Rule for forcing DNS to firewall/router

[pharceface]

Hi, I am trying to create a rule to force DNS to firewall instead of whatever the endpoint has configured. This is the rule I've made so far:

The way I understand this is that if a DNS request comes from the famlan subnets for anyother destination other than the interface IP it is rerouted to the there. The DHCP config for this VLAN does use a different public DNS than the what is in general config. However, this doesn't work. When I set my DNS from the endpoint and reboot I can get to reddit and other places I shouldn't. What am I doing wrong?

Here is the DHCP config I have for the interface

And lastly here is what I have for DNS in general settings:

I appreciate any help that anyone is willing to provide.

[johnpoz]

@pharceface one thing that jumps out is you are only set for tcp, dns normally uses udp. While it sometimes use tcp, your rule should be for both udp and tcp.

And you would normally redirect to the loopback address. Its spelled out here.

https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html

[pharceface]

@johnpoz Thank you. Things are working as intended. Is it possible to consildate the external DNS allow/block rule(s) to one rule by inverting the destination? If not, I'll keep what what the documentation has, just curious.

[johnpoz]

@pharceface Bang or inverse rules - smart man here corrected me on their use - I no longer use them myself.

[pharceface]

So I am potentially very dumb. I cannot get this to work. By this I mean my DNS filtering. I have two subnets that I want to use a different DNS than what is configured under general settings.

I have followed the guides to redirect DNS and it was initally working. Now that I've deployed things its not working. If I alter the rules to have the block rule first, of course DNS doesn't work. If they're in any other order sites like Reddit, X are accessible despite the DNS in use explicitly blocking these sites.
If it means anything I was testing this from my phone using DuckDuckGo and the built-in LinageOS browser. I would re-order rules, connect and try to hit sites I'm attempting to block and get there. Curse and then try again.

Here is the order they're currently in:

This interface pictured is a VLAN, I'll be going through and checking to ensure its tagged/untagged on appropiate interfaces and devices. But, what else could I be overlooking?

Here are the DHCP configs for that interface. I did enable the DNS registration thinking this is neccessary because I want this interface using a different DNS.

I appreciate any help anyone can provide.

[johnpoz]

@pharceface redirection of dot, (853) should never work. Not if your client is sane and actually checking ssl cert.

One of the aspects of dot and doh is validation you are talking to who you want to talk to by validation of ssl cert handed out by the IP your talking to, ie googledns, or cloudflare etc.. If the cert doesn't match then your client - if sane would not use this dns.

that you have any hits on your dot rule is surprising to be honest, dot is rarely used by a client unless you specifically set it up to do so. Common is doh (443).. and much harder to block because it hides in your normal 443 traffic.. You have to specifically block where it is trying to talk to. And again it should be validating the cert so difficult to redirect.

Not sure what your actual goal is here. What is the point of handing out a NS that is not pfsense, if you are redirecting?

Keep in mind in testing dns filtering - clients cache, also many browsers love to use doh unless you specifically tell them not too.

[pharceface]

@johnpoz Thanks again for responding. The end goal of all of this is too try to keep my kids off of the bad parts of the web using DNS filtering. I was attempting to use these rules to ensure that just wouldn't learn to switch the DNS on the desktop they share. Granted, they don't have admin on it. But, I still try not to underestimate them. Some the sites blocked include reddit, x, instagram, etc. I sometimes go to reddit myself and the other adults use some of these sites so I had created other subnets that used the DNS (Quad9) configured in general settings. Would it just be easer to have the filtered DNS as the "main" DNS for the firewall and the subnets inteneded for the adults be the exception with a different DNS assgined via DHCP? Also, thank you again for all the help you've provided so far.

[johnpoz]

@pharceface if the goal is dns filter your going to need to make sure you block doh, and or make sure their browsers are set not use it - and they can't change that.

Browsers these days default to doh - and would circumvent any normal 53 dns redirection you were doing anyway.

your devices are on a different vlan sure set them to use an unfiltered dns.

You might have better luck with filtering for different users using something like pihole.

[SteveITS]

For reference there's a recipe for DoT that mentions DoH:

https://docs.netgate.com/pfsense/en/latest/recipes/dns-block-external.html

For DoH, an easy way is to use the pfBlocker package, set this and select all the DNS servers in the list:

In my experience one must also set at least one DNSBL list a.k.a. Group, or the package will ignore the setting above. This is sufficient:

name: Placeholder
DNSBL Source Definitions state: off
DNSBL Source Definitions Source: (leave blank)
Update Frequency: never
DNSBL Custom_List: bogus.example.com

The last one forces the update.

[pharceface]

@SteveITS Thank you, I will implement this! I actually have pfBlocker installed for some ad blocking.