Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Host Overrides for forced safe search stopped working on 2.3 [solved]

    General pfSense Questions
    3
    26
    3039
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      aGeekhere last edited by

      Hi, after upgrading to 2.3 my forced google safe search has stopped working.
      In DNS Resolver Host Overrides my setup is

      
Host             Domain                 IP                            
www            google.com.au	216.239.38.120	googlesafe

      Anyone else have this issue?

      1 Reply Last reply Reply Quote 0
      • A
        aGeekhere last edited by

        anyone else have this issue?

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by

          when you ping google or do a dns query for www.google.com.au what IP do you get back.. if you get back that IP, then host override is working.  If you are getting results that are not "safe" then that is on google not host overrides, all a host override does is return a specific IP when asked for a specific name.

          And what I can tell you is that is working just fine in 2.3.

          1 Reply Last reply Reply Quote 0
          • A
            aGeekhere last edited by

            when you ping google or do a dns query for www.google.com.au what IP do you get back

            It is not going to host overrides 216.239.38.120 but direct to google unsafe.

            And what I can tell you is that is working just fine in 2.3

            Was working fine for me in 2.2.6 after updating to 2.3 it stopped so I am a bit puzzled, how can I troubleshoot this issue?

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              dude when you query pfsense for that record do you get back that IP??  If so then host override is working..

              Be it your safesearch is working or not has nothing to do with the host override working..

              So when I query www.google.com.au normally I get this

              ;; OPT PSEUDOSECTION:
              ; EDNS: version: 0, flags:; udp: 4096
              ;; QUESTION SECTION:
              ;www.google.com.au.            IN      A

              ;; ANSWER SECTION:
              www.google.com.au.      300    IN      A      64.233.177.94

              When I create an override it returns what I put in the override = host override working.. Are you saying that is not working?  Please show your override and your query to pfsense where this is not the case..


              1 Reply Last reply Reply Quote 0
              • A
                aGeekhere last edited by

                pinging www.google.com

                Pinging www.google.com [216.58.199.36] with 32 bytes of data:
Reply from 216.58.199.36: bytes=32 time=23ms TTL=55
Reply from 216.58.199.36: bytes=32 time=74ms TTL=55
Reply from 216.58.199.36: bytes=32 time=21ms TTL=55
Reply from 216.58.199.36: bytes=32 time=21ms TTL=55

Ping statistics for 216.58.199.36:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 21ms, Maximum = 74ms, Average = 34ms

                nslookup www.google.com

                nslookup www.google.com
Non-authoritative answer:
Name:    www.google.com
Addresses:  2404:6800:4006:803::2004
          216.58.199.36

                DNS Resolver Host Overrides
                see attachment

                Google is not showing that safe search is enabled (because it is not going to 216.239.38.120) so the Host Overrides has stopped working for me after the update.


                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  and your host override is for www.google.com.au, and your pinging www.google.com so yeah not going to to return the IP you put in the override..

                  Ah So you have both ok…  Where are you doing your query too, clearly its not pfsense..  Your nslook doesn't show what server you asked..


                  1 Reply Last reply Reply Quote 0
                  • A
                    aGeekhere last edited by

                    here it is

                    nslookup www.google.com
Server:  pfsense.myDomain.local
Address:  192.168.1.1

Non-authoritative answer:
Name:    www.google.com
Addresses:  2404:6800:4006:803::2004
          216.58.199.36
                    1 Reply Last reply Reply Quote 0
                    • johnpoz
                      johnpoz LAYER 8 Global Moderator last edited by

                      Well you sure you have your host override in the right place??  Seen this quite often users put override in forwarder section and running resolver, or have in resolver and using forwarder..

                      What I can tell you is that I am using the resolver on 2.3 and have lots and lots of overrides and all working just fine..  I would validate what is running on pfsense and its setup..  And that you have the overrides in the correct place.

