Unable to route incoming DNS traffic
-
Hi there,
I am a new user to pfSense, and it's been great up until now - I'm having issues with trying to route incoming DNS traffic through my pfSense device :( I'm hoping it's a reasonable quick and simple fix, and would appreciate some know-how on how I can achieve the following.
I have a couple of public subnets from my upstream provider (no BGP or anything fancy), and within one of those nets, I have a bind server which I want to make available to the wider world through my pfSense device.
Here is a textual topology of my network:
(internet)
|
|
99.99.99.99
(pfsense)
88.88.88.1
|
|
88.88.88.2
(downstream router)
77.77.77.1
|
|
77.77.77.2
(Bind DNS Server)-
WAN IP is static assigned from ISP (in my example, 99.99.99.99)
-
LAN IP is a public IP from a /30 range (in my example, 88.88.88.1), connected to a downstream router (88.88.88.2)
-
My downstream router has many networks coming off it, including 77.77.77.0/24 - which is where by Bind DNS server sits.
-
NAT is disabled on my pfSense device (and I would prefer to keep it that way - I am hoping to just use this pfSense device as a firewall).
-
DNS Forwarder and DNS Resolver finctionality are disabled.
-
I have an "open everything" rule for my Bind DNS server to talk to and from the internet (I hope to only allow port 53 through to it).
When I try and query the Bind Server from the outside world (or anything north of my pfSense device), I get time outs - specifically, I can't get to port 53. When I am anywhere south of my pfSense device, everything works fine. From the wider world, I can ping and SSH to the Bind Server no problem (I have a temporary allow-all rule) - I just can't get to anything on port 53.
I ran tshark on the Bind Server to see if the box was getting any packets on port 53, and it was only getting captures for any device south of pfSense - not the internet.
When I look at the firewall logs, I can see all the ping and SSH traffic being allowed, but there are no entries for an attempted port 53 passthrough. It seems as though the pfSense device is trying to be the end-point for everything port 53 - which I am trying to get around.
Could someone please advise how I can configure pfSense such that it treats port 53 like any other port and passes it through the device if there is a matching firewall rule?
Your assistance is appreciated :) TIA.
-
-
so these are all public IPs and your natting at pfsense.
So you say you can ping the bind servers IP from the public? Your saying when you sniff on the bind server you see no dns traffic from public internet but you see the pings? And the bind server can query dns on the public internet?
-
I have a bind server which I want to make available to the wider world through my pfSense device.
IMHO this isn't the best idea. DDOS attacks are common using improperly configured bind servers. Port 53 traffic may be blocked by your ISP because of this.
-
so these are all public IPs and your natting at pfsense.
All are public IPs, and I am not performing any NAT - just trying to simply route.
So you say you can ping the bind servers IP from the public?
Correct. And I can SSH to it.
Your saying when you sniff on the bind server you see no dns traffic from public internet but you see the pings?
Correct.
And the bind server can query dns on the public internet?
Correct. I can query DNS against 8.8.8.8 no problem.
Port 53 traffic may be blocked by your ISP.
No ports are filtered by my ISP. When I remove the pfSense device from the picture (and replace it with something like VyOS) - it works no problem.
-
Can you post a screen shot of your firewall rules?
-
Can you post a screen shot of your firewall rules?
Sure…. I've also attached a log to show that traffic is being logged for this rule, and that SSH traffic is flowing through.
I know the rule I've created is dangerous - however I am trying to rule out where the problem is.
-
And where it that you see 53 traffic.. All see there is ssh traffic.
why would pfsense block 53?? Makes no sense you got something else going on or 53 is not even getting to you. Why don't you sniff on the wan and lan of pfsense and lets see the 53 traffic hit wan and not go out lan, or maybe it does?
So you photoshopped those rules? because 77.77.77.2 is not your real IP..
-
The screenshots do NOT show DNS traffic and chances are high that inbound DNS is completely blocked by ISP.
-
what dns traffic are you seeing in those screenshots dok?
Do you have any rules in floating?
-
None of course. Tried typing on touchscreen junk after a couple of months.
-
Is the downstream router NAT'd?
IMHO, I would have created an explicit rule to take traffic going into port 53 on the WAN side of pfSense and routes it to the IP address/port 53 of the downstream router. In the downstream router you'd direct that traffic to the bind server.
-
And where it that you see 53 traffic.. All see there is ssh traffic.
I don't - that's the problem. I don't see any DNS traffic coming in.
why would pfsense block 53?? Makes no sense you got something else going on or 53 is not even getting to you. Why don't you sniff on the wan and lan of pfsense and lets see the 53 traffic hit wan and not go out lan, or maybe it does?
This is what I'm trying to figure out - it doesn't make sense to me why pfSense is not passing inbound DNS requests through.
How do I perform sniffing on the pfSense device itself?So you photoshopped those rules? because 77.77.77.2 is not your real IP..
I have replaced my IPs in my original post and in my firewall log for the purposes of this post.
The screenshots do NOT show DNS traffic and chances are high that inbound DNS is completely blocked by ISP.
As mentioned in an earlier post, if I replace my pfSense device with VyOS - DNS works no problem - so I know port 53 and inbound DNS are NOT filtered by my ISP.
-
you sniff on pfsense under diag, packet capture.
And your floating tab is empty?
I see your blocking bogon - is it possible your source of dns traffic would be in bogon?
