Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Periodic since 2.2 pages load blank, certs invalid

    General pfSense Questions
    14
    126
    39.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      Ok I just let unbound look them up.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Start listening to these guys.  There's something strange and it looks like it's in unbound.

        
$ dig @192.168.223.1 www.google.com

; <<>> DiG 9.8.3-P1 <<>> @192.168.223.1 www.google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 53699
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.com.			IN	A

;; Query time: 81 msec
;; SERVER: 192.168.223.1#53(192.168.223.1)
;; WHEN: Mon Feb  9 12:23:46 2015
;; MSG SIZE  rcvd: 32

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          After bouncing unbound:

          
$ dig @192.168.223.1 www.google.com

; <<>> DiG 9.8.3-P1 <<>> @192.168.223.1 www.google.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54480
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.google.com.			IN	A

;; ANSWER SECTION:
www.google.com.		300	IN	A	216.58.216.36

;; Query time: 1333 msec
;; SERVER: 192.168.223.1#53(192.168.223.1)
;; WHEN: Mon Feb  9 12:26:36 2015
;; MSG SIZE  rcvd: 48

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 0
          • 2
            2chemlud Banned
            last edited by

            @Trel:

            @2chemlud:

            @Trel:

            When only unbound can be used and DNS Sec is set to ON, and port 53 is blocked except to pfsense
            -A DNS lookup from any computer to one of the domains causes unbound to stop resolving anything, all lookups fail
            (persists until unbound service is restarted)

            I can not confirm this, worked fine for me in this setup (with some service interruptions, 5-7times a day)

            When you say interruptions, could those have been unbound not responding?
            Someone did mention that one of the times I was unable to restart the service manually (as I was not available) it began working again after 45-50 minutes.

            ….

            My thread is this here:

            https://forum.pfsense.org/index.php?topic=88272

            :-)

            1 Reply Last reply Reply Quote 0
            • T
              Trel
              last edited by

              @Derelict:

              Start listening to these guys.  There's something strange and it looks like it's in unbound.

              I'm guessing it happened a few moments after doing a lookup on one of the domains I mentioned?

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Yup.

                Unbound starts returning SERVFAIL for random domains after querying at least one or both of those hostnames.  I'm doing it one more time at unbound log level 5.

                ETA: Ironically, I had to kill unbound to post this because:

                $ dig forum.pfsense.org

                ; <<>> DiG 9.8.3-P1 <<>> forum.pfsense.org
                ;; global options: +cmd
                ;; Got answer:
                ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 30471
                ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

                ;; QUESTION SECTION:
                ;forum.pfsense.org. IN A

                ;; Query time: 1781 msec
                ;; SERVER: 192.168.223.1#53(192.168.223.1)
                ;; WHEN: Mon Feb  9 17:46:41 2015
                ;; MSG SIZE  rcvd: 35

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  Have you guys considered setting the advanced settings that prevent excessive replies and purge things when excessive replies and poisoning is possibly happening?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    https://forum.pfsense.org/index.php?topic=88466.msg488411#msg488411

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • A
                      agreenfield1
                      last edited by

                      @Derelict:

                      Yup.

                      Unbound starts returning SERVFAIL for random domains after querying at least one or both of those hostnames.  I'm doing it one more time at unbound log level 5.

                      This sounds like the manifestation of the issue with DNSSEC enabled.  At some point, you may want to try it again with DNSSEC disabled; you should then see all domains being resolved to a hostile IP, bad certs for https, etc. like reported in the beginning of this thread.  Not sure if this would help with the diagnostics.

                      1 Reply Last reply Reply Quote 0
                      • T
                        Trel
                        last edited by

                        @agreenfield1:

                        @Derelict:

                        Yup.

                        Unbound starts returning SERVFAIL for random domains after querying at least one or both of those hostnames.  I'm doing it one more time at unbound log level 5.

                        This sounds like the manifestation of the issue with DNSSEC enabled.  At some point, you may want to try it again with DNSSEC disabled; you should then see all domains being resolved to a hostile IP, bad certs for https, etc. like reported in the beginning of this thread.  Not sure if this would help with the diagnostics.

