Using pfSense with a L3 core switch

[coxhaus]

Is this really still a thing right now? If so, I'll be changing over to google instantly.

Why not use QUAD9 and let it do domain management? It should stay current on the bad domains out there.
QUAD9 works great for me.

 

[ddaenen1]

Why not use QUAD9 and let it do domain management? It should stay current on the bad domains out there.
QUAD9 works great for me.

I am going to give it a go. Quad9 is apparently Swiss so how bad can it be. I just updated my DNS settings in pfSense using THIS guide on the Quad9 website. Not sure if i can really test if there is any difference though. Let's see how that goes.

 

[ddaenen1]

I am going to give it a go. Quad9 is apparently Swiss so how bad can it be. I just updated my DNS settings in pfSense using THIS guide on the Quad9 website. Not sure if i can really test if there is any difference though. Let's see how that goes.

I got rid of the Quad9 DNS in pfSense yesterday. I noticed it was blocking off a couple of websites that i occasionally use and i can't have that.

 

[sfx2000]

I got rid of the Quad9 DNS in pfSense yesterday. I noticed it was blocking off a couple of websites that i occasionally use and i can't have that.

Yeah, blocking pornhub and xhamster can be a challenge, eh?

LOL

 

[sfx2000]

Yeah, blocking pornhub and xhamster can be a challenge, eh?

LOL

And apologies - you kind of set that one up...

Both of those sites have actually been aggressively hit due to legislative actions in many areas...

 

[Christos]

I got rid of the Quad9 DNS in pfSense yesterday. I noticed it was blocking off a couple of websites that i occasionally use and i can't have that.

You can set Domain Overrides on Unbound, so you will use other dns servers for these domains that get blocked.
I'm saying this because you may face blocks using other dns services too.

 

[ddaenen1]

Yeah, blocking pornhub and xhamster can be a challenge, eh?

LOL

I would lie if i would say that i don't know pronhub but i have never ever heard of xhamster. In any case, it wasn't any of those but rather some subtitle websites that i use to add srt's to my media content.

 

[ddaenen1]

You can set Domain Overrides on Unbound, so you will use other dns servers for these domains that get blocked.
I'm saying this because you may face blocks using other dns services too.

I will look at that. I have had Cloudflare configured for quite some time as my DNS and never experienced any blocks. After i made the switchover to Quad9, some subtitle sites weren't accessible anymore. Changing back to Cloudfare fixed it instantly.

 

[sfx2000]

I will look at that. I have had Cloudflare configured for quite some time as my DNS and never experienced any blocks. After i made the switchover to Quad9, some subtitle sites weren't accessible anymore. Changing back to Cloudfare fixed it instantly.

I've had good luck with Cloudflare DNS - I would trust them over the other public DNS services...

 

[Christos]

We are out of topic, but since we are talking about dns, I would post my thoughts:

Cisco Umbrella/Opendns:
+Spend the most money on dns infrastructure than anyone else
+Don't add any experimental features
-Have no malware blocking on the free tier.

Google DNS:
+Many locations and good infrastructure
-Experimental features (have their own dns software)
-No protection (malware or else)

Cloudflare:
+Many locations and good infrastructure
+Malware and porn protection (Cloudflare family)
-Experimental features (have their own dns software)

Quad9:
+Have the best malware protection for a free service
+Don't add any experimental features
-Poor company without many resources for datacenter and engineers, compared to competition.

Adguard public dns:
+Best ad-blocking service and decent anti-malware protection
-Experimental features (have their own dns software)
-Poor company without many resources for datacenter and engineers, compared to competition.

 

[Tech9]

Cisco Umbrella/Opendns:
+Spend the most money on dns infrastructure than anyone else
+Don't add any experimental features
-Have no malware blocking on the free tier.

They do it in non-intrusive and non-disruptive way:

Plus Web Content filtering with Custom Categories many others don't have:

Limitation - IPv4 only, no Custom Categories with IPv6 (at least last time I checked).