                      1 Reply Last reply Reply Quote 0
                      • A
                        aGeekhere last edited by

                        Well it was working before the update so if I had it miss configured then it would have never work.
                        I will go over my setup tomorrow to see if i can find anything that might have changed during the update.

                        By the way did you do an upgrade or fresh install?

                        1 Reply Last reply Reply Quote 0
                        • johnpoz
                          johnpoz LAYER 8 Global Moderator last edited by

                          I did an upgrade from 2.2.6 to snapshots before 2.3 actually released when they were on the RCs and then to the final 2.3 when that came out.

                          I had no issues with anything in the transition from 2.2 to 2.3 all my packages worked, my vpn worked.. It was smooth as you would expect from the pfsense team.. I did have a bit of an issue with it trying to continue on to the 2.3.1 dev line…  So had to change that setting.

                          So how many overrides do you have?  create a new test one - does that work..  If not then yeah you got something borked up..


                          1 Reply Last reply Reply Quote 0
                          • A
                            aGeekhere last edited by

                            So how many overrides do you have?

                            For now the ones I have shown.

                            create a new test one - does that work

                            Sorry to say no

                            If not then yeah you got something borked up

                            Looks to be the case, I see no errors in the logs saying something is wrong in the DNS resolver. I guess I could wait for 2.3.1 and see if that fixes anything as I do not want to reinstall pfsense at this time.

                            1 Reply Last reply Reply Quote 0
                            • johnpoz
                              johnpoz LAYER 8 Global Moderator last edited by

                              Are you even sure resolver is running??  Maybe you have the forwarder running..  Sorry to sound like I am treating you like a moron..  But normally that is the case around here..

                              If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place.  Or your not even doing a query to pfsense..

                              1 Reply Last reply Reply Quote 0
                              • A
                                aGeekhere last edited by

                                Are you even sure resolver is running??

                                DNS Resolver is runing

                                Maybe you have the forwarder running

                                I do have the forwarder running for the WPAD, but i never had any issue with that before see attachment

                                Sorry to sound like I am treating you like a moron..  But normally that is the case around here.

                                I hope that I am not making a moron of a mistake but it was all working perfectly before the update, when the update finished I notice straight away that the Host Overrides stopped working.

                                If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place.  Or your not even doing a query to pfsense..

                                See attachments






                                1 Reply Last reply Reply Quote 0
                                • johnpoz
                                  johnpoz LAYER 8 Global Moderator last edited by

                                  Huh???

                                  What is the point of forwarding anything to 53 to 53??  How about you turn off that and the forwarder and make sure resolver is working..  Which you don't even have doing dnssec so what is the point of it?  Why do you think you need forwarder running for wpad??  On the proxy port?

                                  When are you going to query the resolver?

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    aGeekhere last edited by

                                    Fixed it by Diagnostics\States\States Reset States

                                    Would have thought restarting the router would have done that, anyway.

                                    I also Enabled DNSSEC Support.

                                    What is the point of forwarding anything to 53 to 53??  How about you turn off that and the forwarder and make sure resolver is working..  Which you don't even have doing dnssec so what is the point of it?  Why do you think you need forwarder running for wpad??  On the proxy port?

                                    When are you going to query the resolver?

                                    Well it works now and i do not want to break anything by changing something, thanks for the help

                                    1 Reply Last reply Reply Quote 0
                                    • johnpoz
                                      johnpoz LAYER 8 Global Moderator last edited by

                                      What is the point of forwarding 53 to loopback, you want to make sure some that does a query to 53 to something outside is redirected to pfsense??

                                      And your forwarder is running on 3128 so when is that queried??

                                      Break something - break what a pointless configuration?

