DNS suddenly broken [on some VLANs]

DaveP 0

I went reading their blurb about DNS servers and found this sentence

NordVPN offers private DNS in its apps, which ensures tighter security and privacy for your traffic. The NordVPN native applications automatically use NordVPN's DNS servers when connected to VPN. This prevents DNS leaks during your VPN connection, ensuring that your NordVPN private DNS requests are safe.

Maybe what they mean by 'The NordVPN native applications automatically use NordVPN's DNS servers when connected to VPN' is 'We intercept your DNS queries and securely process them via our servers when you are connected via our VPN'. That could be why the automagically send them through normally.

So they are intercepting them and turning off forwarding in PfSense and making it request the root severs can't give an IP as it doesn't know the full domain you have requested just the first character for the root server so it is screwed and returns nothing of use. In which case you would think that their support staff would advise that this is unlikely to get fixed and they see it as a feature. In which case I need to change VPN provider if i want that functionality. OR I reroute DNS queries so they don't go into the VPN tunnel but go directly out via my ISP where accessing the root servers works.

So lets see what Nord say. I've a while before I am due to renew my Nord subscription but I have stopped auto renew in the system.

johnpoz

@DaveP-0 unless you were using qname minimization, and had strict set it should fall back.. If your not doing that the roots do get asked for the fqdn your asking for, but they just respond with the NS for the TLD..

With qname min it would only send them the .tld, but without stict it will fall back to fqdn, etc..

so you would send .com to roots, for example and then domain.com to the qtld servers root handed you, and then only when talking to NS for the domain.tld would you send the fqdn like www.domain.tld

I have this set, but not strict - because that is known to break some major players that have crazy daisy chained names setup, etc.

but more likely that dnssec is just failing if they are intercepting.. You could try turning that off and stil resolving - and try turning off query name min settings if you have those set in unbound advanced settings.

But I don't want any service intercepting anything of mine!! If you want to provide some so call "private" dns for me to use great - I will set my stuff to use those if I want to.. But don't go calling dns interception something your doing to help me!! Cuz you know that is not the reason your doing it!!! Your app, sure ok - but if I just create a connection with my own device via a openvpn settings - you better not be intercepting my dns traffic..

DaveP 0

@johnpoz Sorry I only speak English. No speaky networky things. Just joking but only a little bit.

I'm not a networking person but I have a technical background where networking is the weakest bit. I know enough to set things up but not enough to really debug more than the basic things. I didn't sacrifice enough small furry animals to dark gods when I was learning networking. Plus it was easier back then with coaxial cable and 10-Base-T connections for business use and I had a dial up modem.

I have turned off dnssec because it was recommended to remove something that is known to create issues. query name min settings was turned off in my setup already.

The system worked fine without forward and performing its own lookups with DNSSEC on and query minimum name settings off until a few weeks ago. Of course because I play with things I always assume its something I have done and I'd just installed PfBlockerNG which is a DNS filter so I didn't have to think hard about whose fault it was. I then take everything back to basics to only find it was still going wrong. What a pain that was.

I also don't want people monitoring or intercepting me which is why I set this complex system up in the first place. It is frustrating that this is going on with the provider i use for a security product.

johnpoz

@DaveP-0 said in DNS suddenly broken [on some VLANs]:

provider i use for a security product.

Not sure where you got the idea that vpn services were a security product? They sell you the idea that we won't sell your info to someone else.. Do you really believe that????? really???

I never understood the logic in hey my isp knows where I go, so let me hide that from that that from them and give it to someone else and also pay them money to hide it from the first guy??

But hey if you want to pay company X to connect you to the internet, but then hey they might know where I go, so lets pay company Y to hide that info, because you know company Y is way more trust worthy, and I pay them 3 bucks a month to slow down my internet and and hide where I go from company X.

And then let me complain when this service that is only out for my best interest isn't...
.

Gertjan

@johnpoz

Not (only) hiding or security.
It's also the darker part that never gets mentioned during the in-video youtube adds : the local ISP can be checked upon by government, in France and most Europe countries they do, and when you download and share that "Disney" movie, you will get a warning, then a letter against signature, and then they will cancel your connection.
VPNs are less subjected to this as you chose their end-point, your new WAN, outside of your country.

Another related example : I've a captive portal I'm using to offer a 'internet connection' to my hotel clients.
I don't know what they are doing with their connection, and I don't want to know.
But I can, in case of a doubt, route that interface over to a VPN to, for example, a VPN in Paris (I'm based in France). Just so that my quest do not pollute my ISP WAN IP, which is a quasi static IP. Not that I'm mailing from this IP, or that I host something at this IP.
The main subscriber of the ISP stays responsible for the connection. The (my) ISP contract says clearly : do not share your connection with people that you do not trust.

