4. Host Overrides for forced safe search stopped working on 2.3 [solved]

Host Overrides for forced safe search stopped working on 2.3 [solved]

  • A

    Hi, after upgrading to 2.3 my forced google safe search has stopped working.
    In DNS Resolver Host Overrides my setup is

    
Host             Domain                 IP                            
www            google.com.au	216.239.38.120	googlesafe

    Anyone else have this issue?

    0
  • A

    anyone else have this issue?

    0
  • LAYER 8 Global Moderator

    when you ping google or do a dns query for www.google.com.au what IP do you get back.. if you get back that IP, then host override is working.  If you are getting results that are not "safe" then that is on google not host overrides, all a host override does is return a specific IP when asked for a specific name.

    And what I can tell you is that is working just fine in 2.3.

    0
  • A

    when you ping google or do a dns query for www.google.com.au what IP do you get back

    It is not going to host overrides 216.239.38.120 but direct to google unsafe.

    And what I can tell you is that is working just fine in 2.3

    Was working fine for me in 2.2.6 after updating to 2.3 it stopped so I am a bit puzzled, how can I troubleshoot this issue?

    0
  • LAYER 8 Global Moderator

    dude when you query pfsense for that record do you get back that IP??  If so then host override is working..

    Be it your safesearch is working or not has nothing to do with the host override working..

    So when I query www.google.com.au normally I get this

    ;; OPT PSEUDOSECTION:
    ; EDNS: version: 0, flags:; udp: 4096
    ;; QUESTION SECTION:
    ;www.google.com.au.            IN      A

    ;; ANSWER SECTION:
    www.google.com.au.      300    IN      A      64.233.177.94

    When I create an override it returns what I put in the override = host override working.. Are you saying that is not working?  Please show your override and your query to pfsense where this is not the case..


    0
  • A

    pinging www.google.com

    Pinging www.google.com [216.58.199.36] with 32 bytes of data:
Reply from 216.58.199.36: bytes=32 time=23ms TTL=55
Reply from 216.58.199.36: bytes=32 time=74ms TTL=55
Reply from 216.58.199.36: bytes=32 time=21ms TTL=55
Reply from 216.58.199.36: bytes=32 time=21ms TTL=55

Ping statistics for 216.58.199.36:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 21ms, Maximum = 74ms, Average = 34ms

    nslookup www.google.com

    nslookup www.google.com
Non-authoritative answer:
Name:    www.google.com
Addresses:  2404:6800:4006:803::2004
          216.58.199.36

    DNS Resolver Host Overrides
    see attachment

    Google is not showing that safe search is enabled (because it is not going to 216.239.38.120) so the Host Overrides has stopped working for me after the update.


    0
  • LAYER 8 Global Moderator

    and your host override is for www.google.com.au, and your pinging www.google.com so yeah not going to to return the IP you put in the override..

    Ah So you have both ok…  Where are you doing your query too, clearly its not pfsense..  Your nslook doesn't show what server you asked..


    0
  • A

    here it is

    nslookup www.google.com
Server:  pfsense.myDomain.local
Address:  192.168.1.1

Non-authoritative answer:
Name:    www.google.com
Addresses:  2404:6800:4006:803::2004
          216.58.199.36
    0
  • LAYER 8 Global Moderator

    Well you sure you have your host override in the right place??  Seen this quite often users put override in forwarder section and running resolver, or have in resolver and using forwarder..

    What I can tell you is that I am using the resolver on 2.3 and have lots and lots of overrides and all working just fine..  I would validate what is running on pfsense and its setup..  And that you have the overrides in the correct place.

    0
  • A

    Well it was working before the update so if I had it miss configured then it would have never work.
    I will go over my setup tomorrow to see if i can find anything that might have changed during the update.

    By the way did you do an upgrade or fresh install?

    0
  • LAYER 8 Global Moderator

    I did an upgrade from 2.2.6 to snapshots before 2.3 actually released when they were on the RCs and then to the final 2.3 when that came out.

    I had no issues with anything in the transition from 2.2 to 2.3 all my packages worked, my vpn worked.. It was smooth as you would expect from the pfsense team.. I did have a bit of an issue with it trying to continue on to the 2.3.1 dev line…  So had to change that setting.

