Using pfSense with a L3 core switch

[Christos]

I switched today from DNS forwarding to DNS resolver.

DNS resolver seems faster and more reliable. I've been using unbound in this mode for the past 3-4 months and don't plan to change it.

 

[coxhaus]

Yes, but there was a bug so I switched to DNS Forwarding which was patched in version 24.03. So now I switched back.

Unbound - CVE-2023-50387 and CVE-2023-50868

Was just reading about CVE-2023-50387 which seems to affect all DNS resolvers that support DNSSec. It seems NLnetlabs has released an Unbound patch today. ht...

forum.netgate.com

 

[ddaenen1]

I haven't made the upgrade yet. Waiting for a suitable slot at home.

 

[coxhaus]

Yes, my wife went on a trip with her best friend so I had plenty of time to test but it turns out I did not need it. I was up and running in under 10 minutes. It was probably faster but I forgot I had to log in again as it kept telling me it was not ready so I waited.
I tried my monitor but it would not sync as it has been turned off too long. It takes a reboot to sync the monitor and of course you cannot reboot during an upgrade. Next time I will have the monitor working before I upgrade. Just so I can watch the progress.

 

[ddaenen1]

Upgraded today to 24.03. Pretty uneventful. Interface seems a bit snappier though and i also have the impression that the HAproxy pass-through is a bit faster. Had a small issue with accessing my cloud-server but it seems an entry i had to change with a previous upgrade needed to go back to the original setting.

 

[coxhaus]

So, I came across these settings. I am trying them. Except I don't run pfblocker. I have an ACL to allow only QUAD9 DNS out. Any comment? I am not sure what enable Python would do for me if I don't run pfblocker.

This should help

System / General Setup

• DNS Servers: Provide resolvers of your choice
• DNS Resolution Behavior: Use local DNS (127.0.0.1), ignore remote DNS Servers

Services / DNS Forwarder

• Leave disabled

Services / DNS Resolver / General Settings

• Untick 'Enable DNSSEC Support'
• Tick 'Enable Python Module'
• Tick 'Enable Forwarding Mode'

Services / DNS Resolver / Advanced Settings

• Tick 'Query Name Minimization'
• Tick 'Prefetch Support'
• Tick 'Prefetch DNS Key Support'
• Untick 'Harden DNSSEC Data'

Firewall / pfBlockerNG / IP / IPv4

• Disable any lists you don't use (these can incur a significant performance hit)

Firewall / pfBlockerNG / IP / IPv6

• Disable any lists you don't use (these can incur a significant performance hit)

Firewall / pfBlockerNG / DNSBL

• Tick 'DNSBL Blocking'
• Tick 'CNAME Validation'

Firewall / pfBlockerNG / DNSBL / DNSBL

• Logging / Blocking Mode: Null Blocking (no logging) or Null Blocking (logging)