DaveP 0

@johnpoz I understand your viewpoint but for me it is as @Gertjan says. It is a single layer, and the only one I can get, that stops the stasi from just contacting my ISP and taking my information. If Nord do collect and pass the stats on then I'm no worse off that I was without them. the DNS part is because I don't fully trust anyone and want to make sure I'm getting to where I'm supposed to. Having all my eggs in a different basket isn't what I want either.

Gertjan

@DaveP-0 said in DNS suddenly broken [on some VLANs]:

and want to make sure I'm getting to where I'm supposed to

That's DNSSEC. Works out of the box for those who resolve - do not forward.

DaveP 0

Got a reply from Nord.

Thank you for your reply.

It seems we are experiencing some issues with custom DNS addresses, our developers are aware of the issue and are working to resolve it.

We would rather not give you an estimation when we do not actually have one for certain.

Telling you that it will take 5 days and if in reality, it ends up taking 2 months - would be bad for both sides involved.

We understand that waiting is rather frustrating, and we can only apologize in the name of the company.

In the meantime, let us know if you have any other issues or questions.

Which doesn't actually say anything really. I'll not hear anything more I suspect but I'll let you know if I do or it changes.

Gertjan

@DaveP-0 said in DNS suddenly broken [on some VLANs]:

It seems we are experiencing some issues with custom DNS addresses ...

I'm reading - and understand this :

On the VPN server side, like user authentication etc, all is fine.
Their DNS are fine also.
They've added something between those two, like a policy routing, or a DNS redirect "NAT" firewall rule.

Maybe this is futuristic new their way to "protect" their clients - and this part will be soon shown on their advertisement video's "We protect your DNS requests without any setup issues" - and on the other side, they collect all your DNS so they ...... and know I will be polite, as I can't be sure, but your DNS data is worth $$$ so everything comes nicely together : the making more money show must go on.

I presume they are experimenting with some server nodes, just to check if they can pull it of.

And I get it. Its the same song again : I was working for them ?! Nice move, this is what I would do ^^

johnpoz

@DaveP-0 said in DNS suddenly broken [on some VLANs]:

NordVPN offers private DNS in its apps, which ensures tighter security and privacy for your traffic.

So seems like they aren't really doing that.. But just redirecting all the dns traffic to their own servers.. Vs the app say pointing to their server on 4.5.6.7.. Or even some rfc1918 IP on their network.

Why should such a thing take 5 day or 2 months to fix? Clearly you made a change that users noticed and breaks stuff, roll the change back and back to the drawing board.. Should take all of 2 hours at most to fix ;)

They are like hey only a small % of our users are complaining.. Screw them is how I read this response..

Or how about hey here is a new feature, click the use our dns checkbox.. If you don't want to use ours, uncheck it and we won't mess with your dns.. Shouldn't all of this been worked about before they rolled it out?

DaveP 0

That was my thoughts. I can't imagine any issue like this taking weeks never mind months to fix either. So I came to the same conclusion.

I would have thought it was an easy setting to make as well. Chose our DNS servers, use your own or build your own using the root servers.

Everyone is looking for ways to increase their income. It would be stupid of them to sell this data as it would have a big knock on effect.

DaveP 0

I wrote the following to Nord. Lets see how it goes.

I don't understand how this issue has taken as long as it has never mind a further 2 months never mind 5 days more. Networking may be a black art but it follows very simple rules. Can you clarify what the issue you are working on is.

From my understanding the issue I am having can only be caused by Nord intercepting my DNS queries as you say on your website. 'NordVPN native applications automatically use NordVPN's DNS servers when connected to VPN.' I read this as you intercept my DNS and direct it to your DNS servers. Can you confirm if this is true or not.

This makes me concerned that Nord are collecting this data as it is valuable to marketing people. Can you confirm that you are not collecting any DNS data.

I look forward to hearing from you.

johnpoz

@DaveP-0 if they say they are not intercepting, ask them why when you query 1.2.3.4 through their network you get an answer.. When 1.2.3.4 doesn't answer dns..

Do a simple test dig @1.2.3.4 www.google.com if you get an answer you were intercepted. Now it could be your own interception? Or redirection if you will.. But from the other thread(s) about this pretty sure someone did that test and got an answer, which is a smoking gun that dns was redirect somewhere, and if your not doing it and your routing your traffic through a vpn.. This screams they are doing it, unless the ISP of their exit IPs are doing it??