                        Yes, DNSSEC was the change I made that made it go from the bad domain resolutions to the failure to resolve at all.

                        I've had both issues and DNSSEC was the difference between which one I got.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Uncheck DNSSEC, Save, Apply….  There is most certainly something here....

                          
$ dig ns3.csof.net

; <<>> DiG 9.8.3-P1 <<>> ns3.csof.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1411
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 5, ADDITIONAL: 3

;; QUESTION SECTION:
;ns3.csof.net.			IN	A

;; ANSWER SECTION:
ns3.csof.net.		600	IN	A	195.22.26.199

;; AUTHORITY SECTION:
csof.net.		1792	IN	NS	ns62.domaincontrol.com.
csof.net.		1792	IN	NS	ns61.domaincontrol.com.
csof.net.		1792	IN	NS	ns4.csof.net.
csof.net.		1792	IN	NS	ns2.csof.net.
csof.net.		1792	IN	NS	ns1.csof.net.

;; ADDITIONAL SECTION:
ns4.csof.net.		1792	IN	A	54.72.8.183
ns2.csof.net.		1793	IN	A	212.6.183.201
ns1.csof.net.		1792	IN	A	54.77.72.254

;; Query time: 29 msec
;; SERVER: 192.168.223.1#53(192.168.223.1)
;; WHEN: Mon Feb  9 18:48:25 2015
;; MSG SIZE  rcvd: 203

$ dig api-nyc01.exip.org

; <<>> DiG 9.8.3-P1 <<>> api-nyc01.exip.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14360
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;api-nyc01.exip.org.		IN	A

;; ANSWER SECTION:
api-nyc01.exip.org.	10	IN	A	195.22.26.248

;; Query time: 206 msec
;; SERVER: 192.168.223.1#53(192.168.223.1)
;; WHEN: Mon Feb  9 18:48:35 2015
;; MSG SIZE  rcvd: 52

$ dig www.pfsense.org

; <<>> DiG 9.8.3-P1 <<>> www.pfsense.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51593
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 4, ADDITIONAL: 0

;; QUESTION SECTION:
;www.pfsense.org.		IN	A

;; ANSWER SECTION:
www.pfsense.org.	10	IN	A	195.22.26.248

;; AUTHORITY SECTION:
org.			172779	IN	NS	ns1.csof.net.
org.			172779	IN	NS	ns2.csof.net.
org.			172779	IN	NS	ns3.csof.net.
org.			172779	IN	NS	ns4.csof.net.

;; Query time: 159 msec
;; SERVER: 192.168.223.1#53(192.168.223.1)
;; WHEN: Mon Feb  9 18:48:39 2015
;; MSG SIZE  rcvd: 129

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            looks like unbound is allowing itself to get polluted by this nonsense:

                            
gridbug:etc cjl$ dig @ns1.csof.net. com. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. com. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31834
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;com.				IN	NS

;; ANSWER SECTION:
com.			172800	IN	NS	ns1.csof.net.
com.			172800	IN	NS	ns2.csof.net.
com.			172800	IN	NS	ns3.csof.net.
com.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 163 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:58:46 2015
;; MSG SIZE  rcvd: 165

gridbug:etc cjl$ dig @ns1.csof.net. . ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. . ns
; (1 server found)
;; global options: +cmd
;; connection timed out; no servers could be reached
gridbug:etc cjl$ dig @ns1.csof.net. net. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. net. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 23620
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;net.				IN	NS

;; ANSWER SECTION:
net.			172800	IN	NS	ns1.csof.net.
net.			172800	IN	NS	ns2.csof.net.
net.			172800	IN	NS	ns3.csof.net.
net.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 161 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:59:19 2015
;; MSG SIZE  rcvd: 162

gridbug:etc cjl$ dig @ns1.csof.net. com. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. com. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57675
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;com.				IN	NS

