Host Overrides for forced safe search stopped working on 2.3 [solved]
-
Hi, after upgrading to 2.3 my forced google safe search has stopped working.
In DNS Resolver Host Overrides my setup isHost Domain IP www google.com.au 216.239.38.120 googlesafe
Anyone else have this issue?
-
anyone else have this issue?
-
when you ping google or do a dns query for www.google.com.au what IP do you get back.. if you get back that IP, then host override is working. If you are getting results that are not "safe" then that is on google not host overrides, all a host override does is return a specific IP when asked for a specific name.
And what I can tell you is that is working just fine in 2.3.
-
when you ping google or do a dns query for www.google.com.au what IP do you get back
It is not going to host overrides 216.239.38.120 but direct to google unsafe.
And what I can tell you is that is working just fine in 2.3
Was working fine for me in 2.2.6 after updating to 2.3 it stopped so I am a bit puzzled, how can I troubleshoot this issue?
-
dude when you query pfsense for that record do you get back that IP?? If so then host override is working..
Be it your safesearch is working or not has nothing to do with the host override working..
So when I query www.google.com.au normally I get this
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.google.com.au. IN A;; ANSWER SECTION:
www.google.com.au. 300 IN A 64.233.177.94When I create an override it returns what I put in the override = host override working.. Are you saying that is not working? Please show your override and your query to pfsense where this is not the case..
-
pinging www.google.com
Pinging www.google.com [216.58.199.36] with 32 bytes of data: Reply from 216.58.199.36: bytes=32 time=23ms TTL=55 Reply from 216.58.199.36: bytes=32 time=74ms TTL=55 Reply from 216.58.199.36: bytes=32 time=21ms TTL=55 Reply from 216.58.199.36: bytes=32 time=21ms TTL=55 Ping statistics for 216.58.199.36: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 21ms, Maximum = 74ms, Average = 34ms
nslookup www.google.com
nslookup www.google.com Non-authoritative answer: Name: www.google.com Addresses: 2404:6800:4006:803::2004 216.58.199.36
DNS Resolver Host Overrides
see attachmentGoogle is not showing that safe search is enabled (because it is not going to 216.239.38.120) so the Host Overrides has stopped working for me after the update.
-
and your host override is for www.google.com.au, and your pinging www.google.com so yeah not going to to return the IP you put in the override..
Ah So you have both ok… Where are you doing your query too, clearly its not pfsense.. Your nslook doesn't show what server you asked..
-
here it is
nslookup www.google.com Server: pfsense.myDomain.local Address: 192.168.1.1 Non-authoritative answer: Name: www.google.com Addresses: 2404:6800:4006:803::2004 216.58.199.36
-
Well you sure you have your host override in the right place?? Seen this quite often users put override in forwarder section and running resolver, or have in resolver and using forwarder..
What I can tell you is that I am using the resolver on 2.3 and have lots and lots of overrides and all working just fine.. I would validate what is running on pfsense and its setup.. And that you have the overrides in the correct place.
-
Well it was working before the update so if I had it miss configured then it would have never work.
I will go over my setup tomorrow to see if i can find anything that might have changed during the update.By the way did you do an upgrade or fresh install?
-
I did an upgrade from 2.2.6 to snapshots before 2.3 actually released when they were on the RCs and then to the final 2.3 when that came out.
I had no issues with anything in the transition from 2.2 to 2.3 all my packages worked, my vpn worked.. It was smooth as you would expect from the pfsense team.. I did have a bit of an issue with it trying to continue on to the 2.3.1 dev line… So had to change that setting.
So how many overrides do you have? create a new test one - does that work.. If not then yeah you got something borked up..
-
So how many overrides do you have?
For now the ones I have shown.
create a new test one - does that work
Sorry to say no
If not then yeah you got something borked up
Looks to be the case, I see no errors in the logs saying something is wrong in the DNS resolver. I guess I could wait for 2.3.1 and see if that fixes anything as I do not want to reinstall pfsense at this time.
-
Are you even sure resolver is running?? Maybe you have the forwarder running.. Sorry to sound like I am treating you like a moron.. But normally that is the case around here..
If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place. Or your not even doing a query to pfsense..
-
Are you even sure resolver is running??
DNS Resolver is runing
Maybe you have the forwarder running
I do have the forwarder running for the WPAD, but i never had any issue with that before see attachment
Sorry to sound like I am treating you like a moron.. But normally that is the case around here.
I hope that I am not making a moron of a mistake but it was all working perfectly before the update, when the update finished I notice straight away that the Host Overrides stopped working.
If you saying no overrides work, then the first thing that comes to mind is your putting in the the wrong place. Or your not even doing a query to pfsense..
See attachments
-
Huh???
What is the point of forwarding anything to 53 to 53?? How about you turn off that and the forwarder and make sure resolver is working.. Which you don't even have doing dnssec so what is the point of it? Why do you think you need forwarder running for wpad?? On the proxy port?
When are you going to query the resolver?
-
Fixed it by Diagnostics\States\States Reset States
Would have thought restarting the router would have done that, anyway.
I also Enabled DNSSEC Support.
What is the point of forwarding anything to 53 to 53?? How about you turn off that and the forwarder and make sure resolver is working.. Which you don't even have doing dnssec so what is the point of it? Why do you think you need forwarder running for wpad?? On the proxy port?
When are you going to query the resolver?
Well it works now and i do not want to break anything by changing something, thanks for the help
-
What is the point of forwarding 53 to loopback, you want to make sure some that does a query to 53 to something outside is redirected to pfsense??
And your forwarder is running on 3128 so when is that queried??
Break something - break what a pointless configuration?
-
http://resources.infosecinstitute.com/hacking-clients-wpad-web-proxy-auto-discovery-protocol/
-
What does that have to do with running forwarder on 3128?? Yeah you can create a entry for wpad.yourdomain.tld to point to where the autoconfiguration script is.. What does that have to do with forwarder listening on 3128?? Which would be the same port your proxy is listening on normally??
-
Ok just had a look I needed to use a port other than 53 because Resolver was using that port and when I was trying different methods to get the wpad working i tried the proxy port and it worked however I just changed the DNS Forwarder to something else and it also works fine.
So yeah there is no need to point the DNS Forwarder to the proxy port (just need to pick an unused one) learn something new everyday.