Potential DNS Rebind attack detected on my local network

[comet424]

i tried googling for help to search for a fix but couldnt find it

everytime i ping any of my local network servers and such it ping responses to my WAN ip address

so if server is
server1
it doesnt come back with 192.168.0.3 but a WAN ip and my dynmaic DNS web address

i have recently changed vpns from nord to PIA not sure if that does anything...

but how do i fix my local ips resolving localy again

[stephenw10]

Usually if you see that it's because you're trying to use the dyndns URL from the LAN side and it resolves to the WAN address:

https://docs.netgate.com/pfsense/en/latest/recipes/port-forwards-from-local-networks.html

[comet424]

@stephenw10
so i looked at that documents.. i have Method 1.. and still does it

i also have method 2 but i dont use it in host orride but custom options
and i had that there for a while.. but still points to the wan IP
and then i have like 100 devices sometimes i like to access by the local name and not remember the ip does that mean i gotta add all 100+ IOt devices name and ip in the custom? what caused this issue in the first place?

this is my custom i have a tardis server and a pump computer i also tried this
private-domain: "pump"

but here is the custom overrides

server:
local-zone: "windowsupdate.com" redirect
local-data: "windowsupdate.com 86400 IN A 192.168.0.32"

server:
local-zone: "microsoft.com.edgesuite.net" redirect
local-data: "microsoft.com.edgesuite.net 86400 IN A 192.168.0.32"

server:
local-zone: "update.microsoft.com" redirect
local-data: "update.microsoft.com 86400 IN A 192.168.0.32"

server:
local-zone: "do.dsp.mp.microsoft.com" redirect
local-data: "do.dsp.mp.microsoft.com 86400 IN A 192.168.0.32"

server:
local-zone: "dl.delivery.mp.microsoft.com" redirect
local-data: "dl.delivery.mp.microsoft.com 86400 IN A 192.168.0.32"

server:
local-zone: "cdn.blizzard.com" redirect
local-data: "cdn.blizzard.com 86400 IN A 192.168.0.32"

server:
local-zone: "pump" redirect
local-data: "pump 86400 IN A 192.168.0.10"

server:
private-domain: "tardis"
private-domain: "pump"
server:include: /var/unbound/pfb_dnsbl.*conf

i did try this button check box to disable rebind but that didnt help the problem still cant ping by names anymore

[stephenw10]

It's probably trying to resolve the full domain and you have entered only the hostname. The full domain still resolves to the dyndns name?

[comet424]

@stephenw10

well its only for home network so i not trying to do www.tardis.hell.com as an example

i just wanna in my local browser in my home type

http://tardis/
and just redirects me to 192.168.0.3

or on my cameras vlan if i wanna type a camera1 say it would goto 192.168.10.50 say

it used to work only thing ive changed is how i setup the PIA vpn from nord

so i tried tardis.<dynaddress> and it still gives me the wan ip not the local ip address

but i dont wanna have to type all the iot devices cameras and there ips in the custom yet its not working

[comet424]

so im not sure if the vpn can cause that or not

[johnpoz]

@comet424 said in Potential DNS Rebind attack detected on my local network:

http://tardis/
and just redirects me to 192.168.0.3

that is not any sort of valid config.. that is not fqdn, how would dns resolve that? Now your client could add a search suffix to that, but that is on the client to do.

example

$ ping nas

Pinging nas.home.arpa [192.168.9.10] with 32 bytes of data:
Reply from 192.168.9.10: bytes=32 time=1ms TTL=64

See how it comes back nas.home.arpa, that is because when the dns query was done, my client auto added the domain.

$ ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : i9-win
   Primary Dns Suffix  . . . . . . . : home.arpa
   Node Type . . . . . . . . . . . . : Broadcast
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : home.arpa

If you notice with a simple nslookup

If your getting back some wan IP in your query that goes to the internet, then your client is most likely adding some public domain in the query.

If your client asks unbound on pfsense for www.tardis.hell.com and you want that to redirect some local IP, you would need a override.. But just going to tardis, what is it actually asking for via the FQDN?

