Potential DNS Rebind attack detected on my local network
-
@comet424 said in Potential DNS Rebind attack detected on my local network:
http://tardis/
and just redirects me to 192.168.0.3that is not any sort of valid config.. that is not fqdn, how would dns resolve that? Now your client could add a search suffix to that, but that is on the client to do.
example
$ ping nas Pinging nas.home.arpa [192.168.9.10] with 32 bytes of data: Reply from 192.168.9.10: bytes=32 time=1ms TTL=64See how it comes back nas.home.arpa, that is because when the dns query was done, my client auto added the domain.
$ ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : i9-win Primary Dns Suffix . . . . . . . : home.arpa Node Type . . . . . . . . . . . . : Broadcast IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : home.arpaIf you notice with a simple nslookup
If your getting back some wan IP in your query that goes to the internet, then your client is most likely adding some public domain in the query.
If your client asks unbound on pfsense for www.tardis.hell.com and you want that to redirect some local IP, you would need a override.. But just going to tardis, what is it actually asking for via the FQDN?
-
@johnpoz
so like when i orginally setup pfsense it worked out of the boxhttp://tardis pfsense redirects to 192.168.0.3 unraid server
http://pump:8123 pfsense would redirect to 192.168.0.10 home asstant server
if i pinged tardis
id get tardis 192.168.0.3
no tardis.hell.comsame with the cameras all i type in the address bar
camera1/
camera2/ and pfsense rediects it to 192.168.10.50 say
least thats how it used to workso i ran your nslookup set debug
i changed the actual ip but left it startting as 69. and i changed my dyns to hell.comC:\Users\mike>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : Windows11-Gaming-Desktop Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : hell.com Ethernet adapter 10Gig Nic: Connection-specific DNS Suffix . : hell.com Description . . . . . . . . . . . : Intel(R) 82599 10 Gigabit Network Connection Physical Address. . . . . . . . . : 98-B7-85-1F-A0-B1 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::a570:4985:f868:8d21%12(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.0.151(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, November 15, 2024 5:54:28 PM Lease Expires . . . . . . . . . . : Friday, November 22, 2024 12:17:08 PM Default Gateway . . . . . . . . . : 192.168.0.1 DHCP Server . . . . . . . . . . . : 192.168.0.1 DHCPv6 IAID . . . . . . . . . . . : 714651525 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2D-34-A3-5E-C8-7F-54-55-89-B8 DNS Servers . . . . . . . . . . . : 192.168.0.1 NetBIOS over Tcpip. . . . . . . . : Enabled C:\Users\mike>nslookup Default Server: pfSense.hell.com Address: 192.168.0.1 > tardis Server: pfSense.hell.com Address: 192.168.0.1 Non-authoritative answer: Name: hell.com Address: 69.x.x.x Aliases: tardis.hell.com > set debug > tardis Server: pfSense.hell.com Address: 192.168.0.1 ------------ Got answer: HEADER: opcode = QUERY, id = 4, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 2, authority records = 0, additional = 0 QUESTIONS: tardis.hell.com, type = A, class = IN ANSWERS: -> tardis.hell.com canonical name = hell.com ttl = 49 (49 secs) -> hell.com internet address = 69.x.x.x ttl = 49 (49 secs) ------------ Non-authoritative answer: ------------ Got answer: HEADER: opcode = QUERY, id = 5, rcode = NOERROR header flags: response, want recursion, recursion avail. questions = 1, answers = 1, authority records = 1, additional = 0 QUESTIONS: tardis.hell.com, type = AAAA, class = IN ANSWERS: -> tardis.hell.com canonical name = hell.com ttl = 49 (49 secs) AUTHORITY RECORDS: -> mine.nu ttl = 1789 (29 mins 49 secs) primary name server = ns1.dyndns.org responsible mail addr = hostmaster.dyndns.org serial = 2525007979 refresh = 900 (15 mins) retry = 300 (5 mins) expire = 604800 (7 days) default TTL = 1800 (30 mins) ------------ Name: hell.com Address: 69.x.x.x Aliases: tardis.hell.comas for FQDN? i have no idea just simple home user
-
here is my lan rules and my dns resolver
-
and here is my nat rules
if that helps at all
-
there was a couple ways people setup PIA VPN so reason i have wan and pia toronto ::1/128 and all those whatever they all mean
and another video didntso i not sure if that has anything to do with it etc
-
@comet424 not sure where your getting your dns from, but hell.com does not return a 69.x here
hell.com. 3600 IN A 15. hell.com. 3600 IN A 3.And tardis.hell.com doesn't even resolve on the public internet.. So not sure where your getting 69.x from? and a 69.x would not be a rebind anyway. A rebind is when unbound forwards to anywhere or resolves itself, ie its not a local resource that gets sent in the answer and that answer contains rfc1918 address space. If 69.x is returned that would not be a rebind.
