Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== PFSense - DNS - Force DNS over TLS ======

DNS requests are normally not encrypted, and therefore visible to your ISP to record, use for research / marketing purposes, or even (in the case of some nefarious actors) manipulate or change.

Running DNS over TLS prevents that, by encrypting your DNS traffic so that it cannot be manipulated or collected.

<WRAP important>
**WARNING:**  DNS over TLS will increase latency for DNS lookups due to SSL handshakes.

However this is only for the first query.  After that the session is reused due to caching.

Reason for this is that TLS takes longer.

To prevent this increase in latency, switch to standard port 53.
</WRAP>

----

Navigate to **Services -> DNS Resolver**.

Add the following to the **Custom Options**. 

<code bash>
server:
    access-control-view: 192.168.10.0/24 bypass
    access-control-view: 192.168.20.0/24 dnsbl
    access-control-view: 192.168.30.0/24 forward
    access-control-view: 192.168.40.0/24 tls
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
    include: /var/unbound/pfb_dnsbl.*conf
view:
    name: "forward"
    view-first: yes
    forward-addr: 1.1.1.1
    forward-addr: 8.8.8.8
view:
    name: "tls"
    view-first: yes
    tls-cert-bundle: /etc/ssl/certs/ca-certificates.crt
    forward-tls-upstream: yes
    forward-addr: 1.1.1.1@853#cloudflare-dns.com
    forward-addr: 1.1.1.1
</code>

<WRAP info>
**NOTE:**  To use **DNS over TLS**, you will need:

  * to specify **tls-cert-bundle** option that points to the local system's root certificate authority bundle.
  * allow unbound to forward TLS requests; **forward-tls-upstream: yes**.
  * specify any number of servers that allow DNS over TLS.

For each server you will need to specify that the connection port using **@**, and you will also need to indicate which is its domain name with **#**.

  * Even though it looks like an comment the hashtag name allows for the TLS authentication name to be set for stub-zones and with unbound-control forward control command.
  * There should not be any spaces between the @ and # markups.
</WRAP>




----

===== Another Example =====

Navigate to **Services -> DNS Resolver**

  * DNS Query Forwarding:  **Not Checked**.
  * Custom Options:  <code>
server:
  # Next line is needed only if pfBlockerNG is being used.
  include: /var/unbound/pfb_dnsbl.*conf
  ssl-upstream: yes
  do-tcp: yes
  forward-zone:
    name: "." 
    # Below 4 addresses are Cloudflare DNS.
    forward-addr: 1.1.1.1@853
    forward-addr: 1.0.0.1@853
    forward-addr: 2606:4700:4700::1111@853
    forward-addr: 2606:4700:4700::1001@853
    # Below 3 addresses are Quad9 DNS.
    forward-addr: 9.9.9.9@853
    forward-addr: 149.112.112.112@853
    forward-addr: 2620:fe::fe@853
</code>

<WRAP info>
**NOTE:**  See https://nlnetlabs.nl/documentation/unbound/unbound.conf/ for info on these options.

It is OK to set the resolver to listen on all interfaces, since the firewall rules on the WAN will prevent Internet hosts from using your resolver anyway.

</WRAP>

<WRAP important>
**WARNING:**  This will increase latency for DNS lookups due to SSL handshakes.

However this is only for the first query.  After that the session is reused due to caching.

Reason for this is that CloudFlare's 1.1.1.1 DNS service supports TLS on port 853.  TLS takes longer.  Same goes for Quad9's 9.9.9.9 DNS service.

To prevent this increase in latency, switch to standard port 53, or to an alternative DNS provider that does not use TLS for example:

<code>
server:
  #ssl-upstream: yes
  #do-tcp: yes
  forward-zone:
    name: "."
    # Below 4 addresses are Cloudflare DNS SSL.
#    forward-addr: 1.1.1.1@853
#    forward-addr: 1.0.0.1@853
#    forward-addr: 2606:4700:4700::1111@853
#    forward-addr: 2606:4700:4700::1001@853
    # Non TLS.
    forward-addr: 1.1.1.1@53
    forward-addr: 1.0.0.1@53
    forward-addr: 2606:4700:4700::1111@53
    forward-addr: 2606:4700:4700::1001@53
</code>

Try other settings as needed, for instance:

<code>
server:
  do-tcp: yes
  # Speed and privacy
  minimal-responses: yes
  prefetch: yes
  qname-minimisation: yes
  rrset-roundrobin: yes
  forward-zone:
    name: "."
    # To keep local overrides and avoid slow downs.
    forward-ssl-upstream: yes
    # Below addresses are Cloudflare DNS
    forward-addr: 1.1.1.1@853
    forward-addr: 1.0.0.1@853
    # forward-addr: 2606:4700:4700::1111@853
    # forward-addr: 2606:4700:4700::1001@853
</code>

<WRAP info>
**NOTE:**  Using **ssl-upstream** will cause all outgoing queries to use TLS, not just forwards, which could break Domain Overrides.

So using **forward-tls-upstream** instead inside the '.' zone which will only apply the TLS setting to that forwarding zone.
</WRAP>


Testing with Google Chrome was a bit upset at first, but a **<nowiki>chrome://net-internals/#dns</nowiki>** and **clear** fixed it.

Measured a few lookups with Chrome and the network inspector, and it looks like uncached lookups are taking about 50ms.  Without TLS the lookups run about 10ms.
</WRAP>


----

===== Test =====

==== Test using an internal DNS: ====

<code bash>
dig www.google.com @pfSense.localdomain
</code>

<WRAP info>
**NOTE:**   This should resolve against the DNS resolver on the router.

You can use use **Diagnostics -> Packet Capture**, and capture port 853 to verify that requests are being triggered.
</WRAP>

----

==== Test using an external DNS ====

Try and dig something against an IP that you know is not internal and is not a DNS server.  It should work, since the request will be NATted.  Something like;

<code bash>
dig www.google.com @8.8.8.8
</code>

Assuming that’s all fine, you should now be able to configure a broad block rule to bar all outbound port 53.

----

===== Block all outbound non-encrypted DNS =====

Navigate to **Firewall -> Rules**

On the **WAN** interface, define a new rule at the top of the list.  This rule should use these settings;

  * Action: **Block**.
  * Interface: **WAN**.
  * Address Family: **IPv4+IPv6**.
  * Protocol: **TCP/UDP**.
  * Source: **any**.
  * Destination: **any**.
  * Destination Port: **DNS (53)**.
  * Description: **Block outbound insecure DNS**.

Verify that you can still resolve against the local resolver (your router’s IP), and that you can still resolve against what seems to be external resolver (e.g, 8.8.8.8).

You should also check that when you do so that nothing passes on the WAN interface on port 53.

----

===== References =====

https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html

https://nlnetlabs.nl/documentation/unbound/

https://nlnetlabs.nl/documentation/unbound/unbound.conf/

https://www.reddit.com/r/PFSENSE/comments/897boi/dns_over_tls_for_1111/

https://redmine.pfsense.org/issues/8388