[comet424]

@johnpoz
so like when i orginally setup pfsense it worked out of the box

http://tardis pfsense redirects to 192.168.0.3 unraid server
http://pump:8123 pfsense would redirect to 192.168.0.10 home asstant server
if i pinged tardis
id get tardis 192.168.0.3
no tardis.hell.com

same with the cameras all i type in the address bar
camera1/
camera2/ and pfsense rediects it to 192.168.10.50 say
least thats how it used to work

so i ran your nslookup set debug
i changed the actual ip but left it startting as 69. and i changed my dyns to hell.com

C:\Users\mike>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Windows11-Gaming-Desktop
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : hell.com

Ethernet adapter 10Gig Nic:

   Connection-specific DNS Suffix  . : hell.com
   Description . . . . . . . . . . . : Intel(R) 82599 10 Gigabit Network Connection
   Physical Address. . . . . . . . . : 98-B7-85-1F-A0-B1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a570:4985:f868:8d21%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.151(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Friday, November 15, 2024 5:54:28 PM
   Lease Expires . . . . . . . . . . : Friday, November 22, 2024 12:17:08 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 714651525
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2D-34-A3-5E-C8-7F-54-55-89-B8
   DNS Servers . . . . . . . . . . . : 192.168.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Users\mike>nslookup
Default Server:  pfSense.hell.com
Address:  192.168.0.1

> tardis
Server:  pfSense.hell.com
Address:  192.168.0.1

Non-authoritative answer:
Name:    hell.com
Address:  69.x.x.x
Aliases:  tardis.hell.com

> set debug
> tardis
Server:  pfSense.hell.com
Address:  192.168.0.1

------------
Got answer:
    HEADER:
        opcode = QUERY, id = 4, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 2,  authority records = 0,  additional = 0

    QUESTIONS:
        tardis.hell.com, type = A, class = IN
    ANSWERS:
    ->  tardis.hell.com
        canonical name = hell.com
        ttl = 49 (49 secs)
    ->  hell.com
        internet address = 69.x.x.x
        ttl = 49 (49 secs)

------------
Non-authoritative answer:
------------
Got answer:
    HEADER:
        opcode = QUERY, id = 5, rcode = NOERROR
        header flags:  response, want recursion, recursion avail.
        questions = 1,  answers = 1,  authority records = 1,  additional = 0

    QUESTIONS:
        tardis.hell.com, type = AAAA, class = IN
    ANSWERS:
    ->  tardis.hell.com
        canonical name = hell.com
        ttl = 49 (49 secs)
    AUTHORITY RECORDS:
    ->  mine.nu
        ttl = 1789 (29 mins 49 secs)
        primary name server = ns1.dyndns.org
        responsible mail addr = hostmaster.dyndns.org
        serial  = 2525007979
        refresh = 900 (15 mins)
        retry   = 300 (5 mins)
        expire  = 604800 (7 days)
        default TTL = 1800 (30 mins)

------------
Name:    hell.com
Address:  69.x.x.x
Aliases:  tardis.hell.com

as for FQDN? i have no idea just simple home user

[comet424]

here is my lan rules and my dns resolver

[comet424]

and here is my nat rules

if that helps at all

[comet424]

there was a couple ways people setup PIA VPN so reason i have wan and pia toronto ::1/128 and all those whatever they all mean
and another video didnt

so i not sure if that has anything to do with it etc

[johnpoz]

@comet424 not sure where your getting your dns from, but hell.com does not return a 69.x here

hell.com.               3600    IN      A       15.
hell.com.               3600    IN      A       3.

And tardis.hell.com doesn't even resolve on the public internet.. So not sure where your getting 69.x from? and a 69.x would not be a rebind anyway. A rebind is when unbound forwards to anywhere or resolves itself, ie its not a local resource that gets sent in the answer and that answer contains rfc1918 address space. If 69.x is returned that would not be a rebind.

[stephenw10]

You can see the windows client has hell.com set as the search suffix. That means when you try to resolve 'tardis' it actually queries for tardis.hell.com to make a valid fqdn.

If you add host overrides to Unbound via the GUI you have to set the domain so they would be valid but in your custom Unbound conf settings you have omitted the domain so it doesn't match.

[comet424]

@johnpoz i mentioned that i changed my actual dynns name to hell.com and i changed my actaual WAN IP to 69.x.x.x replacing the actual numbers with x

as was easier to do Find and Replace then screen shot and black out the actual dns name
as i learned your supposed to block it out thats why i mentioned i actually changed it... guess i should said i changed it for display purpose only my bad for miss representing

@stephenw10
1
so why does windows get the hell.com (display purpose only) in the serach suffix

would the original pfsense setup be search suffix "workgroup" or
how would i remove the search suffix wouldnt that solve the problem bring it back to default thats how it always worked?