-
You can see the windows client has hell.com set as the search suffix. That means when you try to resolve 'tardis' it actually queries for tardis.hell.com to make a valid fqdn.
If you add host overrides to Unbound via the GUI you have to set the domain so they would be valid but in your custom Unbound conf settings you have omitted the domain so it doesn't match.
-
@johnpoz i mentioned that i changed my actual dynns name to hell.com and i changed my actaual WAN IP to 69.x.x.x replacing the actual numbers with x
as was easier to do Find and Replace then screen shot and black out the actual dns name
as i learned your supposed to block it out thats why i mentioned i actually changed it... guess i should said i changed it for display purpose only my bad for miss representing@stephenw10
1
so why does windows get the hell.com (display purpose only) in the serach suffixwould the original pfsense setup be search suffix "workgroup" or
how would i remove the search suffix wouldnt that solve the problem bring it back to default thats how it always worked?2
so if i do the unbound thats the dns resolver.. the custom and would you type it thenserver:
local-zone: "pump.hell.com" redirect
local-data: "pump.hell.com 86400 IN A 192.168.0.10"and when do you use
server:
private-domain: "tardis"
private-domain: "pump"so do you have to type it
server:
private-domain: "tardis.hell.com"
private-domain: "pump.hell.com"but this woulld get to be a long list.. if everytime you add a new device to the home network you gotta add it to the custom override. and if the ip address changes then it wont work...
the best route be removing the search suffix but how did it get in there in the first place... is there a check box in pfsense that set it... like the
DNS Server Override Allow DNS server list to be overridden by DHCP/PPP on WAN or remote OpenVPN serverwould that solve it.. as i dont need my local computers with with .hell.com on the end of it just a home setup not a big company with servers
and if i can remove the search suffix will it bring it back to default how it worked originally that im used to?
-
under dhcp server i looked at lan
i blacked out the blank doman locationif i just put a spacebar to remove the default will that fix that
i just dont know how i caused it to have this problem a simple check box?
when i transitioned from NordVPN to PIA VPN?
-
ok i think i fixed it
i googled domain name of pfsense
i changed it back to "localdomain"
i guess when i did a new pfsense setup and it asked about domain name i used what i had in my dyndns updater...its back to working i can ping
tardis
and go to
http://tardisand it goes to 192.168.0.3
wish i was more smarter at this stuff@johnpoz @stephenw10
i apperciate your both helps.. without your help i wouldnt have tried changing domain name to localdomain as it was frustrating with your help i figured it out i really appreciate it -
@comet424 that really should have zero to do with it..
but now when you ping tardis, does it comeback tardis.localdomain? does it comeback without a domain? If so then dns was was not used. And your client used some other method to find tardis, be it mdns, or just a broadcast, etc.
Do you have registration of dhcp clients set in unbound? Are you using isc or kea dhcp server?
-
@johnpoz
when i ping it no i dont get localdomain i getC:\Users\mike>ping tardis Pinging tardis [192.168.0.3] with 32 bytes of data: Reply from 192.168.0.3: bytes=32 time<1ms TTL=64 Reply from 192.168.0.3: bytes=32 time<1ms TTL=64 Reply from 192.168.0.3: bytes=32 time<1ms TTL=64 Reply from 192.168.0.3: bytes=32 time<1ms TTL=64 Ping statistics for 192.168.0.3: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0msC:\Users\mike>ipconfig /all Windows IP Configuration Host Name . . . . . . . . . . . . : Windows11-Gaming-Desktop Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No DNS Suffix Search List. . . . . . : localdomain Ethernet adapter 10Gig Nic: Connection-specific DNS Suffix . : localdomain Description . . . . . . . . . . . : Intel(R) 82599 10 Gigabit Network Connection Physical Address. . . . . . . . . : 98-B7-85-1F-A0-B1 DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes Link-local IPv6 Address . . . . . : fe80::a570:4985:f868:8d21%12(Preferred) IPv4 Address. . . . . . . . . . . : 192.168.0.151(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, November 22, 2024 11:16:38 AM Lease Expires . . . . . . . . . . : Friday, November 22, 2024 1:16:37 PM Default Gateway . . . . . . . . . : 192.168.0.1 DHCP Server . . . . . . . . . . . : 192.168.0.1 DHCPv6 IAID . . . . . . . . . . . : 714651525 DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-2D-34-A3-5E-C8-7F-54-55-89-B8 DNS Servers . . . . . . . . . . . : 192.168.0.1 NetBIOS over Tcpip. . . . . . . . : Enabled C:\Users\mike>the way it originally worked
im using kea dhcp as i learned pfsense said the other is depreciating
i dont know what isc unless thats the old dhcp and no dhcp clients in the custom override if thats what u mean by unboundalthough i set in dhcp server lan i static set tardis to be 192.168.0.3
-
and if that solves my issue i was having and i use dyndns for my domain name
by changing domain to localdomain under generaljust curiousity when do you use domain under general to be like the hell.com as display pupose example
is that for when you have a big company... or something as i always trying to learn stuff new everyday so curious when and when you dont use that -
@comet424 not sure why anyone would use an actual public domain in pfsense. Unless you were using that internally - but that normally is idea that comes with many issues.
now if you owned hell.com and used hell.net internally where hell.net did not resolve on the public internet that would be one thing. But trying to leverage public domain externally and internally at the same time runs into problems. And is not really a suggested setup.
