PfSense not forwarding DNS to concerned VPS

domain-name-systempfsense

We are running Xenserver hyper-visor and I created 5 VM and 1VM for pfSense so all VMs are in 172.16.0.0/24 range attached to pfSenese LAN interface. pfSense has two interfaces: LAN (172.16.0.100 as a gateway for all VMs) and WAN with Failover_IP (public IP).

I registered domains with our Failover_IP (public IP) and all of them are pinging. One of our domain is chineesmetal.com. This domain resides on our one of VPS that has hostname OracleLinux1.Onlinenics.net

Now I tried in pfSense as following:

  1. Services => DNS Forwarder
  2. Checked option Enable DNS forwarder & Register DHCP leases in DNS forwarder
  3. Services => DNS Forwarder => Advanced => address=/coldrol.com/172.16.0.1
  4. Services => DNS Forwarder =>Host Overrides and did the following:
    enter image description here
    but not forwarding with following error when I access chineesmetal.com in browser:

Potential DNS Rebind attack detected, see
http://en.wikipedia.org/wiki/DNS_rebinding
Try accessing the router by IP address instead
of by hostname.

I just removed BIND from pfSense and simply forwarded port 53 (DNS) to the concerned VPS and all domains on failover IP started working but my question is this for one vps on one specific IP its working but how pfSense will recognize other vps domains while ports are same on each server e.g. port 80, 8443, 25, 587 110 etc.

How to configure pfSense in this case?

please advise

Best Answer

This issue is very well documented in Pfsense with workaround: DNS Rebinding Protections

The DNS forwarder (dnsmasq) uses the option --stop-dns-rebind by default, which rejects and logs addresses from upstream nameservers which are in the private IP ranges. In the most common usage, this is filtering DNS responses received from the Internet to prevent DNS rebinding attacks. Internet DNS responses should never come back with a private IP, hence it's safest to block this.

There are some cases when public DNS servers have private IP address replies by default, though it is not recommended. In those cases, DNS rebinding can be disabled or an override may be placed in the DNS Forwarder Advanced Settings box as follows:

rebind-domain-ok=/mydomain.com/

Note this is automatically overridden for domains in the DNS forwarder's domain override list, as the most common usage of that functionality is to resolve internal DNS hostnames.

Related Topic