    So how many overrides do you have?  create a new test one - does that work..  If not then yeah you got something borked up..


    0
  • A

    So how many overrides do you have?

    For now the ones I have shown.

    create a new test one - does that work

    Sorry to say no

    If not then yeah you got something borked up

    Looks to be the case, I see no errors in the logs saying something is wrong in the DNS resolver. I guess I could wait for 2.3.1 and see if that fixes anything as I do not want to reinstall pfsense at this time.

    0
  • LAYER 8 Global Moderator

    Are you even sure resolver is running??  Maybe you have the forwarder running..  Sorry to sound like I am treating you like a moron..  But normally that is the case around here..

    If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place.  Or your not even doing a query to pfsense..

    0
  • A

    Are you even sure resolver is running??

    DNS Resolver is runing

    Maybe you have the forwarder running

    I do have the forwarder running for the WPAD, but i never had any issue with that before see attachment

    Sorry to sound like I am treating you like a moron..  But normally that is the case around here.

    I hope that I am not making a moron of a mistake but it was all working perfectly before the update, when the update finished I notice straight away that the Host Overrides stopped working.

    If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place.  Or your not even doing a query to pfsense..

    See attachments






    0
  • LAYER 8 Global Moderator

    Huh???

    What is the point of forwarding anything to 53 to 53??  How about you turn off that and the forwarder and make sure resolver is working..  Which you don't even have doing dnssec so what is the point of it?  Why do you think you need forwarder running for wpad??  On the proxy port?

    When are you going to query the resolver?

    0
  • A

    Fixed it by Diagnostics\States\States Reset States

    Would have thought restarting the router would have done that, anyway.

    I also Enabled DNSSEC Support.

    What is the point of forwarding anything to 53 to 53??  How about you turn off that and the forwarder and make sure resolver is working..  Which you don't even have doing dnssec so what is the point of it?  Why do you think you need forwarder running for wpad??  On the proxy port?

    When are you going to query the resolver?

    Well it works now and i do not want to break anything by changing something, thanks for the help

    0
  • LAYER 8 Global Moderator

    What is the point of forwarding 53 to loopback, you want to make sure some that does a query to 53 to something outside is redirected to pfsense??

    And your forwarder is running on 3128 so when is that queried??

    Break something - break what a pointless configuration?

    0
  • A

    http://resources.infosecinstitute.com/hacking-clients-wpad-web-proxy-auto-discovery-protocol/

    0
  • LAYER 8 Global Moderator

    What does that have to do with running forwarder on 3128??  Yeah you can create a entry for wpad.yourdomain.tld to point to where the autoconfiguration script is..  What does that have to do with forwarder listening on 3128??  Which would be the same port your proxy is listening on normally??

    0
  • A

    Ok just had a look I needed to use a port other than 53 because Resolver was using that port and when I was trying different methods to get the wpad working i tried the proxy port and it worked however I just changed the DNS Forwarder to something else and it also works fine.

    So yeah there is no need to point the DNS Forwarder to the proxy port (just need to pick an unused one) learn something new everyday.

    0
  • LAYER 8 Global Moderator

    Not sure how you think that is working??  What do you think is doing a query to the forwarder for wpad??

    Do you have some other redirection going on?  Why do you need the forwarder?  Why would you not just create a entry in resolver?  You have a redirect to loopback.. What what is listing on loopback the forwarder or the resolver?

    I am really confused what you think that is doing?  And why you need both forwarder and resolver?

    0
  • A

    Why do you need the forwarder?  Why would you not just create a entry in resolver

    I just tried using the the resolver for the wpad and it seems to be working so no I do not need the forwarder. I used the forwarder because I will following a tutorial when i set up the wpad. As far as the loopback be selected I was just testing something with it, disabled it now.

    Thanks for the help

    0
  • J

    Hello.

