• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

DNS Resolver Infrastructure Cache Stats

Scheduled Pinned Locked Moved DHCP and DNS
33 Posts 4 Posters 1.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • A
    Antibiotic @Gertjan
    last edited by Antibiotic Nov 19, 2024, 5:43 PM Nov 19, 2024, 5:39 PM

    @Gertjan said in DNS Resolver Infrastructure Cache Stats:

    You could still resolve, but then you need to VPN out all your traffic.
    Or only VPN out your DNS requests (dono if that can be done, I 'think' you could) ?

    Yes, I tried but without success, could you please get 2 firewalls examples. how to make this. For first option and for me I think preferable second option. VPN out your DNS requests , this is my dream to make,

    pfSense plus 24.11 on Topton mini PC
    CPU: Intel N100
    NIC: Intel i-226v 4 pcs
    RAM : 16 GB DDR5
    Disk: 128 GB NVMe
    Brgds, Archi

    G 1 Reply Last reply Nov 19, 2024, 5:57 PM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator @Antibiotic
      last edited by johnpoz Nov 19, 2024, 5:46 PM Nov 19, 2024, 5:43 PM

      @Antibiotic how would your isp stop you from going to site xyz if you were running your dns also through the vpn. Unless of course your vpn was also filtering your dns like nord.

      It is unlikely your isp is filtering dns in that they prevent looking up xyz, but what they could be doing is hijacking and redirecting your dns which can break resolving.

      I mean if an isp doesn't want their user base going to xyz site, its pretty lame attempt at stopping the users to just break dns, and not actually block the traffic to that sites IPs as well.

      If I found out my isp was doing anything weird with my dns first thing I would be doing would be looking for a new isp. Which is not always possible sure. Next best option prob find vpn service that doesn't mess with dns either..But would prob just spin up a vpn on a vms somewhere - you can run a vps for a couple of bucks a month. I have one that is like 20 a year I can route traffic through, be more than capable of running a dns resolver for me.

      I have little desire to send my dns to these dns providers - they are not providing dns out of the goodness of their hearts, there is profit in it for them, in one form or another or they wouldn't be doing it.

      A simple smoking gun test to see if your isp or vpn is hijacking dns is simple directed dig to 1.2.3.4 for something.. If you get an answer then your dns is being redirected, either you are doing it yourself on pfsense or its happening up stream. But 1.2.3.4 does not answer dns, so if you got an answer its a smoking gun that you have been redirected.

      dig @1.2.3.4 www.google.com

      That should just time out, if you get a response your dns has been hijacked/redirected that is a fact jack ;)

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      A 2 Replies Last reply Nov 19, 2024, 5:48 PM Reply Quote 0
      • A
        Antibiotic @johnpoz
        last edited by Nov 19, 2024, 5:48 PM

        @johnpoz said in DNS Resolver Infrastructure Cache Stats:

        how would your isp stop you from going to site xyz if you were running your dns also through the vpn. Unless of course your vpn was also filtering your dns like nord.

        It is unlikely your isp is filtering dns in that they prevent looking up xyz, but what they could be doing is hijacking and redirecting your dns which can break resolving.

        I mean if an isp doesn't want their user base going to xyz site, its pretty lame attempt at stopping the users to just break dns, and not actually block the traffic to that sites IPs as well.

        Sorry, I'm not expert in this. Try to explain, when set Unbound to resolver mode and using VPN , LAN rule here:
        Screenshot_19-11-2024_194743_192.168.20.1.jpeg

        I cannot get some sites.

        pfSense plus 24.11 on Topton mini PC
        CPU: Intel N100
        NIC: Intel i-226v 4 pcs
        RAM : 16 GB DDR5
        Disk: 128 GB NVMe
        Brgds, Archi

        J 1 Reply Last reply Nov 19, 2024, 5:54 PM Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @Antibiotic
          last edited by Nov 19, 2024, 5:54 PM

          @Antibiotic where in those rules do you have pfsense dns route through your vpn? That routes your clients traffic over a vpn via policy route. What your client asks for something.domain.tld of pfsense resolver.. Does your resolver query route out the vpn? If not then no it would just be out your isp.

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          A 1 Reply Last reply Nov 19, 2024, 5:56 PM Reply Quote 0
          • A
            Antibiotic @johnpoz
            last edited by Antibiotic Nov 19, 2024, 5:58 PM Nov 19, 2024, 5:56 PM

            @johnpoz said in DNS Resolver Infrastructure Cache Stats:

            Does your resolver query route out the vpn?

