoz said in pfSense, Unbound & Netflix = No go...:

          but don't your clients just point to pfsense for dns?

          They should, yes, good point. Thanks :) I guess a rule like this should do it, right?
          b33f91c1-9c4f-438d-ba9a-379bda3a7e22-image.png

          johnpoz 2 Replies Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator @furom last edited by johnpoz

            @furom yup that is valid rule to allow clients on one of your network to talk to that networks pfsense IP and use dns.

            Just need to make sure its in your rule list before something blocks or redirects it.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 23.01 | Lab VMs CE 2.6, 2.7

            F M 2 Replies Last reply Reply Quote 1
            • johnpoz
              johnpoz LAYER 8 Global Moderator @furom last edited by

              @furom now just because I don't have any issues with resolving all the stuff needed for netflix to work correctly, and I do quite a bit of dns filtering.. But nothing that I recall for netflix specific, but I do a lot of telemetry blocking of my rokus attempts..

              Might be good troubleshooting step to load netflix in your browser - do you have any issues with that working? With a browser you can normally get a listing of all the stuff trying to be loaded, like the developers tools in firefox..

              To see what exactly is not resolving, what is not loading, etc.

              you could enable more detailed logging of your dns queries and responses with

              server:
              log-queries: yes
              log-replies: yes
              

              In unbound custom options box - this might give you some insight to what is failing, and once you know that you can look to why.. Maybe your having a hard time talking to a specific network where some of the NS for a specific domain involved in some aspect of using netflix sit.. It is prob way more than just www.netflix.com ;)

              I know for sure that at least at some point in the past, not sure if currently happens.. But if you were using HE tunnel for your IPv6 netflix wouldn't work.. HE can be used as a way to circumvent geo location, so netflix had blocked it.. There was a few discussions of that around here, and ways stop unbound from returning any AAAA for the netflix required domains.

              While I use HE, the network my rokus sit that I use netflix on has no IPv6 enabled at all - so be it they got a AAAA for something doesn't matter since the clients don't have an IPv6 to try and talk to netflix via HE anyway.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 23.01 | Lab VMs CE 2.6, 2.7

              F 1 Reply Last reply Reply Quote 0
              • F
                furom @johnpoz last edited by

                @johnpoz said in pfSense, Unbound & Netflix = No go...:

                @furom yup that is valid rule to allow clients on one of your network to talk to that networks pfsense IP and use dns.

                Just need to make sure its in your rule list before something blocks or redirects it.

                Great. It works fine for most stuff I tried, but Netflix still won't like this... I get black icons for much content for some reason. I did reload filters, reset states and then restarted Netflix/player...

                1 Reply Last reply Reply Quote 0
                • F
                  furom @wardex last edited by

                  @wardex said in pfSense, Unbound & Netflix = No go...:

                  After you switch to resolver mode I would check to see if there are any residual states that still point to 8.8.8.8 and delete them. The Netflix app does make direct connections to 8.8.8.8 with a very short TTL. Those states may still be active from before your config changes.

                  Thanks! This is a good one, have started to do this more regularly now after a change. :)

                  1 Reply Last reply Reply Quote 0
                  • F
                    furom @johnpoz last edited by furom

                    @johnpoz said in pfSense, Unbound & Netflix = No go...:

                    Might be good troubleshooting step to load netflix in your browser

                    Just tried Netflix in firefox, and well, works flawlessly, but my player on another network still refuses partly, identical DNS rules, on top of all else so should behave the same... But the DNS-rule on netflix network creates no states...

                    F johnpoz 2 Replies Last reply Reply Quote 0
                    • F
                      furom @furom last edited by

                      @furom Found what made the difference... :(
                      My player does not like this to be on;
                      196f0be5-af1b-45be-8e06-a62e895b92f4-image.png
                      And yes, it says quite clear that it may break a lot, but worked fine with Quad9 so why suspect it...

                      So... Would this indicate something is not working or how should I interpret it?

                      johnpoz 1 Reply Last reply Reply Quote 0
                      • johnpoz
                        johnpoz LAYER 8 Global Moderator @furom last edited by

                        @furom said in pfSense, Unbound & Netflix = No go...:

                        But the DNS-rule on netflix network creates no states...