The 2 approved domains to use internally these days is home.arpa and .internal
I would suggest you use one of those..
Kea is not as yet at feature parity with isc (older dhcp server).. And it is missing features.. I would not suggest you use it currently unless you have the most basic requirements of a dhcp server. There are some good strides to bring it to parity with isc in the 24.11 release..
Since tardis did not come back fq in your ping - that really points to just windows finding it with some other method where dns isn't even involved.
-
@johnpoz
ok i changed localdomain to home.arpaas for dhcp settings all i set is
192.168.0.50-254 as range
dns 192.168.0.1
gateway 192.168.0.1 and i do the same for my vlans
so dns 192.168.10.1 and gateway for cameras and so on
so if thats basic then ya i set my up basicand ubuntu and my other unraid boxes can now ping tardis and get the same results
no domain name added... do they use other methods then tooalways learning something new everyday.. and the 24.11 release is that pfsense being released this month i know i had issues when i had 2.7.1 it didnt even know there was an update and when i transitioned to 2.7.2 there was a bunch of glitches in the config file and such that... so i manually re set up everything so entering in all manually so its glitch free.. so hope next upgrade no issues
-
@comet424 have no idea what your doing on your linux boxes.. But if the name was discovered via DNS, then it should come back fq
root@UC:/home/user# ping nas PING nas.home.arpa (192.168.9.10) 56(84) bytes of data. 64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=1 ttl=63 time=1.37 ms 64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=2 ttl=63 time=0.731 ms 64 bytes from nas.home.arpa (192.168.9.10): icmp_seq=3 ttl=63 time=0.489 msthat is a linux box on my network. See I ping nas and it comes back nas.home.arpa - do you have host file on your linux box?
My resolv.conf on my linux box has search set for home.arpa
nameserver 127.0.0.53 options edns0 trust-ad search home.arpa -
@johnpoz
apparently i spoke too soon.. i had to reboot my unraid.. my other unraid can ping tardis thats rambo... but the ubuntu desktop it cant ping now
pinging from unraid to tardisroot@Rambo:~# ping tardis PING tardis (192.168.0.3) 56(84) bytes of data. 64 bytes from Tardis.local (192.168.0.3): icmp_seq=1 ttl=64 time=0.267 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=2 ttl=64 time=0.227 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=3 ttl=64 time=0.313 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=4 ttl=64 time=0.391 ms 64 bytes from Tardis.local (192.168.0.3): icmp_seq=5 ttl=64 time=0.285 ms ^C --- tardis ping statistics --- 5 packets transmitted, 5 received, 0% packet loss, time 4089ms rtt min/avg/max/mdev = 0.227/0.296/0.391/0.054 mspinging from ubuntu to tardis
so i spoke too soon that everything working
-
It looks like you made it work by removing the search domain from the client so it really is trying to resolve just 'tardis'. But some (many?) devices won't allow that.
You should send the local domain via DHCP and then set the host overides using that domain.
In Ubuntu you may need to flash the local resolver cache:
sudo resolvectl flush-caches -
@stephenw10 ah ok so i set the dhcp server domain i put in home.arpa
and i rebooted the ubuntu desktop but still up able to ping tardis
i can ping www.google.ca that has no problem it cant ping locallyso you mean many devices wont allow you to ping tardis or like ping camera10
as example or all my ESP32 devices that run esphomeas for the host override... how do i blank host override to add domain and covers everything on the network.. as so far i only learned you can do like 1 ip address at a time
and i read about split dns and 1:1 nat but all i remember is when i defaulted a clean pfsense i could ping ubuntu and stuff but now where i added vpn and the 1::128 and all those other nats i also wondered if those conflict?
but so far i can ping from
raspberry pi
unraid
windows
pfsensebut i cant seem to ping from any of my ubuntu vms
and i thought if i set dns 192.168.0.1 and in the resolver i set it to all all for incomming and out going that it would resolve things but i guesss not
and even after the reboot and the sudo resolvectl flush-caches i still get same error temporary failture..
i did try this it also failed
if you can show with picture how my host override should look like that would cover everything be good as im a visual learner more over then words to understand things
-
so i tried these 2 different over rides but these didnt work