;; ANSWER SECTION:
com.			172800	IN	NS	ns1.csof.net.
com.			172800	IN	NS	ns2.csof.net.
com.			172800	IN	NS	ns3.csof.net.
com.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 164 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:59:23 2015
;; MSG SIZE  rcvd: 165

gridbug:etc cjl$ dig @ns1.csof.net. org. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. org. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20295
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;org.				IN	NS

;; ANSWER SECTION:
org.			172800	IN	NS	ns1.csof.net.
org.			172800	IN	NS	ns2.csof.net.
org.			172800	IN	NS	ns3.csof.net.
org.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 162 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:59:27 2015
;; MSG SIZE  rcvd: 165

gridbug:etc cjl$ dig @ns1.csof.net. edu. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. edu. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28770
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;edu.				IN	NS

;; ANSWER SECTION:
edu.			172800	IN	NS	ns1.csof.net.
edu.			172800	IN	NS	ns2.csof.net.
edu.			172800	IN	NS	ns3.csof.net.
edu.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 161 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:59:31 2015
;; MSG SIZE  rcvd: 165

gridbug:etc cjl$ dig @ns1.csof.net. gov. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. gov. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 46880
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;gov.				IN	NS

;; ANSWER SECTION:
gov.			172800	IN	NS	ns1.csof.net.
gov.			172800	IN	NS	ns2.csof.net.
gov.			172800	IN	NS	ns3.csof.net.
gov.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 162 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:59:34 2015
;; MSG SIZE  rcvd: 165

gridbug:etc cjl$ dig @ns1.csof.net. mil. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. mil. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21791
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;mil.				IN	NS

;; ANSWER SECTION:
mil.			172800	IN	NS	ns1.csof.net.
mil.			172800	IN	NS	ns2.csof.net.
mil.			172800	IN	NS	ns3.csof.net.
mil.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 160 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:59:40 2015
;; MSG SIZE  rcvd: 165

gridbug:etc cjl$ dig @ns1.csof.net. us. ns

; <<>> DiG 9.8.3-P1 <<>> @ns1.csof.net. us. ns
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5930
;; flags: qr aa rd; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 4
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;us.				IN	NS

;; ANSWER SECTION:
us.			172800	IN	NS	ns1.csof.net.
us.			172800	IN	NS	ns2.csof.net.
us.			172800	IN	NS	ns3.csof.net.
us.			172800	IN	NS	ns4.csof.net.

;; ADDITIONAL SECTION:
ns1.csof.net.		100	IN	A	54.77.72.254
ns2.csof.net.		100	IN	A	212.6.183.201
ns3.csof.net.		100	IN	A	195.22.26.199
ns4.csof.net.		100	IN	A	54.72.8.183

;; Query time: 161 msec
;; SERVER: 54.77.72.254#53(54.77.72.254)
;; WHEN: Mon Feb  9 18:59:43 2015
;; MSG SIZE  rcvd: 164

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Back to dnsmasq for me until someone says something.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • T
                                Trel
                                last edited by

                                I don't know which I should be.

                                Upset that unbound is doing this
                                Relieved that everything I was seeing can be reproduced

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  You should be thankful you found something that made it easily-reproducible.  No need to be mad.  Things happen - Look at BIND's history.  And you can always just run dnsmasq in the meantime even though that's the exact opposite advice you got at first.  :/

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    agreenfield1
                                    last edited by

                                    I'm really out of my league trying to diagnose this, but here is the output of 'unbound-control -c /var/unbound/unbound.conf lookup slashdot.org', when the issue is occuring with DNSSEC enabled:

