Messages

346

20.7 Legacy Series / Why does the firewall sometimes flag blocked packets that are actually allowed?

« on: November 25, 2020, 03:41:21 pm »

Hi,

Unsure why sometimes the firewall logs show that packets are blocked when I have a rule that allows these packets outbound (443 is allowed outbound from any source on my network, and indeed i can browse https sites )

I have attached a screenshot of an example. I have a rule that allows 443 outbound and am 100% sure it is working as this only happens very infrequently that I see these packets. I dont detect anything not working and can browse sites on https anytime without issue so am not clear what it is blocking.

Here is the detail of 1 of the packets in the below screenshot:

__timestamp__   Nov 25 09:27:05
ack   3986972122
action   [block]
anchorname   
datalen   1395
dir   [in]
dst   13.107.42.12
dstport   443
ecn   
id   0
interface   vtnet1
interface_name   lan
ipflags   DF
label   Default block LAN to any rule
length   1435
offset   0
proto   6
protoname   tcp
reason   match
rid   da7b834f8d727a70d52f48cc6b111da3
ridentifier   0
rulenr   324
seq   3973428692:3973430087
src   192.168.2.53
srcport   56922
subrulenr   
tcpflags   PA
tcpopts   
tos   0x0
ttl   64
urp   4096
version   4

347

General Discussion / Re: What's the correct way to set up local zone reverse lookup with Unbound?

« on: November 25, 2020, 03:28:13 pm »

Yup good luck thats the best way to learn, slowly add more and more as you find a need to do so and remove things that you thought you needed but found that actually you did not when experimenting on your home network

348

General Discussion / Re: What's the correct way to set up local zone reverse lookup with Unbound?

« on: November 25, 2020, 01:45:26 pm »

Yes the domain override is telling the unbound server where to go and query for that specific domain, in this case the domain is a ptr reverse lookup domain, so without the override unbound will simply query whatever is configured in your forwarders section or use root hints if you query that way, both which cannot provide an authoritative answer to your query of an internal record.

Edit : if you set your forwarder or dns server for opnsense to be pihole then it would work without an override but I would advise against such a setup as the firewall should be able to resolve dns without pihole working to ensure services that rely on dns (sensei etc) to function in the event of an outage with pihole or error and also because blocking these services from accessing domains by way of a filter may have undesirable effects. You should trust the firewall to not need filtering or alternatively use a product you do trust. The firewall should be able to sort itself out essentially without relying on a piece of internal equipment to be working perfectly.

Just fyi on my network I have opnsense unbound set to use 1.1.1.1 as a forwarder and an internal DNS server that client nodes use and provides dns filtering - that dns server gets its answers from unbound running on the opnsense. On opnsense I redirect any queries on port 53 using outbound nat to the internal dns server except for the source ip of the firewall and the ip of the internal dns server, so their queries do not get looped back. This means anyone changing their dns server to either the opnsense firewall or any external IP are silently having their requests directed back to the internal dns filter server. An alert is then flagged on my opnsense. Currently I have found it n my network a roku tv and an ip camera that had hardcoded dns servers trigger this alert. I also block outbound traffic to known doh servers. Currently the only app that has triggered an alert to try bypass dns filtering by querying hardcoded external doh servers is the app ‘tiktok’ which I then subsequently blocked all of bytedances servers on the dns level so the apps do not function.

Final thing I will say is that I dont agree with the general consensus that using 1.1.1 or some other public dns is a privacy concern if your alternative is to use toot hints with unbound. Or what I mean is using root hints does not solve the privacy concern imo. If you obscure your DNS and then turn right around to your ISP and say ‘please connect me to this IP’ then you have not solved the privacy issue and have simple made your dns queries take longer. For this reason I dont use root hints and use 1.1.1.1 which is very fast.

To obscure your traffic a vpn provider who does not log would be required but I dont know how to ensure that a vpn provider is actually doing what they say. For this reason I believe its better to simply know all you do on the internet is logged and there is no real privacy unless you are illegally compromising servers on the internet and proxying your traffic through them and clearing all the logs automatically yourself and somehow making sure you dint get caught. I dont see any solution as really viable in the real world so it seems better to me to simply understand that public internet = public space. People are allowed to look at what you do in public when you walk to the shops. Same on the internet.

349

General Discussion / Re: What's the correct way to set up local zone reverse lookup with Unbound?

« on: November 25, 2020, 03:01:48 am »

Thank you.

I setup a windows dns server and unbound to test on opnsense. I also had an issue until I found this option here :

Once I set to be able to forward queries out of the lan interface my opnsense running unbound could resolve ptr records for me by forwarding the query to the windows dns server and querying the ptr records.

Please double check your config as I believe I have confirmed it can work.

Pete

350

20.7 Legacy Series / Re: Spikes on recursive resolution average time in Unbound

« on: November 25, 2020, 02:29:12 am »

Hi @andrema2

Please read this document and in particular try the CPU optimisation and report back. Please specify how you added the optimisations in detail.

https://nlnetlabs.nl/documentation/unbound/howto-optimise/

Kind regards.

351

General Discussion / Re: What's the correct way to set up local zone reverse lookup with Unbound?

« on: November 24, 2020, 01:13:34 pm »

Hi,

I did not hear back regarding this. Please can you do the steps like the below screenshot against the dns server that you expect the ptr records to be held and let me know.

Example commands to type highlighted in yellow, expected answer example in red.

Kind regards,
P

352

General Discussion / Re: Is it normal for youtube to try bypass DNS now?

« on: November 23, 2020, 10:45:47 pm »

Just an update to this I have managed to locate the app that does this on the ipad. Its TikTok - I guess to a 10 year old youtube/tiktok is the same thing basically. It looks like it does DOH by default and cant be changed so it will simply attempt to connect out and bypass any dns filtering you have in place.

353

General Discussion / Is it normal for youtube(actually tiktok) to try bypass DNS now?

« on: November 23, 2020, 10:24:59 pm »

I have noticed on my firewall that today when one of my kids were playing on their ipads, (apparently watching youtube in safari - was not able to confirm this for sure but he is only 10 years old) that in my firewall logs, attempts to 8.8.8.8 from the Ipad over port 443 was attempted in bursts of 3 packets, then a delay of a few seconds, and then another burst of traffic etc multiple times for about 2 minutes.

Currently my firewall blocks traffic to known public DNS servers, so this was prevented and flagged on my firewall. I would imagine a DOH query occurred in an attempt to bypass by DNS filtering I use on my internal network at home. Is it possible that accessing youtube via safari could have done this, and that a webpage or advert attempted to bypass my DNS servers in order to circumvent the ad blocking I use? Or do you think something else caused this?

Kind regards
Peter

354

General Discussion / Re: What's the correct way to set up local zone reverse lookup with Unbound?

« on: November 21, 2020, 08:57:40 pm »

I have also tried, but not working. Still showing (reverse) IPs and a lot of PTR requests.

Are you saying you now see ptr requests from inbound now, on your dns server (pihole).

If so then unbound was correctly configured. If pihole does not reply with the correct reverse record answer then you must explain why pihole is unable to give the answer to the dns query when requested. This is similar to my post above asking that you check pihole can actually do this.

355

General Discussion / Re: What's the correct way to set up local zone reverse lookup with Unbound?

« on: November 21, 2020, 08:53:49 pm »

Please can you show me how you have tested that your dns server (pihole?) you are using in the override setting of unbound is able to reply with a ptr record? Eg: a screenshot from a client using nslookup against the dns server where the ptr records reside showing it give an authoritative answer to a requested ptr record.

356

General Discussion / Re: What's the correct way to set up local zone reverse lookup with Unbound?

« on: November 21, 2020, 05:44:19 am »

I havent tested this but I believe you would go to overrides and then add a domain override.

The domain to add would be something like:
1.168.192.in-addr.arpa

(this would specify 192.168.1.x)

and in the IP section you would put the DNS server for unbound to query eg: 192.168.1.20 (assuming that is IP of DNS server).

I would say that if you do this you should take care to ensure the firewall does not answer DNS queries to anyone other than on the local LAN or it would be possible to fingerprint devices behind your network and perform a nat pinning attack. You can ensure this is the case by making sure only LAN is selected for unbound to run on and ensuring 53 is not open on your firewall.

357

20.7 Legacy Series / Re: Need clarification on definitions used in nat rules.

« on: November 13, 2020, 10:53:21 pm »

Thank you.

358

20.7 Legacy Series / Need clarification on definitions used in nat rules.

« on: November 12, 2020, 06:12:12 pm »

Hi,

When creating a NAT rule in OpnSense you can select things like, LAN net (ie the /24 network for lan for example in my case) or LAN address (ie the IP address of OpnSense on the LAN interface).

One definition I am unsure of is the option 'This Firewall'.

What address or range of addresses is this? If I am choosing a destination address of 'this firewall' where is it going? Or If I choose a source address of 'This Firewall' what Ip's are included in this definition.

I tried looking it up in the documentation but could not find an answer. Thank you in advance.

Pete

359

20.7 Legacy Series / Re: 20.7.4 Success!! PPPoE?

« on: November 10, 2020, 01:29:09 am »

I guess I'm after a next-gen firewall and for almost free

Like allebone I pay for a Monthly Sensei sub and donate to OPNsense as I think the total package is amazing and easily worth these costs.
This solution covers my home setup which is relatively complicated as I work in IT and it changes on almost a daily basis... so the easy configuration and ability to adapt to my needs is excellent.
Ideally I would have modern Cyber Sec from my firewall including IPS (not IDS) and application-level inspection. Most users can now get this when using OPNsense with Sensei and Suricata, Hopefully netmap support will come for PPPoE for us other users

Any info on progress of this and how we can help if needed is what we are after.

@Franco I think you have answered this now as its basically unknown, not a priority currently and in the hands of the FreeBSD netmap Gods.

https://forum.opnsense.org/index.php?topic=17363.msg92433#msg92433

360

20.7 Legacy Series / Re: Call for testing: netmap on 20.7

« on: November 10, 2020, 01:28:08 am »

Hi @allebone,

tun(4) support is now in 20.7.4. It seems it's not working as expected for PPPoE. We're on it.

Thank you

@bunchofreeds