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        aGeekhere last edited by

                                        http://resources.infosecinstitute.com/hacking-clients-wpad-web-proxy-auto-discovery-protocol/

                                        1 Reply Last reply Reply Quote 0
                                        • johnpoz
                                          johnpoz LAYER 8 Global Moderator last edited by

                                          What does that have to do with running forwarder on 3128??  Yeah you can create a entry for wpad.yourdomain.tld to point to where the autoconfiguration script is..  What does that have to do with forwarder listening on 3128??  Which would be the same port your proxy is listening on normally??

                                          1 Reply Last reply Reply Quote 0
                                          • A
                                            aGeekhere last edited by

                                            Ok just had a look I needed to use a port other than 53 because Resolver was using that port and when I was trying different methods to get the wpad working i tried the proxy port and it worked however I just changed the DNS Forwarder to something else and it also works fine.

                                            So yeah there is no need to point the DNS Forwarder to the proxy port (just need to pick an unused one) learn something new everyday.

                                            1 Reply Last reply Reply Quote 0
                                            • johnpoz
                                              johnpoz LAYER 8 Global Moderator last edited by

                                              Not sure how you think that is working??  What do you think is doing a query to the forwarder for wpad??

                                              Do you have some other redirection going on?  Why do you need the forwarder?  Why would you not just create a entry in resolver?  You have a redirect to loopback.. What what is listing on loopback the forwarder or the resolver?

                                              I am really confused what you think that is doing?  And why you need both forwarder and resolver?

                                              1 Reply Last reply Reply Quote 0
                                              • A
                                                aGeekhere last edited by

                                                Why do you need the forwarder?  Why would you not just create a entry in resolver

                                                I just tried using the the resolver for the wpad and it seems to be working so no I do not need the forwarder. I used the forwarder because I will following a tutorial when i set up the wpad. As far as the loopback be selected I was just testing something with it, disabled it now.

                                                Thanks for the help

                                                1 Reply Last reply Reply Quote 0
                                                • J
                                                  javcasta last edited by

                                                  Hello.

                                                  I use DNS resolver (unbound) for set Force Safe Search Google, for all google domains, and works fine for my pfSense 2.3:

                                                  I have the list (forecegoogle.conf)  with domain overrides for google
                                                  https://www.javcasta.com/configuracion-avanzada-forcesafesearchgoogle-con-pfsense/

                                                  Services > DNS Resolver
                                                  Host Overrides:
                                                  forcesafesearch.google.com  216.239.38.120 
                                                  www.google.com  216.239.38.120
                                                  www.google.es  216.239.38.120

                                                  Advanced
                                                  server:
                                                  include: /var/unbound/forecegoogle.conf

                                                  Regards

                                                  1 Reply Last reply Reply Quote 0
                                                  • A
                                                    aGeekhere last edited by

                                                    there is an issue with selecting the google domains

                                                    local-data: "www.google.ad A 216.239.38.120"
                                                    local-data: "www.google.ae A 216.239.38.120"
                                                    local-data: "www.google.com.af A 216.239.38.120"
                                                    local-data: "www.google.com.ag A 216.239.38.120"

                                                    That is all I can select.

                                                    1 Reply Last reply Reply Quote 0
                                                    • J
                                                      javcasta last edited by

                                                      Hello.

                                                      Services > DNS Resolver
                                                      Host Overrides:
                                                      forcesafesearch.google.com  216.239.38.120 
                                                      www.google.com  216.239.38.120
                                                      www.google.es  216.239.38.120

                                                      Advanced
                                                      server:
                                                      include: /var/unbound/forecegoogle.conf

                                                      This is the /var/unbound/forecegoogle.conf file (except for www.google.com and www.google.es, that are defined directly in host overrides)

