cert error

[reynold]

Hello,
clients get certificate error pop up message
That's a really strange behaviour
It seems happen when user open pdf document on a public shared folder in file server

[johnpoz]

@reynold you would only get that cert when you were redirected to blocked page.. So what your trying to access is being redirected by pfblocker..

Or your trying to do something that resolves to public IP and the pfblocker block page is answering vs what your really wanting to access. If your server is local, you should access it via its local fqdn or IP..

Or you should setup nat reflection so that if you do hit public IP of pfsense, you get redirected to the local IP..

[reynold]

@johnpoz
The file server where documents are stored is also local DNS server.
I set up dns forward in my local dns server.
It forward queries to pfblocker (192.168.1.254 is local address of pfsense)
Maybe i did something wrong in dns forwarding?
()

[johnpoz]

@reynold if your clients are using that for dns, and your trying to access say server.somedomain.tld the it should resolve that to your local IP of this server.somedomain.tld, not some public IP or some other IP on pfsense or the pfblocker vip, etc.

The only way to be presented with that pfblocker cert - is where your trying to via some fqdn resolve to a IP on pfsense where pfblocker serves up that cert..

[reynold]

@johnpoz
Yes, my clients are using that server for primary DNS:
You say that i need to enter nslookup server.domain.local on clients?
And it has to give me back the static ip address of the server (in my case 192.168.1.2)?

[johnpoz]

@reynold said in cert error:

And it has to give me back the static ip address of the server (in my case 192.168.1.2)?

Ok if your trying to access via a "browser" make sure its not using doh, browser makers love to point the browser to their own dns vs using local..

But there is no way you could get that cert asking 192.168.1.2 if pfsense does not have the IP 192.168.1.2 on it.. So clearly your accessing an IP on pfsense for the pfblocker to be served to your client.

[reynold]

@johnpoz
I set up dns resolver on pfSense and i set up domain overrides.
192.168.1.2 is my local DNS server and file server
It should be ok but could it causes the issues?

[johnpoz]

@reynold well that could be problematic - since when you forward a returned IP being rfc1918 would be a rebind..

So with your client be it nslookup or dig or host, whatever your fav dns client is from cmd line. Do a query to pfsense IP, do you get back local resources that your DNS is resolving?

When you forward to some other NS, you prob want to allow for rebind from it, create a private-domain entry in your unbound config.

See here

https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html

But if was a rebind pfsense would not return an IP for some fqdn query, so how would you end up on pfsense IP? What is more likely is your browser is doing doh, and getting some public IP that is say pfsense wan, to how your getting the pfblocker dnsbl cert..

But you should actually validate that is working.. But if your running your own DNS, all your clients should really point directly to that IP for dns..