            Could you please give a firewall rule example for this? If yes, regarding my settings where better to arrange this rule, I mean by rules order on this interface?

            pfSense plus 24.11 on Topton mini PC
            CPU: Intel N100
            NIC: Intel i-226v 4 pcs
            RAM : 16 GB DDR5
            Disk: 128 GB NVMe
            Brgds, Archi

            J 1 Reply Last reply Nov 19, 2024, 5:57 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @Antibiotic
              last edited by Nov 19, 2024, 5:57 PM

              @Antibiotic wouldn't be a firewall rule, it would be a setting in your resolver on what outbound interface to use. Or it would be the default route in pfsense to send all traffic out the vpn.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              A 1 Reply Last reply Nov 19, 2024, 6:05 PM Reply Quote 0
              • G
                Gertjan @Antibiotic
                last edited by Nov 19, 2024, 5:57 PM

                @Antibiotic said in DNS Resolver Infrastructure Cache Stats:

                could you please get 2 firewalls examples. how to make this. For first option and for me I think preferable second option.

                Long story short : I can't.
                I use a (just one now) pfSense, and that's the one used by the company I work for.
                Experimenting with that setup, and my boss knows that it is me messing around (again), and I already lost all my "who broke the Internet to credit points" for this year.

                If I have DNS issues with my ISP, I terminate the contract with them.

                I prefer by far keeping my pfSense setup as simple (for me) as possible. And we all know it, we use pfSense, so it won't be simple, that why we use pfSense.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                A 2 Replies Last reply Nov 19, 2024, 6:09 PM Reply Quote 0
                • A
                  Antibiotic @johnpoz
                  last edited by Antibiotic Nov 19, 2024, 6:07 PM Nov 19, 2024, 6:05 PM

                  @johnpoz said in DNS Resolver Infrastructure Cache Stats:

                  it would be a setting in your resolver on what outbound interface

                  Actually, I tried to do like you tell now. But anyway, cannot get some sites.
                  Screenshot_19-11-2024_20524_192.168.20.1.jpeg
                  Screenshot_19-11-2024_2051_192.168.20.1.jpeg

                  Could be make restart?

                  pfSense plus 24.11 on Topton mini PC
                  CPU: Intel N100
                  NIC: Intel i-226v 4 pcs
                  RAM : 16 GB DDR5
                  Disk: 128 GB NVMe
                  Brgds, Archi

                  J 1 Reply Last reply Nov 19, 2024, 6:09 PM Reply Quote 0
                  • A
                    Antibiotic @Gertjan
                    last edited by Nov 19, 2024, 6:09 PM

                    @Gertjan said in DNS Resolver Infrastructure Cache Stats:

                    Long story short : I can't.
                    I use a (just one now) pfSense, and that's the one used by the company I work for.
                    Experimenting with that setup, and my boss knows that it is me messing around (again), and I already lost all my "who broke the Internet to credit points" for this year

                    No problem, buddy, anyaway thank you

                    pfSense plus 24.11 on Topton mini PC
                    CPU: Intel N100
                    NIC: Intel i-226v 4 pcs
                    RAM : 16 GB DDR5
                    Disk: 128 GB NVMe
                    Brgds, Archi

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator @Antibiotic
                      last edited by johnpoz Nov 19, 2024, 6:11 PM Nov 19, 2024, 6:09 PM

                      @Antibiotic not sure how that is suppose to work at all, unless your redirecting dns.. you have unbound only listening on localhost.. which is 127.0.0.1, how would your clients actually ask pfsense for anything for dns..

                      unless you have it listening on interfaces your now showing?

                      mine.jpg

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      A 1 Reply Last reply Nov 19, 2024, 6:14 PM Reply Quote 0
                      • A
                        Antibiotic @Gertjan
                        last edited by Nov 19, 2024, 6:10 PM

                        @Gertjan said in DNS Resolver Infrastructure Cache Stats:

                        If I have DNS issues with my ISP, I terminate the contract with them.

                        Than I have to go out of Europe))) Where freedom exist in internet)))But where exist?)))