                                                      local-data: "www.google.ad A 216.239.38.120"
local-data: "www.google.ae A 216.239.38.120"
local-data: "www.google.com.af A 216.239.38.120"
local-data: "www.google.com.ag A 216.239.38.120"
local-data: "www.google.com.ai A 216.239.38.120"
local-data: "www.google.al A 216.239.38.120"
local-data: "www.google.am A 216.239.38.120"
local-data: "www.google.co.ao A 216.239.38.120"
local-data: "www.google.com.ar A 216.239.38.120"
local-data: "www.google.as A 216.239.38.120"
local-data: "www.google.at A 216.239.38.120"
local-data: "www.google.com.au A 216.239.38.120"
local-data: "www.google.az A 216.239.38.120"
local-data: "www.google.ba A 216.239.38.120"
local-data: "www.google.com.bd A 216.239.38.120"
local-data: "www.google.be A 216.239.38.120"
local-data: "www.google.bf A 216.239.38.120"
local-data: "www.google.bg A 216.239.38.120"
local-data: "www.google.com.bh A 216.239.38.120"
local-data: "www.google.bi A 216.239.38.120"
local-data: "www.google.bj A 216.239.38.120"
local-data: "www.google.com.bn A 216.239.38.120"
local-data: "www.google.com.bo A 216.239.38.120"
local-data: "www.google.com.br A 216.239.38.120"
local-data: "www.google.bs A 216.239.38.120"
local-data: "www.google.bt A 216.239.38.120"
local-data: "www.google.co.bw A 216.239.38.120"
local-data: "www.google.by A 216.239.38.120"
local-data: "www.google.com.bz A 216.239.38.120"
local-data: "www.google.ca A 216.239.38.120"
local-data: "www.google.cd A 216.239.38.120"
local-data: "www.google.cf A 216.239.38.120"
local-data: "www.google.cg A 216.239.38.120"
local-data: "www.google.ch A 216.239.38.120"
local-data: "www.google.ci A 216.239.38.120"
local-data: "www.google.co.ck A 216.239.38.120"
local-data: "www.google.cl A 216.239.38.120"
local-data: "www.google.cm A 216.239.38.120"
local-data: "www.google.cn A 216.239.38.120"
local-data: "www.google.com.co A 216.239.38.120"
local-data: "www.google.co.cr A 216.239.38.120"
local-data: "www.google.com.cu A 216.239.38.120"
local-data: "www.google.cv A 216.239.38.120"
local-data: "www.google.com.cy A 216.239.38.120"
local-data: "www.google.cz A 216.239.38.120"
local-data: "www.google.de A 216.239.38.120"
local-data: "www.google.dj A 216.239.38.120"
local-data: "www.google.dk A 216.239.38.120"
local-data: "www.google.dm A 216.239.38.120"
local-data: "www.google.com.do A 216.239.38.120"
local-data: "www.google.dz A 216.239.38.120"
local-data: "www.google.com.ec A 216.239.38.120"
local-data: "www.google.ee A 216.239.38.120"
local-data: "www.google.com.eg A 216.239.38.120"
local-data: "www.google.com.et A 216.239.38.120"
local-data: "www.google.fi A 216.239.38.120"
local-data: "www.google.com.fj A 216.239.38.120"
local-data: "www.google.fm A 216.239.38.120"
local-data: "www.google.fr A 216.239.38.120"
local-data: "www.google.ga A 216.239.38.120"
local-data: "www.google.ge A 216.239.38.120"
local-data: "www.google.gg A 216.239.38.120"
local-data: "www.google.com.gh A 216.239.38.120"
local-data: "www.google.com.gi A 216.239.38.120"
local-data: "www.google.gl A 216.239.38.120"
local-data: "www.google.gm A 216.239.38.120"
local-data: "www.google.gp A 216.239.38.120"
local-data: "www.google.gr A 216.239.38.120"
local-data: "www.google.com.gt A 216.239.38.120"
local-data: "www.google.gy A 216.239.38.120"
local-data: "www.google.com.hk A 216.239.38.120"
local-data: "www.google.hn A 216.239.38.120"
local-data: "www.google.hr A 216.239.38.120"
local-data: "www.google.ht A 216.239.38.120"
local-data: "www.google.hu A 216.239.38.120"
local-data: "www.google.co.id A 216.239.38.120"
local-data: "www.google.ie A 216.239.38.120"
local-data: "www.google.co.il A 216.239.38.120"
local-data: "www.google.im A 216.239.38.120"
local-data: "www.google.co.in A 216.239.38.120"
local-data: "www.google.iq A 216.239.38.120"
local-data: "www.google.is A 216.239.38.120"
local-data: "www.google.it A 216.239.38.120"
local-data: "www.google.je A 216.239.38.120"
local-data: "www.google.com.jm A 216.239.38.120"