DaveP 0

@johnpoz Thanks for that. I'll use that if they deny it. I'll keep everyone informed.

Gertjan

@johnpoz said in DNS suddenly broken [on some VLANs]:

if they say they are not intercepting, ask them why when you query 1.2.3.4 through their network you get an answer.. When 1.2.3.4 doesn't answer dns..

Do a simple test dig @1.2.3.4 www.google.com if you get an answer you were intercepted. Now it could be your own interception? Or redirection if you will..

@DaveP-0

While doing the dig @1.2.3.4, join a full packet capture on the VPN client interface, the one connected to Nord ?
This should dhow the DNS to 1.2.3.4 going out, and info coming back that 'someone' is answering ...

DaveP 0

Just got this reply ignoring all but one of my questions. I'll be replying to this one.

Thank you for your reply.

NordVPN strictly keeps no logs of your activity online.

That means we do not track the time or duration of the online session, and neither do we keep logs of IP addresses or servers used, websites visited or files downloaded.

In other words, none of your private data is logged or saved at any time.

Unfortunately, we are still experiencing some issues with custom DNS addresses, our developers are aware of the issue and are working to resolve it.

We would rather not give you an estimation when we do not actually have one for certain.

Let us know if you have any further questions in the mean time.

Please note that our support is available 24/7, you can always contact us via email or chat here!

Do not hesitate to drop us a message in case of any inquiries!

DaveP 0

As per their last sentence I dropped them this.

Thank you for your response. I understood that Nord were not selling any data so it is good that you have confirmed that and I understand you do not want to give an eta on fixes.

I did note that you had not responded to my other questions so let me ask them slightly differently.

1 - Is Nord redirecting my DNS queries to the root servers and stopping me from performing my own root DNS searches?

2 - What exactly is issue with custom DNS addresses that you are taking so long to resolve?

DaveP 0

I wrote to them again

I was expecting the security response for the issue so I'll let that go to save time.

You didn't answer all my questions though. I also asked if Nord is intercepting my DNS queries. All the tests I have done point to that
happening.

Can you confirm if Nord intercepts my DNS queries or not.

They have just responded with;

Thank you for your reply.

To clarify, when you connect to the VPN server, our DNS are automatically assigned.

Feel free to contact us if there is anything else we can assist you with!

We offer customer support twenty-four hours a day, seven days a week.

The ticket will be re-opened automatically if you reply to this email.

Which is the best I'm going to get although it didn't answer the question. So they have an issue that they won't tell us about for security reasons. They kind of say they are assigning my DNS. They also say there is an issue with DNS and I can't do anything about it and have no idea when they will fix it. If they ever do.

So next question. I have PfSense set up to automagically send everything through Nord as per their configuration guide for PfSense.

How can I send my DNS queries through to my ISP instead who does allow me to use the root servers for resolving queries. I have no idea where to start. According to my system all items on port 53 are forwarded through the VPN.

TheNarc

@DaveP-0 Just go to Services > DNS Resolver and set the outgoing network interface(s) for unbound to only your WAN, and tick the Strict Outgoing Network Interface Binding check box:

A shame that they're punting on a real explanation, but also rather expected as you say. Although it is somewhat curious that they seem to acknowledge that there is as issue as opposed to just saying everything's working as it should. It will be interesting to see whether there are any further developments. I plan to periodically attempt to turn off forwarding mode and check whether it starts working again at some point. I'll be sure to report back here if it does.

johnpoz

@DaveP-0 said in DNS suddenly broken [on some VLANs]:

To clarify, when you connect to the VPN server, our DNS are automatically assigned.

Nope that is not what they are doing - they are intercepting.. And the big brains running that outfit didn't think it through that interception is easy to spot and will break shit like dnssec, which is one of the things dnssec is suppose to do, validate your talking to the actual authoritative ns.. Which when your intercepting clearly your not..

Using their "app" ok assign your dns away.. But if I am routing traffic through your vpn - you shouldn't freaking touch it..

Why anyone sends their traffic through these money grabbing scare mongers is beyond me.. The whole VPN service scam that blew up over night is just horse shit all the way down.. They don't give too shits about your privacy or your security.. All they are after is a drop dead simple way to get people to send them money for doing nothing..

The only value they provide is the ability to circumvent geo IP restrictions.. And most of the services are starting to block the big boys.. So that money tree is going away..