                        The one to pfsense IP? That would point to devices not using pfsense for dns.. Maybe they using doh?

                        Even if they are redirecting you should see a state..

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                        F 1 Reply Last reply Reply Quote 0
                        • F
                          furom @johnpoz last edited by

                          @johnpoz said in pfSense, Unbound & Netflix = No go...:

                          Even if they are redirecting you should see a state..

                          After unchecking the option above it works great again... :) Time fo celebrate with an episode of something I suppose. :)

                          Would be grand to know if this option should work with Unbound, or is it my player that has a problem with it? It does use the pfSense DNS btw, or at least states that it does...

                          1 Reply Last reply Reply Quote 0
                          • johnpoz
                            johnpoz LAYER 8 Global Moderator @furom last edited by

                            @furom said in pfSense, Unbound & Netflix = No go...:

                            And yes, it says quite clear that it may break a lot, but worked fine with Quad9 so why suspect it...

                            Why would you think that would work when you forward.. That is a resolver option.. Forwarding isn't going to use min name - how would that work?

                            If you are resolving - yeah strict is going to break quite a bit of shit that can tell you for sure..

                            I don't see how that could work if you were forwarding at all to be honest.. I have never tested what exactly would happen when forwarding.. Well because it would be pointless to try and do qname minimization if you were forwarding..

                            But I might see what unbound actually does with qname on and forwarding.. I don't see how that is a valid configuration to be honest.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                            F 2 Replies Last reply Reply Quote 1
                            • F
                              furom @johnpoz last edited by

                              @johnpoz said in pfSense, Unbound & Netflix = No go...:

                              Why would you think that would work when you forward.

                              I thought I used the Resolver? I only said I fell back on forwarding as I didn't get Unbound Resolving to work initially. Sorry if it was confusing. It has been a bit for for me, but finally works now

                              1 Reply Last reply Reply Quote 0
                              • F
                                furom @johnpoz last edited by

                                @johnpoz said in pfSense, Unbound & Netflix = No go...:

                                I don't see how that could work if you were forwarding at all to be honest..

                                I wouldn't be surprised if it just "tolerated" it then. I have once set it and then changed to forward-mode after that I suppose, it never complained :)

                                johnpoz 1 Reply Last reply Reply Quote 0
                                • johnpoz
                                  johnpoz LAYER 8 Global Moderator @furom last edited by

                                  @furom said in pfSense, Unbound & Netflix = No go...:

                                  have once set it and then changed to forward-mode after that I suppose

                                  yeah I would think it forwarder mode it would be ignored.. But moving back to resolver mode it would use it, but strict is going to fail on all kinds of stuff that is for sure.. There is blog about it on cloudflare I think.

                                  If I get a chance later today document what happens when you use when resolving, non strict and then see what it does if switch over to forwarder mode.. Does it send a shit ton of extra queries or just ignore it?

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                                  1 Reply Last reply Reply Quote 1
                                  • M
                                    MoonKnight @johnpoz last edited by

                                    @johnpoz
                                    Hi,

                                    I belive this is the right way to do DNS redirect?

                                    fe046166-84f2-4c3c-ac35-e6b0e71daf9d-image.png

                                    --- 23.01 ---
                                    Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                                    Kingston DDR4 2666MHz 16GB ECC
                                    2 x HyperX Fury SSD 120GB (ZFS-mirror)
                                    2 x Intel i210 (ports)
                                    4 x Intel i350 (ports)

                                    johnpoz 1 Reply Last reply Reply Quote 0
                                    • johnpoz
                                      johnpoz LAYER 8 Global Moderator @MoonKnight last edited by

                                      @moonknight sure - but what is the 853 for... Did you have your clients using dot to talk to unbound? I don't see any point to that on your local network that is for sure.

                                      And the redirect of dot isn't going to work.. Not with any client that actually validates who they are talking to for dot, because that is like one of the important aspects of dot or doh, validation of who your getting your dns from.