    I use DNS resolver (unbound) for set Force Safe Search Google, for all google domains, and works fine for my pfSense 2.3:

    I have the list (forecegoogle.conf)  with domain overrides for google
    https://www.javcasta.com/configuracion-avanzada-forcesafesearchgoogle-con-pfsense/

    Services > DNS Resolver
    Host Overrides:
    forcesafesearch.google.com  216.239.38.120 
    www.google.com  216.239.38.120
    www.google.es  216.239.38.120

    Advanced
    server:
    include: /var/unbound/forecegoogle.conf

    Regards

    0
  • A

    there is an issue with selecting the google domains

    local-data: "www.google.ad A 216.239.38.120"
    local-data: "www.google.ae A 216.239.38.120"
    local-data: "www.google.com.af A 216.239.38.120"
    local-data: "www.google.com.ag A 216.239.38.120"

    That is all I can select.

    0
  • J

    Hello.

    Services > DNS Resolver
    Host Overrides:
    forcesafesearch.google.com  216.239.38.120 
    www.google.com  216.239.38.120
    www.google.es  216.239.38.120

    Advanced
    server:
    include: /var/unbound/forecegoogle.conf

    This is the /var/unbound/forecegoogle.conf file (except for www.google.com and www.google.es, that are defined directly in host overrides)