                                     unbound-control -c /var/unbound/unbound.conf lookup slashdot.org
The following name servers are used for lookup of slashdot.org.
;rrset 85785 4 0 7 0
org.	172185	IN	NS	ns1.csof.net.
org.	172185	IN	NS	ns2.csof.net.
org.	172185	IN	NS	ns3.csof.net.
org.	172185	IN	NS	ns4.csof.net.
;rrset 83879 2 1 11 4
org.	83879	IN	DS	21366 7 1 E6C1716CFB6BDC84E84CE1AB5510DAC69173B5B2
org.	83879	IN	DS	21366 7 2 96EEB2FFD9B00CD4694E78278B5EFDAB0A80446567B69F634DA078F0D90F01BA
org.	83879	IN	RRSIG	DS 8 1 86400 20150219170000 20150209160000 16665 . RxYpI0BzYpGTE/PjRQdR4SZaxlvXCja3SJyx10JagTfz20gnltl4ar94GOwp8bA/ktY/7JxMoJvzCTAtcsGaTGRv04yDHr7WaydMxZuPCP9YT9Ixc+fX9IAZlSfwLCkBQgiC0mVeRiq+LmbIJhI2grJbTtvy96O9mipAqkFR42g= ;{id = 16665}
;rrset 1185 1 0 3 0
ns4.csof.net.	1185	IN	A	54.72.8.183
;rrset 197 1 0 8 0
ns3.csof.net.	197	IN	A	195.22.26.199
;rrset 1185 1 0 8 0
ns2.csof.net.	1185	IN	A	212.6.183.201
;rrset 1185 1 0 8 0
ns1.csof.net.	1185	IN	A	54.77.72.254
Delegation with 4 names, of which 4 can be examined to query further addresses.
It provides 4 IP addresses.
54.77.72.254    	NoDNSSEC rto 344 msec, ttl 286, ping 84 var 65 rtt 344, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
212.6.183.201   	NoDNSSEC rto 365 msec, ttl 286, ping 69 var 74 rtt 365, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
195.22.26.199   	rto 96256 msec, ttl 286, ping 0 var 94 rtt 376, tA 3, tAAAA 3, tother 3, EDNS 0 assumed.
54.72.8.183     	NoDNSSEC rto 315 msec, ttl 286, ping 99 var 54 rtt 315, tA 0, tAAAA 0, tother 0, EDNS 0 probed.

                                    And then after restarting unbound:

                                    unbound-control -c /var/unbound/unbound.conf lookup slashdot.org
The following name servers are used for lookup of slashdot.org.
;rrset 86374 6 0 2 0
org.	86374	IN	NS	a0.org.afilias-nst.info.
org.	86374	IN	NS	a2.org.afilias-nst.info.
org.	86374	IN	NS	b0.org.afilias-nst.org.
org.	86374	IN	NS	b2.org.afilias-nst.org.
org.	86374	IN	NS	c0.org.afilias-nst.info.
org.	86374	IN	NS	d0.org.afilias-nst.org.
;rrset 86374 2 1 2 0
org.	86374	IN	DS	21366 7 1 E6C1716CFB6BDC84E84CE1AB5510DAC69173B5B2
org.	86374	IN	DS	21366 7 2 96EEB2FFD9B00CD4694E78278B5EFDAB0A80446567B69F634DA078F0D90F01BA
org.	86374	IN	RRSIG	DS 8 1 86400 20150219170000 20150209160000 16665 . RxYpI0BzYpGTE/PjRQdR4SZaxlvXCja3SJyx10JagTfz20gnltl4ar94GOwp8bA/ktY/7JxMoJvzCTAtcsGaTGRv04yDHr7WaydMxZuPCP9YT9Ixc+fX9IAZlSfwLCkBQgiC0mVeRiq+LmbIJhI2grJbTtvy96O9mipAqkFR42g= ;{id = 16665}
;rrset 86374 1 0 1 0
d0.org.afilias-nst.org.	172774	IN	A	199.19.57.1
;rrset 86374 1 0 1 0
d0.org.afilias-nst.org.	172774	IN	AAAA	2001:500:f::1
;rrset 86374 1 0 1 0
c0.org.afilias-nst.info.	172774	IN	A	199.19.53.1
;rrset 86374 1 0 1 0
c0.org.afilias-nst.info.	172774	IN	AAAA	2001:500:b::1
;rrset 86374 1 0 1 0
b2.org.afilias-nst.org.	172774	IN	A	199.249.120.1
;rrset 86374 1 0 1 0
b2.org.afilias-nst.org.	172774	IN	AAAA	2001:500:48::1
;rrset 86374 1 0 1 0
b0.org.afilias-nst.org.	172774	IN	A	199.19.54.1
;rrset 86374 1 0 1 0
b0.org.afilias-nst.org.	172774	IN	AAAA	2001:500:c::1
;rrset 86374 1 0 1 0
a2.org.afilias-nst.info.	172774	IN	A	199.249.112.1
;rrset 86374 1 0 1 0
a2.org.afilias-nst.info.	172774	IN	AAAA	2001:500:40::1
;rrset 86374 1 0 1 0
a0.org.afilias-nst.info.	172774	IN	A	199.19.56.1
;rrset 86374 1 0 1 0
a0.org.afilias-nst.info.	172774	IN	AAAA	2001:500:e::1
Delegation with 6 names, of which 0 can be examined to query further addresses.
It provides 12 IP addresses.
2001:500:e::1   	not in infra cache.
199.19.56.1     	not in infra cache.
2001:500:40::1  	not in infra cache.
199.249.112.1   	not in infra cache.
2001:500:c::1   	not in infra cache.
199.19.54.1     	not in infra cache.
2001:500:48::1  	not in infra cache.
199.249.120.1   	rto 356 msec, ttl 874, ping 8 var 87 rtt 356, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:500:b::1   	not in infra cache.
199.19.53.1     	rto 482 msec, ttl 874, ping 22 var 115 rtt 482, tA 0, tAAAA 0, tother 0, EDNS 0 probed.
2001:500:f::1   	not in infra cache.
199.19.57.1     	not in infra cache.
                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kejianshi
                                      last edited by