                                      Also clients don't really do dot they do doh, so no port 853.

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                                      M 1 Reply Last reply Reply Quote 1
                                      • M
                                        MoonKnight @johnpoz last edited by

                                        @johnpoz
                                        yeah you are right. I probably don't need the DoT (853) rule, since the unbound is handling DoT.

                                        389eb3da-73bf-48d1-ba86-5215244642b1-image.png

                                        I'm blocking DoH anyways from floating rule.

                                        982e0d94-c496-4502-840b-72db4f87f0b1-image.png

                                        Thanks, then i can remove the 853 rules from my local networks :)

                                        --- 23.01 ---
                                        Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                                        Kingston DDR4 2666MHz 16GB ECC
                                        2 x HyperX Fury SSD 120GB (ZFS-mirror)
                                        2 x Intel i210 (ports)
                                        4 x Intel i350 (ports)

                                        johnpoz 1 Reply Last reply Reply Quote 0
                                        • johnpoz
                                          johnpoz LAYER 8 Global Moderator @MoonKnight last edited by

                                          @moonknight said in pfSense, Unbound & Netflix = No go...:

                                          then i can remove the 853 rules from my local networks :)

                                          Sure - while sure you could setup some client on your network to use dot to talk to unbound.. I just don't see the point/value of such a setup.. I mean it is your network, who would be hostile on your network sniffing for your dns traffic? ;)

                                          Now if this unbound was out on the net somewhere, and you wanted to forward your local dns to it via dot then that could make sense.

                                          But redirection of dot would be designed to fail redirection. Because the dot client should validate the cert is for the fqdn or IP the client is setup to talk to.. So for example if suppose to be talking to quad9.dns.net or whatever your unbound sure would not be able to return a cert for that that the client trusted as you being quad9.dns.net..

                                          Now you could actually do that - but how do you know what your client might be wanting to talk to - you would have to be able to generate the correct cert on the fly, and then your client would also have to trust your CA you were signing the cert with, etc.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                                          M 1 Reply Last reply Reply Quote 1
                                          • M
                                            MoonKnight @johnpoz last edited by

                                            @johnpoz said in pfSense, Unbound & Netflix = No go...:

                                            @moonknight said in pfSense, Unbound & Netflix = No go...:

                                            then i can remove the 853 rules from my local networks :)

                                            Sure - while sure you could setup some client on your network to use dot to talk to unbound.. I just don't see the point/value of such a setup.. I mean it is your network, who would be hostile on your network sniffing for your dns traffic? ;)

                                            Well, maybe my wife or kids ๐Ÿ˜€

                                            Now if this unbound was out on the net somewhere, and you wanted to forward your local dns to it via dot then that could make sense.

                                            But redirection of dot would be designed to fail redirection. Because the dot client should validate the cert is for the fqdn or IP the client is setup to talk to.. So for example if suppose to be talking to quad9.dns.net or whatever your unbound sure would not be able to return a cert for that that the client trusted as you being quad9.dns.net..

                                            Now you could actually do that - but how do you know what your client might be wanting to talk to - you would have to be able to generate the correct cert on the fly, and then your client would also have to trust your CA you were signing the cert with, etc.

                                            I do use Quad9 DNS servers. I just like to have little bit more control of all the DNS traffics leaving my pfsense.
                                            There is so many devices that have hardcoded DNS, you know, smart thigs, SmartTV, browsers, cell phones etc. I don't see the point why they use hardcoded DNS or DNS over HTTPS... It's my fu...... network ๐Ÿ˜‚
                                            71a73a3e-e039-4073-999c-c075b35f9c6e-image.png

                                            Thanks again for your Informations @johnpoz ๐Ÿ‘ ๐Ÿ˜

                                            --- 23.01 ---
                                            Intel(R) Xeon(R) CPU D-1518 @ 2.20GHz
                                            Kingston DDR4 2666MHz 16GB ECC
                                            2 x HyperX Fury SSD 120GB (ZFS-mirror)
                                            2 x Intel i210 (ports)
                                            4 x Intel i350 (ports)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post