Bug #14624
closed
DNS Lookup tool doesn't respect 'DNS Resolution Behavior: Use local, ignore remote' when DoT is configured
0%
Description
When DoT is configured according to https://docs.netgate.com/pfsense/en/latest/recipes/dns-over-tls.html, the DNS Lookup tool in pfSense results in port 53 to be used in addition to 853 for anything provided in System > General Setup.
Steps to reproduce:
1. Fresh installation of 23.05.1, set up DoT according to the docs. I used 1.1.1.1 and hostname security.cloudflare-dns.com and 9.9.9.9 with dns.quad9.net. System > General Setup > Timezone is set to my local time zone.
https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-tls/
https://www.quad9.net/service/service-addresses-and-features/
2. Add a quick floating rule on WAN to reject outbound TCP/UDP from any source to any destination, any source port to destination port 53. Enabling logging on the rule.
3. Now resolve some public domains from Diagnostics > DNS lookup. The floating rule on WAN will catch and log those outbound UDP 53 connection attempts. Disabling the floating rule will result in states formed on the WAN (for both dst ports 53 and 853), and traffic visible on a packet capture.
I didn't observe this when using `dig` or `nslookup` from Diagnostics > Command Prompt, nor when resolving anything in a virtual machine behind pfSense, and nothing else generated by pfSense itself seems to do this (loading the package manager, forcing a pfSense update check, ping).
Updated by Chris W almost 2 years ago
Will also say that I'm unsure if this is of significance or just due to my lack of understanding on what the GUI is actually doing there, so I made it Private for now.
Updated by Chris W almost 2 years ago
- Subject changed from DNS Lookup tool doesn't respect "Use local, ignore remote" when DoT is configured to DNS Lookup tool doesn't respect 'DNS Resolution Behavior: Use local, ignore remote' when DoT is configured
Updated by Jim Pingle almost 2 years ago
- Project changed from pfSense Plus to pfSense
- Category changed from Administrivia to Administrivia
- Status changed from New to Not a Bug
- Private changed from Yes to No
That page uses several different techniques to function and some do not use the local resolver directly. For example, when probing the DNS server timing individually it uses drill. If it passed that query through the local resolver, it couldn't get the timing data.