                        pfSense plus 24.11 on Topton mini PC
                        CPU: Intel N100
                        NIC: Intel i-226v 4 pcs
                        RAM : 16 GB DDR5
                        Disk: 128 GB NVMe
                        Brgds, Archi

                        1 Reply Last reply Reply Quote 0
                        • A
                          Antibiotic @johnpoz
                          last edited by Nov 19, 2024, 6:14 PM

                          @johnpoz said in DNS Resolver Infrastructure Cache Stats:

                          you have unbound only listening on localhost

                          No , its listening on pfSense interfaces as well:

                          Screenshot_19-11-2024_201227_192.168.20.1.jpeg

                          pfSense plus 24.11 on Topton mini PC
                          CPU: Intel N100
                          NIC: Intel i-226v 4 pcs
                          RAM : 16 GB DDR5
                          Disk: 128 GB NVMe
                          Brgds, Archi

                          1 Reply Last reply Reply Quote 0
                          • A
                            Antibiotic @johnpoz
                            last edited by Nov 19, 2024, 6:33 PM

                            @johnpoz said in DNS Resolver Infrastructure Cache Stats:

                            But would prob just spin up a vpn on a vms somewhere - you can run a vps for a couple of bucks a month. I have one that is like 20 a year I can route traffic through, be more than capable of running a dns resolver for me.

                            What is VPS, so cheap do you use?

                            pfSense plus 24.11 on Topton mini PC
                            CPU: Intel N100
                            NIC: Intel i-226v 4 pcs
                            RAM : 16 GB DDR5
                            Disk: 128 GB NVMe
                            Brgds, Archi

                            J 1 Reply Last reply Nov 21, 2024, 11:33 AM Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator @Antibiotic
                              last edited by johnpoz Nov 21, 2024, 11:55 AM Nov 21, 2024, 11:33 AM

                              @Antibiotic A vps (virtual private server) is just an instance you run on the internet somewhere.

                              Its just a vm, so a full OS that you can really pretty much do anything you want on, just like some vm or server you would setup locally but its hosted somewhere on the internet.

                              If your looking for a lowcost vps, check out https://lowendbox.com they have all sorts of links to deals.

                              I show one on there currently at racknerd for like $10 a year.

                              10.jpg

                              check out for a few different $1 a month deals

                              https://lowendbox.com/blog/1-vps-1-usd-vps-per-month/

                              I use to have bunch of different ones in different locations, west cost, east cost, Chicago, EU (NL) - but I trimmed back and currently only one I have active is with https://buyvm.net/ which is 2$ a month currently.. Price has gone up over the years ;) I do have another server currently in NL.. But its not really a lowend box, and is more like $10 month vs a year.

                              The one I have currently still have, I first got back in 2016, it was $15 a year then. Now its 24.. not really bad price increases, since over the years they have increased what you got for the money.. I might have to spin up one of these 10 a year guys to just kick the ties on it. Might switch over and save myself $15 a year ;) hehehe

                              If I needed one in a specific location for something I was testing, the great things about these is you can have them spun up and active normally in a few minutes.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              A 2 Replies Last reply Nov 21, 2024, 2:36 PM Reply Quote 0
                              • A
                                Antibiotic @johnpoz
                                last edited by Antibiotic Nov 21, 2024, 2:44 PM Nov 21, 2024, 2:36 PM

                                @johnpoz said in DNS Resolver Infrastructure Cache Stats:

                                Its just a vm, so a full OS that you can really pretty much do anything you want on, just like some vm or server you would setup locally but its hosted somewhere on the internet.

                                But in case of planning to use this VPS as private DNS server and VPN for my home net. Is it important to choose server as close to my real location or this not so important regarding my purposes. Second, this VPS have a more less easy setup of DNS server and VPN. I mean these procedures well instructed usually? or have some auto scripts to do on VPS side?

                                pfSense plus 24.11 on Topton mini PC
                                CPU: Intel N100
                                NIC: Intel i-226v 4 pcs
                                RAM : 16 GB DDR5
                                Disk: 128 GB NVMe
                                Brgds, Archi

                                1 Reply Last reply Reply Quote 0
                                • A
                                  Antibiotic @johnpoz
                                  last edited by Nov 21, 2024, 2:41 PM

                                  @johnpoz said in DNS Resolver Infrastructure Cache Stats:

                                  If your looking for a lowcost vps, check out https://lowendbox.com they have all sorts of links to deals.

                                  Also, if planning use as DNS server and VPN server, how much need RAM and CPU to be not overpay and do not have slow connections?