2
so if i do the unbound thats the dns resolver.. the custom and would you type it then

server:
local-zone: "pump.hell.com" redirect
local-data: "pump.hell.com 86400 IN A 192.168.0.10"

and when do you use
server:
private-domain: "tardis"
private-domain: "pump"

so do you have to type it
server:
private-domain: "tardis.hell.com"
private-domain: "pump.hell.com"

but this woulld get to be a long list.. if everytime you add a new device to the home network you gotta add it to the custom override. and if the ip address changes then it wont work...

the best route be removing the search suffix but how did it get in there in the first place... is there a check box in pfsense that set it... like the
DNS Server Override Allow DNS server list to be overridden by DHCP/PPP on WAN or remote OpenVPN server

would that solve it.. as i dont need my local computers with with .hell.com on the end of it just a home setup not a big company with servers

and if i can remove the search suffix will it bring it back to default how it worked originally that im used to?

[comet424]

under dhcp server i looked at lan
i blacked out the blank doman location

if i just put a spacebar to remove the default will that fix that
i just dont know how i caused it to have this problem a simple check box?
when i transitioned from NordVPN to PIA VPN?

[comet424]

ok i think i fixed it

i googled domain name of pfsense
i changed it back to "localdomain"
i guess when i did a new pfsense setup and it asked about domain name i used what i had in my dyndns updater...

its back to working i can ping
tardis
and go to
http://tardis

and it goes to 192.168.0.3
wish i was more smarter at this stuff

@johnpoz @stephenw10
i apperciate your both helps.. without your help i wouldnt have tried changing domain name to localdomain as it was frustrating with your help i figured it out i really appreciate it

[johnpoz]

@comet424 that really should have zero to do with it..

but now when you ping tardis, does it comeback tardis.localdomain? does it comeback without a domain? If so then dns was was not used. And your client used some other method to find tardis, be it mdns, or just a broadcast, etc.

Do you have registration of dhcp clients set in unbound? Are you using isc or kea dhcp server?

[comet424]

@johnpoz
when i ping it no i dont get localdomain i get

C:\Users\mike>ping tardis

Pinging tardis [192.168.0.3] with 32 bytes of data:
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64
Reply from 192.168.0.3: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.0.3:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Users\mike>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Windows11-Gaming-Desktop
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : localdomain

Ethernet adapter 10Gig Nic:

   Connection-specific DNS Suffix  . : localdomain
   Description . . . . . . . . . . . : Intel(R) 82599 10 Gigabit Network Connection
   Physical Address. . . . . . . . . : 98-B7-85-1F-A0-B1
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::a570:4985:f868:8d21%12(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.0.151(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Friday, November 22, 2024 11:16:38 AM
   Lease Expires . . . . . . . . . . : Friday, November 22, 2024 1:16:37 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DHCPv6 IAID . . . . . . . . . . . : 714651525
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2D-34-A3-5E-C8-7F-54-55-89-B8
   DNS Servers . . . . . . . . . . . : 192.168.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

C:\Users\mike>

the way it originally worked

im using kea dhcp as i learned pfsense said the other is depreciating
i dont know what isc unless thats the old dhcp and no dhcp clients in the custom override if thats what u mean by unbound

although i set in dhcp server lan i static set tardis to be 192.168.0.3

[comet424]

and if that solves my issue i was having and i use dyndns for my domain name
by changing domain to localdomain under general

just curiousity when do you use domain under general to be like the hell.com as display pupose example
is that for when you have a big company... or something as i always trying to learn stuff new everyday so curious when and when you dont use that

[johnpoz]

@comet424 not sure why anyone would use an actual public domain in pfsense. Unless you were using that internally - but that normally is idea that comes with many issues.

now if you owned hell.com and used hell.net internally where hell.net did not resolve on the public internet that would be one thing. But trying to leverage public domain externally and internally at the same time runs into problems. And is not really a suggested setup.

The 2 approved domains to use internally these days is home.arpa and .internal

I would suggest you use one of those..

Kea is not as yet at feature parity with isc (older dhcp server).. And it is missing features.. I would not suggest you use it currently unless you have the most basic requirements of a dhcp server. There are some good strides to bring it to parity with isc in the 24.11 release..

Since tardis did not come back fq in your ping - that really points to just windows finding it with some other method where dns isn't even involved.