                                      I'll ask again…

                                      In Services: DNS Resolver: Advanced

                                      Have you tried checking:

                                      Harden Glue

                                      Harden DNSSEC data

                                      Unwanted Reply Threshold (10 million)

                                      etc...  ???

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        cmb
                                        last edited by

                                        @kejianshi:

                                        Have you tried checking:

                                        Harden Glue

                                        Harden DNSSEC data

                                        These two in particular, if you don't have them enabled, enable them. I changed things to enable both those by default, and we'll add config upgrade code to turn those on for anyone who doesn't have them enabled upon upgrade to 2.2.1.

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kejianshi
                                          last edited by

                                          Yeah - I went on a voyage of discovery to find a combo that worked…
                                          Less a matter of being smart.  More a matter of random experimentation.

                                          Even reading and searching online yielded little results.

                                          But yeah - Fixes alot.

                                          I'm glad you guys are making it defaults.

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            doktornotor Banned
                                            last edited by

                                            Couple more of the hardened stuff here: https://forum.pfsense.org/index.php?topic=88466.msg488511#msg488511

                                            • harden-referral-path is hardcoded to no in unbound.inc ATM  :(
                                            • harden-below-nxdomain can be set via the advanced config

                                            (created a feature request for the two above)

                                            • there's also this use-caps-for-id thing (patch to expose in GUI in 4205 or stick use-caps-for-id: yes to advanced config.

                                            Another thing that makes me wonder… dnsmasq AFAICT is not compiled with DNSSEC support at all on pfSense even though it's apparently supported now. Hmmm. And of course, no matter what you are completely screwed with unsigned domains, and the DNS protocol is a piece of insecure crap.

                                            A couple of suggestions for your own servers:

                                            • sign your domains (ahem… why's pfsense.org not signed?!)
                                            • if your registrar does not allow you to do so, switch registrar
                                            • if the TLD you are using is not signed, choose a different one
                                            • use DANE/TLSA for your critical servers at least.

                                            Some useful tools:

                                            • DNSSEC Test - check your resolvers

                                            • DNSSEC Analyzer - check your domain for DNSSEC problems

                                            • DNSSEC/TLSA Validator add-on for Web Browsers

                                            • TLSA Record Generator

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.