    local-data: "www.google.ad A 216.239.38.120"
local-data: "www.google.ae A 216.239.38.120"
local-data: "www.google.com.af A 216.239.38.120"
local-data: "www.google.com.ag A 216.239.38.120"
local-data: "www.google.com.ai A 216.239.38.120"
local-data: "www.google.al A 216.239.38.120"
local-data: "www.google.am A 216.239.38.120"
local-data: "www.google.co.ao A 216.239.38.120"
local-data: "www.google.com.ar A 216.239.38.120"
local-data: "www.google.as A 216.239.38.120"
local-data: "www.google.at A 216.239.38.120"
local-data: "www.google.com.au A 216.239.38.120"
local-data: "www.google.az A 216.239.38.120"
local-data: "www.google.ba A 216.239.38.120"
local-data: "www.google.com.bd A 216.239.38.120"
local-data: "www.google.be A 216.239.38.120"
local-data: "www.google.bf A 216.239.38.120"
local-data: "www.google.bg A 216.239.38.120"
local-data: "www.google.com.bh A 216.239.38.120"
local-data: "www.google.bi A 216.239.38.120"
local-data: "www.google.bj A 216.239.38.120"
local-data: "www.google.com.bn A 216.239.38.120"
local-data: "www.google.com.bo A 216.239.38.120"
local-data: "www.google.com.br A 216.239.38.120"
local-data: "www.google.bs A 216.239.38.120"
local-data: "www.google.bt A 216.239.38.120"
local-data: "www.google.co.bw A 216.239.38.120"
local-data: "www.google.by A 216.239.38.120"
local-data: "www.google.com.bz A 216.239.38.120"
local-data: "www.google.ca A 216.239.38.120"
local-data: "www.google.cd A 216.239.38.120"
local-data: "www.google.cf A 216.239.38.120"
local-data: "www.google.cg A 216.239.38.120"
local-data: "www.google.ch A 216.239.38.120"
local-data: "www.google.ci A 216.239.38.120"
local-data: "www.google.co.ck A 216.239.38.120"
local-data: "www.google.cl A 216.239.38.120"
local-data: "www.google.cm A 216.239.38.120"
local-data: "www.google.cn A 216.239.38.120"
local-data: "www.google.com.co A 216.239.38.120"
local-data: "www.google.co.cr A 216.239.38.120"
local-data: "www.google.com.cu A 216.239.38.120"
local-data: "www.google.cv A 216.239.38.120"
local-data: "www.google.com.cy A 216.239.38.120"
local-data: "www.google.cz A 216.239.38.120"
local-data: "www.google.de A 216.239.38.120"
local-data: "www.google.dj A 216.239.38.120"
local-data: "www.google.dk A 216.239.38.120"
local-data: "www.google.dm A 216.239.38.120"
local-data: "www.google.com.do A 216.239.38.120"
local-data: "www.google.dz A 216.239.38.120"
local-data: "www.google.com.ec A 216.239.38.120"
local-data: "www.google.ee A 216.239.38.120"
local-data: "www.google.com.eg A 216.239.38.120"
local-data: "www.google.com.et A 216.239.38.120"
local-data: "www.google.fi A 216.239.38.120"
local-data: "www.google.com.fj A 216.239.38.120"
local-data: "www.google.fm A 216.239.38.120"
local-data: "www.google.fr A 216.239.38.120"
local-data: "www.google.ga A 216.239.38.120"
local-data: "www.google.ge A 216.239.38.120"
local-data: "www.google.gg A 216.239.38.120"
local-data: "www.google.com.gh A 216.239.38.120"
local-data: "www.google.com.gi A 216.239.38.120"
local-data: "www.google.gl A 216.239.38.120"
local-data: "www.google.gm A 216.239.38.120"
local-data: "www.google.gp A 216.239.38.120"
local-data: "www.google.gr A 216.239.38.120"
local-data: "www.google.com.gt A 216.239.38.120"
local-data: "www.google.gy A 216.239.38.120"
local-data: "www.google.com.hk A 216.239.38.120"
local-data: "www.google.hn A 216.239.38.120"
local-data: "www.google.hr A 216.239.38.120"
local-data: "www.google.ht A 216.239.38.120"
local-data: "www.google.hu A 216.239.38.120"
local-data: "www.google.co.id A 216.239.38.120"
local-data: "www.google.ie A 216.239.38.120"
local-data: "www.google.co.il A 216.239.38.120"
local-data: "www.google.im A 216.239.38.120"
local-data: "www.google.co.in A 216.239.38.120"
local-data: "www.google.iq A 216.239.38.120"
local-data: "www.google.is A 216.239.38.120"
local-data: "www.google.it A 216.239.38.120"
local-data: "www.google.je A 216.239.38.120"
local-data: "www.google.com.jm A 216.239.38.120"
local-data: "www.google.jo A 216.239.38.120"
local-data: "www.google.co.jp A 216.239.38.120"
local-data: "www.google.co.ke A 216.239.38.120"
local-data: "www.google.com.kh A 216.239.38.120"
local-data: "www.google.ki A 216.239.38.120"
local-data: "www.google.kg A 216.239.38.120"
local-data: "www.google.co.kr A 216.239.38.120"
local-data: "www.google.com.kw A 216.239.38.120"
local-data: "www.google.kz A 216.239.38.120"
local-data: "www.google.la A 216.239.38.120"
local-data: "www.google.com.lb A 216.239.38.120"
local-data: "www.google.li A 216.239.38.120"
local-data: "www.google.lk A 216.239.38.120"
local-data: "www.google.co.ls A 216.239.38.120"
local-data: "www.google.lt A 216.239.38.120"