local-data: "www.google.jo A 216.239.38.120"
local-data: "www.google.co.jp A 216.239.38.120"
local-data: "www.google.co.ke A 216.239.38.120"
local-data: "www.google.com.kh A 216.239.38.120"
local-data: "www.google.ki A 216.239.38.120"
local-data: "www.google.kg A 216.239.38.120"
local-data: "www.google.co.kr A 216.239.38.120"
local-data: "www.google.com.kw A 216.239.38.120"
local-data: "www.google.kz A 216.239.38.120"
local-data: "www.google.la A 216.239.38.120"
local-data: "www.google.com.lb A 216.239.38.120"
local-data: "www.google.li A 216.239.38.120"
local-data: "www.google.lk A 216.239.38.120"
local-data: "www.google.co.ls A 216.239.38.120"
local-data: "www.google.lt A 216.239.38.120"
local-data: "www.google.lu A 216.239.38.120"
local-data: "www.google.lv A 216.239.38.120"
local-data: "www.google.com.ly A 216.239.38.120"
local-data: "www.google.co.ma A 216.239.38.120"
local-data: "www.google.md A 216.239.38.120"
local-data: "www.google.me A 216.239.38.120"
local-data: "www.google.mg A 216.239.38.120"
local-data: "www.google.mk A 216.239.38.120"
local-data: "www.google.ml A 216.239.38.120"
local-data: "www.google.com.mm A 216.239.38.120"
local-data: "www.google.mn A 216.239.38.120"
local-data: "www.google.ms A 216.239.38.120"
local-data: "www.google.com.mt A 216.239.38.120"
local-data: "www.google.mu A 216.239.38.120"
local-data: "www.google.mv A 216.239.38.120"
local-data: "www.google.mw A 216.239.38.120"
local-data: "www.google.com.mx A 216.239.38.120"
local-data: "www.google.com.my A 216.239.38.120"
local-data: "www.google.co.mz A 216.239.38.120"
local-data: "www.google.com.na A 216.239.38.120"
local-data: "www.google.com.nf A 216.239.38.120"
local-data: "www.google.com.ng A 216.239.38.120"
local-data: "www.google.com.ni A 216.239.38.120"
local-data: "www.google.ne A 216.239.38.120"
local-data: "www.google.nl A 216.239.38.120"
local-data: "www.google.no A 216.239.38.120"
local-data: "www.google.com.np A 216.239.38.120"
local-data: "www.google.nr A 216.239.38.120"
local-data: "www.google.nu A 216.239.38.120"
local-data: "www.google.co.nz A 216.239.38.120"
local-data: "www.google.com.om A 216.239.38.120"
local-data: "www.google.com.pa A 216.239.38.120"
local-data: "www.google.com.pe A 216.239.38.120"
local-data: "www.google.com.pg A 216.239.38.120"
local-data: "www.google.com.ph A 216.239.38.120"
local-data: "www.google.com.pk A 216.239.38.120"
local-data: "www.google.pl A 216.239.38.120"
local-data: "www.google.pn A 216.239.38.120"
local-data: "www.google.com.pr A 216.239.38.120"
local-data: "www.google.ps A 216.239.38.120"
local-data: "www.google.pt A 216.239.38.120"
local-data: "www.google.com.py A 216.239.38.120"
local-data: "www.google.com.qa A 216.239.38.120"
local-data: "www.google.ro A 216.239.38.120"
local-data: "www.google.ru A 216.239.38.120"
local-data: "www.google.rw A 216.239.38.120"
local-data: "www.google.com.sa A 216.239.38.120"
local-data: "www.google.com.sb A 216.239.38.120"
local-data: "www.google.sc A 216.239.38.120"
local-data: "www.google.se A 216.239.38.120"
local-data: "www.google.com.sg A 216.239.38.120"
local-data: "www.google.sh A 216.239.38.120"
local-data: "www.google.si A 216.239.38.120"
local-data: "www.google.sk A 216.239.38.120"
local-data: "www.google.com.sl A 216.239.38.120"
local-data: "www.google.sn A 216.239.38.120"
local-data: "www.google.so A 216.239.38.120"
local-data: "www.google.sm A 216.239.38.120"
local-data: "www.google.sr A 216.239.38.120"
local-data: "www.google.st A 216.239.38.120"
local-data: "www.google.com.sv A 216.239.38.120"
local-data: "www.google.td A 216.239.38.120"
local-data: "www.google.tg A 216.239.38.120"
local-data: "www.google.co.th A 216.239.38.120"
local-data: "www.google.com.tj A 216.239.38.120"
local-data: "www.google.tk A 216.239.38.120"
local-data: "www.google.tl A 216.239.38.120"
local-data: "www.google.tm A 216.239.38.120"
local-data: "www.google.tn A 216.239.38.120"
local-data: "www.google.to A 216.239.38.120"
local-data: "www.google.com.tr A 216.239.38.120"
