The pfSense Store

Author Topic: Periodic since 2.2 pages load blank, certs invalid  (Read 14729 times)

0 Members and 1 Guest are viewing this topic.

Online kejianshi

  • Hero Member
  • *****
  • Posts: 4897
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #30 on: January 28, 2015, 07:22:50 pm »
There are just too many ways to mess with DNS especially if you can't trust the network between your machine and the servers. In the end, at best you can really only make sure that the guys playing games with your network aren't common criminals because you don't own the root servers.

Offline Trel

  • Sr. Member
  • ****
  • Posts: 368
  • Karma: +11/-1
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #31 on: January 28, 2015, 07:25:22 pm »
There are just too many ways to mess with DNS especially if you can't trust the network between your machine and the servers. In the end, at best you can really only make sure that the guys playing games with your network aren't common criminals because you don't own the root servers.

But I'm asking about this specifically, I need to know if what's been happening could be due to an infected machine elsewhere on my network, or if it's definitely happening due to something from WAN and beyond.

Online kejianshi

  • Hero Member
  • *****
  • Posts: 4897
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #32 on: January 28, 2015, 07:27:43 pm »
I don't think one machine on the network could be the problem (unless that machine is pfsense its self), at least in my case, or going to unbound+DNSSEC would have made no difference.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9047
  • Karma: +1032/-306
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #33 on: January 28, 2015, 07:39:30 pm »
If you were affected by this, what part of the world are you in?  Just curious.  Interesting incident.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline Trel

  • Sr. Member
  • ****
  • Posts: 368
  • Karma: +11/-1
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #34 on: January 28, 2015, 07:43:16 pm »
I don't think one machine on the network could be the problem (unless that machine is pfsense its self), at least in my case, or going to unbound+DNSSEC would have made no difference.

I just double checked and it looks like I never enabled DNSSEC when I changed to unbound.  Does that change your answer at all?
(needless to say, it's getting turned on now)

If you were affected by this, what part of the world are you in?  Just curious.  Interesting incident.

North East USA.

Online kejianshi

  • Hero Member
  • *****
  • Posts: 4897
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #35 on: January 28, 2015, 07:43:30 pm »
How about this - I will show you where the pfsense is sitting.  Hows that?  Check PM

Offline cmb

  • Hero Member
  • *****
  • Posts: 11230
  • Karma: +893/-7
    • View Profile
    • Chris Buechler
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #36 on: January 28, 2015, 07:45:57 pm »
If you were affected by this, what part of the world are you in?  Just curious.  Interesting incident.

North East USA.

Seems to be geographically diverse. At least two in the US in this thread, one in the UK.
« Last Edit: January 28, 2015, 07:51:04 pm by cmb »

Online kejianshi

  • Hero Member
  • *****
  • Posts: 4897
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #37 on: January 28, 2015, 07:48:42 pm »
The pfsense in question is in Maryland, for me.

Offline Trel

  • Sr. Member
  • ****
  • Posts: 368
  • Karma: +11/-1
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #38 on: January 28, 2015, 07:56:09 pm »
By the way, I can confirm for sure that pfsense was seeing the bad DNS.

I have an alias for facebook.com
I saw this in the resolver log
Code: [Select]
filterdns: adding entry 195.22.26.248 to table Social_Test on host facebook.com
195.22.26.248 is the bad IP.  PFSense itself saw that when it did its update on the alias resolution.

Online kejianshi

  • Hero Member
  • *****
  • Posts: 4897
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #39 on: January 28, 2015, 08:09:44 pm »
https://www.virustotal.com/en/ip-address/195.22.26.248/information/

https://www.robtex.net/en/advisory/ip/195/22/26/248/

Seems like there is an associated IP block thats pretty much into everything bad.

Offline Trel

  • Sr. Member
  • ****
  • Posts: 368
  • Karma: +11/-1
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #40 on: January 28, 2015, 08:12:08 pm »
https://www.virustotal.com/en/ip-address/195.22.26.248/information/

https://www.robtex.net/en/advisory/ip/195/22/26/248/

Seems like there is an associated IP block thats pretty much into everything bad.

I don't doubt that, but that doesn't answer the question as to how when using google dns and level3 dns with unbound, that legitimate sites started resolving to this IP range, unless I'm missing something.

Online kejianshi

  • Hero Member
  • *****
  • Posts: 4897
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #41 on: January 28, 2015, 08:18:13 pm »
No idea

Offline agreenfield1

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #42 on: February 05, 2015, 07:42:58 pm »
Same thing happened to me this morning: https certs signed by lolcat, all dns inquiries not handled by pfsense directly give 195.22.26.248, and using the Google DNS and Level 3 dns servers.  I was able to resolve the issue for the time being by checking the 'Allow DNS server list to be overridden by DHCP/PPP on WAN' box, which presumably switched pfsense from using the compromised/poisoned DNS server to my ISPs DNS server.

I originally thought this issue was unrelated to pfsense, and posted the issue here:https://forum.pfsense.org/index.php?topic=88238.0.  But after seeing this thread, it seems like pfsense 2.2 / DNS Resolver / Unbound may be a factor?

Configuration: PFSense 2.2, DNS Resolver, GoogleDNS and Level3 as primary and secondary DNS servers respectively.

Online kejianshi

  • Hero Member
  • *****
  • Posts: 4897
  • Karma: +194/-40
  • Debugging...
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #43 on: February 05, 2015, 08:40:03 pm »
Nope - Because the same thing was happening to me using dnsmasq...

Actually switching to unbound + DNSSEC cured it.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9047
  • Karma: +1032/-306
    • View Profile
Re: Periodic since 2.2 pages load blank, certs invalid
« Reply #44 on: February 05, 2015, 09:40:57 pm »
Quote
I originally thought this issue was unrelated to pfsense, and posted the issue here:https://forum.pfsense.org/index.php?topic=88238.0.  But after seeing this thread, it seems like pfsense 2.2 / DNS Resolver / Unbound may be a factor?

This has nothing to do with pfSense.  It has to do with you relying solely on google/level3 for all your DNS and someone is playing with it.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM