Comments on: New malware spotted that answers to DHCP-Requests to send clients to malicious DNS-servers http://blog.pfsense.org/?p=308 News, reviews and more related to the pfSense firewall project Sun, 19 May 2013 21:07:07 +0000 hourly 1 http://wordpress.org/?v=3.5.1 By: Chris Buechler http://blog.pfsense.org/?p=308&cpage=1#comment-3806 Chris Buechler Fri, 29 May 2009 20:48:58 +0000 http://blog.pfsense.org/?p=308#comment-3806 Sean: Disable IPv6.

]]> By: Sean McRobbie http://blog.pfsense.org/?p=308&cpage=1#comment-3805 Sean McRobbie Fri, 29 May 2009 20:17:09 +0000 http://blog.pfsense.org/?p=308#comment-3805 Appears to be one problem with the workaround…

I recently set up a test Windows 7 machine and joined it to my pfSense powered wifi hotspot.

Turns out everything worked as normal to a point… got the correct ipv4 IP, gateway and DNS server from DHCP, However….

Some other device on the wifi hotspot network has issued an ipv6 DNS server which the machine uses instead of the v4 server!

I see this as a *HUGE* security issue as someone can simply plug in a v6 device to the network which Windows 7 (and possiblyWindows Vista and others) will use out of the box!

Aside from the fact it is a security issue, it actually broke everything as far as captive portal is concerned because the captive portal hostname was of course not resolving correctly…

Any workaround for this?

]]> By: Chris Buechler http://blog.pfsense.org/?p=308&cpage=1#comment-2560 Chris Buechler Sat, 13 Dec 2008 18:41:33 +0000 http://blog.pfsense.org/?p=308#comment-2560 You do need to allow both TCP *and* UDP for DNS to work properly. Queries with large responses will be re-issued as TCP, so if you block TCP 53 some queries will fail.

]]> By: phil http://blog.pfsense.org/?p=308&cpage=1#comment-2557 phil Sat, 13 Dec 2008 12:59:12 +0000 http://blog.pfsense.org/?p=308#comment-2557 if you use the pfsense as dns-forwarder create a rule that grants access to the pfsense ip on port 53 udp is enough . You don’t need tcp.

only first rule with ie. enable udp dns(port 53) to 192.168.1.1 (let’s assume 192.168.1.1 is your lan0 IP@)

2nd rule reject tcp/udp dns(port 53) to any

]]> By: Slick http://blog.pfsense.org/?p=308&cpage=1#comment-2545 Slick Fri, 12 Dec 2008 15:57:46 +0000 http://blog.pfsense.org/?p=308#comment-2545 “somebody trying to do something they aren’t supposed to be doing”

Thats usually the case!

]]> By: Chris Buechler http://blog.pfsense.org/?p=308&cpage=1#comment-2533 Chris Buechler Fri, 12 Dec 2008 02:24:43 +0000 http://blog.pfsense.org/?p=308#comment-2533 Pete: that’s right on.

I’d leave the logging enabled on the block rule, I like logging what gets dropped egress because it typically indicates either a misconfiguration, compromised host, or somebody trying to do something they aren’t supposed to be doing.

]]> By: Pete Boyd http://blog.pfsense.org/?p=308&cpage=1#comment-2532 Pete Boyd Thu, 11 Dec 2008 19:33:39 +0000 http://blog.pfsense.org/?p=308#comment-2532 Thanks Chris. For completeness’ sake, here’s my updated config:

The rules must appear in the following order.

Allow outgoing DNS access by pfSense, or by a dedicated DNS server (whichever you use)
Action: Pass
Interface: LAN
Protocol: TCP/UDP
Source
- Type: Single host or alias
- Address: LAN IP of your pfSense, or of your stand-alone DNS server
Destination: any
Destination port range
- from: DNS
- to: DNS
Description: Allow outgoing DNS for our pfSense DNS forwarder

On LAN interface block all DNS traffic to any network
Action: Block
Interface: LAN
Protocol: TCP/UDP
Destination: any
Destination port range
- from: DNS
- to: DNS
Log: Log packets that are handled by this rule – for short-term testing so as to find out who might mistakenly have an external DNS set, or picked up a rogue DNS
Description: Block outgoing DNS in case of rogue DNS servers

]]> By: Chris Buechler http://blog.pfsense.org/?p=308&cpage=1#comment-2531 Chris Buechler Thu, 11 Dec 2008 16:34:21 +0000 http://blog.pfsense.org/?p=308#comment-2531 The destination in that rule must be “any”, not “WAN IP address”. All you’re doing there is blocking DNS traffic destined to your WAN IP, which isn’t what you want to do.

The pass rules must come before any matching block rules. If that block rule were setup correctly you would have been dropping all DNS traffic if it weren’t passed first.

]]> By: Pete Boyd http://blog.pfsense.org/?p=308&cpage=1#comment-2528 Pete Boyd Thu, 11 Dec 2008 09:36:50 +0000 http://blog.pfsense.org/?p=308#comment-2528 I found the wording above of “A way to prevent this using pfsense..” not easy to understand, so here’s the translation I did for myself, for anyone else having difficulty with it:

* On LAN interface block all DNS traffic to WAN

Action: Block
Interface: LAN
Protocol: TCP/UDP
Destination: WAN address
Destination port range
from: DNS
to: DNS
Log: Log packets that are handled by this rule – for short-term testing so as to find out who might mistakenly have an external DNS set, or picked up a rogue DNS
Description: Block outgoing DNS in case of rogue DNS servers

* Allow outgoing DNS access by pfSense, or by a dedicated DNS server (whichever you use)

Action: Pass
Interface: LAN
Protocol: TCP/UDP
Source
Type: Single host or alias
Address: LAN IP of your pfSense, or of your stand-alone DNS server
Destination: WAN address
Destination port range
from: DNS
to: DNS
Description: allow outgoing DNS for our pfSense DNS forwarder

The firewall rules page says the order matters, which to me would mean the pass rule needs to go above the block rule, but in practice this doesn’t appear necessary. Maybe someone can correct me if I’m wrong.

]]> By: Slick http://blog.pfsense.org/?p=308&cpage=1#comment-2525 Slick Thu, 11 Dec 2008 01:48:59 +0000 http://blog.pfsense.org/?p=308#comment-2525 At the mortgage company I administrate the network for. I have 53 blocked for everything but OPENDNS and internal. All other DNS servers are blocked. I actually didnt do it for this reason, I actually did it for content filtering purposes. However, its nice to know that Im already protected against this as well.

]]>