local-data: "www.google.tt A 216.239.38.120"
local-data: "www.google.com.tw A 216.239.38.120"
local-data: "www.google.co.tz A 216.239.38.120"
local-data: "www.google.com.ua A 216.239.38.120"
local-data: "www.google.co.ug A 216.239.38.120"
local-data: "www.google.co.uk A 216.239.38.120"
local-data: "www.google.com.uy A 216.239.38.120"
local-data: "www.google.co.uz A 216.239.38.120"
local-data: "www.google.com.vc A 216.239.38.120"
local-data: "www.google.co.ve A 216.239.38.120"
local-data: "www.google.vg A 216.239.38.120"
local-data: "www.google.co.vi A 216.239.38.120"
local-data: "www.google.com.vn A 216.239.38.120"
local-data: "www.google.vu A 216.239.38.120"
local-data: "www.google.ws A 216.239.38.120"
local-data: "www.google.rs A 216.239.38.120"
local-data: "www.google.co.za A 216.239.38.120"
local-data: "www.google.co.zm A 216.239.38.120"
local-data: "www.google.co.zw A 216.239.38.120"
local-data: "www.google.cat A 216.239.38.120"

                                                      Regards.

                                                      1 Reply Last reply Reply Quote 0
                                                      • A
                                                        aGeekhere last edited by

                                                        thanks

                                                        1 Reply Last reply Reply Quote 0
                                                        • First post
                                                          Last post

                                                        Products

                                                        • Platform Overview
                                                        • TNSR
                                                        • pfSense Plus
                                                        • Appliances

                                                        Services

                                                        • Training
                                                        • Professional Services

                                                        Support

                                                        • Subscription Plans
                                                        • Contact Support
                                                        • Product Lifecycle
                                                        • Documentation

                                                        News

                                                        • Media Coverage
                                                        • Press
                                                        • Events

                                                        Resources

                                                        • Blog
                                                        • FAQ
                                                        • Find a Partner
                                                        • Resource Library
                                                        • Security Information

                                                        Company

                                                        • About Us
                                                        • Careers
                                                        • Partners
                                                        • Contact Us
                                                        • Legal
                                                        Our Mission

                                                        We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

                                                        Subscribe to our Newsletter

                                                        Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

                                                        © 2021 Rubicon Communications, LLC | Privacy Policy