 

[Tech9]

Quad9:
+Have the best malware protection for a free service
+Don't add any experimental features
-Poor company without many resources for datacenter and engineers, compared to competition.

One of the best is CleanBrowsing. You may want to try it and see how it works for you.

Main site:

CleanBrowsing | DNS Filtering Platform

Affordable DNS Filtering for schools, municipalities, libraries, transportation and parents.

cleanbrowsing.org

Free filters:

Free DNS Filtering | Block Online Porn with CleanBrowsing

Free DNS Filters by CleanBrowsing allow you to filter adult, pornography, obscene and other similar content from your internet.

cleanbrowsing.org

 

[sfx2000]

Google DNS:
+Many locations and good infrastructure
-Experimental features (have their own dns software)
-No protection (malware or else)

Cloudflare:
+Many locations and good infrastructure
+Malware and porn protection (Cloudflare family)
-Experimental features (have their own dns software)

Google and Cloudflare's DNS offerings are based mostly on the CDN and Cloud offerings - they needed to do it anyways, so why not make it publically available.

Curious as to when Amazon AWS starts to offer up Public DNS, as the internal Route53 service is quite good...

 

[coxhaus]

If I did not use QUAD9, I would Cisco's umbrella OpenDNS.

 

[sfx2000]

If I did not use QUAD9, I would Cisco's umbrella OpenDNS.

QUAD9 does support DNS over HTTPS (DoH) which some folks might like

DoH with Quad9 DNS Servers | Quad9

DoH is a secure DNS protocol that is getting a lot of traction lately. Mozilla announced support for it in their Firefox browser and Google recently announced support for developers and Alphabet through Jigsaw released the Intra app for Android.

www.quad9.net

OpenDNS also supports DoH - info below

https://support.opendns.com/hc/en-us/articles/360038086532-Using-DNS-over-HTTPS-DoH-with-OpenDNS

 

[sfx2000]

Since we've been talking about changing DNS server, one thing to consider is clearing out the DNS caches on the client devices...

Mac

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

iOS - both iPad and iPhone

Airplane mode for 30 seconds - or just power cycle it

Win 10/11 - cmd as admin

ipconfig /flushdns

Android

• Using Chrome: :
  1. Open Chrome
  2. Type chrome://net-internals/#dns in the URL bar
  3. Select DNS from the left pane
  4. Click Clear host cache in the right pane

 

[Christos]

OpenDNS also supports DoH

Also supports TLS, for those who use Unbound and android devices.

tls://208.67.222.222
tls://208.67.220.220

 

[ddaenen1]

Since we've been talking about changing DNS server, one thing to consider is clearing out the DNS caches on the client devices...

Mac

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

iOS - both iPad and iPhone

Airplane mode for 30 seconds - or just power cycle it

Win 10/11 - cmd as admin

ipconfig /flushdns

Android

• Using Chrome: :
  1. Open Chrome
  2. Type chrome://net-internals/#dns in the URL bar
  3. Select DNS from the left pane
  4. Click Clear host cache in the right pane

And what does that do?

 

[sfx2000]

And what does that do?

Clears out the DNS caches of the client devices - remember most, if not all, are cloud based, and with many services now using Content and/or Application Distribution Networks (e.g. CDN's), it's best to clear the clear the caches, as some domains have very long TTL for their lookups.

On pfSense - you can clear the caches on the router by restarting either dnsmasq or unbound, one doesn't have to restart the router, just restart the tasks - this applies to the resolver, and even if running as a forwarder, it doesn't hurt...

 

[Christos]

Spoiler: blocked malware domain

a4p.adpartner.pro

This is a malware domain, blocked by Mastercard.
Use dig command to see which dns providers actually block this malicious domain. (OpenDNS free plan does not block it, while Cisco Umbrella paid tier, blocks it as malware)

For example

dig a4p.adpartner.pro @9.9.9.9