local-data: "www.google.lu A 216.239.38.120"
local-data: "www.google.lv A 216.239.38.120"
local-data: "www.google.com.ly A 216.239.38.120"
local-data: "www.google.co.ma A 216.239.38.120"
local-data: "www.google.md A 216.239.38.120"
local-data: "www.google.me A 216.239.38.120"
local-data: "www.google.mg A 216.239.38.120"
local-data: "www.google.mk A 216.239.38.120"
local-data: "www.google.ml A 216.239.38.120"
local-data: "www.google.com.mm A 216.239.38.120"
local-data: "www.google.mn A 216.239.38.120"
local-data: "www.google.ms A 216.239.38.120"
local-data: "www.google.com.mt A 216.239.38.120"
local-data: "www.google.mu A 216.239.38.120"
local-data: "www.google.mv A 216.239.38.120"
local-data: "www.google.mw A 216.239.38.120"
local-data: "www.google.com.mx A 216.239.38.120"
local-data: "www.google.com.my A 216.239.38.120"
local-data: "www.google.co.mz A 216.239.38.120"
local-data: "www.google.com.na A 216.239.38.120"
local-data: "www.google.com.nf A 216.239.38.120"
local-data: "www.google.com.ng A 216.239.38.120"
local-data: "www.google.com.ni A 216.239.38.120"
local-data: "www.google.ne A 216.239.38.120"
local-data: "www.google.nl A 216.239.38.120"
local-data: "www.google.no A 216.239.38.120"
local-data: "www.google.com.np A 216.239.38.120"
local-data: "www.google.nr A 216.239.38.120"
local-data: "www.google.nu A 216.239.38.120"
local-data: "www.google.co.nz A 216.239.38.120"
local-data: "www.google.com.om A 216.239.38.120"
local-data: "www.google.com.pa A 216.239.38.120"
local-data: "www.google.com.pe A 216.239.38.120"
local-data: "www.google.com.pg A 216.239.38.120"
local-data: "www.google.com.ph A 216.239.38.120"
local-data: "www.google.com.pk A 216.239.38.120"
local-data: "www.google.pl A 216.239.38.120"
local-data: "www.google.pn A 216.239.38.120"
local-data: "www.google.com.pr A 216.239.38.120"
local-data: "www.google.ps A 216.239.38.120"
local-data: "www.google.pt A 216.239.38.120"
local-data: "www.google.com.py A 216.239.38.120"
local-data: "www.google.com.qa A 216.239.38.120"
local-data: "www.google.ro A 216.239.38.120"
local-data: "www.google.ru A 216.239.38.120"
local-data: "www.google.rw A 216.239.38.120"
local-data: "www.google.com.sa A 216.239.38.120"
local-data: "www.google.com.sb A 216.239.38.120"
local-data: "www.google.sc A 216.239.38.120"
local-data: "www.google.se A 216.239.38.120"
local-data: "www.google.com.sg A 216.239.38.120"
local-data: "www.google.sh A 216.239.38.120"
local-data: "www.google.si A 216.239.38.120"
local-data: "www.google.sk A 216.239.38.120"
local-data: "www.google.com.sl A 216.239.38.120"
local-data: "www.google.sn A 216.239.38.120"
local-data: "www.google.so A 216.239.38.120"
local-data: "www.google.sm A 216.239.38.120"
local-data: "www.google.sr A 216.239.38.120"
local-data: "www.google.st A 216.239.38.120"
local-data: "www.google.com.sv A 216.239.38.120"
local-data: "www.google.td A 216.239.38.120"
local-data: "www.google.tg A 216.239.38.120"
local-data: "www.google.co.th A 216.239.38.120"
local-data: "www.google.com.tj A 216.239.38.120"
local-data: "www.google.tk A 216.239.38.120"
local-data: "www.google.tl A 216.239.38.120"
local-data: "www.google.tm A 216.239.38.120"
local-data: "www.google.tn A 216.239.38.120"
local-data: "www.google.to A 216.239.38.120"
local-data: "www.google.com.tr A 216.239.38.120"
local-data: "www.google.tt A 216.239.38.120"
local-data: "www.google.com.tw A 216.239.38.120"
local-data: "www.google.co.tz A 216.239.38.120"
local-data: "www.google.com.ua A 216.239.38.120"
local-data: "www.google.co.ug A 216.239.38.120"
local-data: "www.google.co.uk A 216.239.38.120"
local-data: "www.google.com.uy A 216.239.38.120"
local-data: "www.google.co.uz A 216.239.38.120"
local-data: "www.google.com.vc A 216.239.38.120"
local-data: "www.google.co.ve A 216.239.38.120"
local-data: "www.google.vg A 216.239.38.120"
local-data: "www.google.co.vi A 216.239.38.120"
local-data: "www.google.com.vn A 216.239.38.120"
local-data: "www.google.vu A 216.239.38.120"
local-data: "www.google.ws A 216.239.38.120"
local-data: "www.google.rs A 216.239.38.120"
local-data: "www.google.co.za A 216.239.38.120"
local-data: "www.google.co.zm A 216.239.38.120"
local-data: "www.google.co.zw A 216.239.38.120"
local-data: "www.google.cat A 216.239.38.120"

    Regards.

    0
  • A

    thanks

    0
Log in to reply
 

Products

Services

Support

News

Resources

Company

Our Mission

We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

Subscribe to our Newsletter

Product information, software announcements, and special offers. See our newsletter archive for past announcements.

© Copyright 2002 - 2019 Rubicon Communications, LLC | Privacy Policy