                                  pfSense plus 24.11 on Topton mini PC
                                  CPU: Intel N100
                                  NIC: Intel i-226v 4 pcs
                                  RAM : 16 GB DDR5
                                  Disk: 128 GB NVMe
                                  Brgds, Archi

                                  J 1 Reply Last reply Nov 21, 2024, 7:28 PM Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator @Antibiotic
                                    last edited by Nov 21, 2024, 7:28 PM

                                    @Antibiotic dns would require pretty much nothing.. you could run that on a pi zero.. vpn on the other hand would depend on how fast of connection want/have and how much traffic your actually going to push through it.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      tinfoilmatt @johnpoz
                                      last edited by Nov 21, 2024, 11:59 PM

                                      @johnpoz said in DNS Resolver Infrastructure Cache Stats:

                                      Now that you can resolve yourself - I just don't get why everyone doesn't just resolve, you couldn't get me to go back to forwarding ever..

                                      Simple: because the root name servers don't accept encyrpted queries. If you're resolving, every query leaving your LAN does so via sniffable cleartext to at least your ISP and whoever/whatever else they allow, knowingly or unknowingly, to sniff their LAN.

                                      ISPs are massive corporate overlords—even more so in so-called 'developed countries' (e.g. AT&T, Charter, Comcast, Cox Communications, Frontier, Time Warner, Verizon, etc.) than lesser developed ones—and I'm not convinced they aren't all in bed with one another when it comes to sharing private customer data.

                                      @Gertjan said in DNS Resolver Infrastructure Cache Stats:

                                      You could still resolve, but then you need to VPN out all your traffic.

                                      My opinion from a privacy perspective is that this would be the only acceptable alternative to DoT. (In fact, if you were really paranoid, you could encapsulate DoT queries within the tunnel to keep them hidden from even your VPN provider.)

                                      J A 2 Replies Last reply Nov 22, 2024, 12:22 AM Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator @tinfoilmatt
                                        last edited by johnpoz Nov 22, 2024, 12:26 AM Nov 22, 2024, 12:22 AM

                                        @tinfoilmatt said in DNS Resolver Infrastructure Cache Stats:

                                        ISPs are massive corporate overlords

                                        but google and cloudflare - they don't do anything with your data at all?

                                        You do understand sending your dns over dot, doesn't stop the isp from knowing where your going - they are the ones handling the traffic and that https has the fqdn in the clear right in the sni.. So until ech is a an actual thing.. hiding your "dns" from your isp isn't doing much of anything, and now your just handing over all that info to google or cloudflare, etc.. on silver platter.. But hey you do you, if it helps you sleep at night..

                                        If your goal is to hide where you go from your isp, then use a vpn, and then resolve through the vpn.. Now your isp doesn't know anything other than your moving traffic back and forth between your vpn, and your not handing all your data over to dns guys either.

                                        If you don't want your vpn to know, run your own via a vps, etc.

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        T 2 Replies Last reply Nov 22, 2024, 1:24 AM Reply Quote 0
                                        • T
                                          tinfoilmatt @johnpoz
                                          last edited by Nov 22, 2024, 1:24 AM

                                          @johnpoz said in DNS Resolver Infrastructure Cache Stats:

                                          but google and cloudflare - they don't do anything with your data at all?

                                          John, you're not seriously comparing what a company like Cloudflare has done and is still doing for a free and open Internet where user privacy is reasonably maximally respected—with telecom and mass media conglomerates, are you?

                                          And what about Quad9? They answer DoT queries...

                                          You do understand sending your dns over dot, doesn't stop the isp from knowing where your going - they are the ones handling the traffic and that https has the fqdn in the clear right in the sni.. So until ech is a an actual thing.. hiding your "dns" from your isp isn't doing much of anything, and now your just handing over all that info to google or cloudflare, etc.. on silver platter.. But hey you do you, if it helps you sleep at night..

                                          You're right. And ECH will only reach wide-scale adoption through the work of people and organizations who value user privacy over commercial interests (or, for those that don't, have their hand forced by those who do). That's exactly why it's a "thing" at all.

                                          I respect anybody who's at least trying to find better sleep at night over someone who's thrown their hands up.

                                          If you don't want your vpn to know, run your own via a vps, etc.

                                          Thought about that after I posted. Added to the 'maybe' section of the never-ending project list. Encapsulated DoT would still avoid the VPS cost altogether.

                                          1 Reply Last reply Reply Quote 0
                                          31 out of 33
                                          • First post
                                            31/33
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received