Potential DNS Rebind attack detected, workaround

If you publish sites to the Internet behind pfSense device, and then try to open the Internet address you will receive the following error message:

Potential DNS Rebind attack detected, see http://en.wikipedia.org/wiki/DNS_rebinding

Try accessing the router by IP address instead of by hostname.

This will appear on your browser.

Potential DNS Rebind attack detected 01

Recently I’ve hit this issue.

The workaround the problem that I’ve found is as follows.

You set for the network behind the pfSense device a static DNS record for the site, pointing to the internal IP address. In this way you bypass the security checks.

The solution is as follows:

Go you the Web GUI of the pfSense, select

Services > DNS Forwarder

Potential DNS Rebind attack detected 02

There at the bottom of the page, is the section Host Overrides.

Clock on the “+” sign in this section

Potential DNS Rebind attack detected 03

Here for the site that you want to open fill in the following:

Let’s say for example you published the site:

Something.anything.com

In the Host field enter: Something

In the Domain field enter: anything.com

In the IP Address field: enter the internal IP address of the server hosting the site

In the Description: fill something useful, so half a year later, you can remind yourself that this exception was for 😉

Click on Save.

Potential DNS Rebind attack detected 04

Upgrade from pfSense 2.1.5 to 2.2 on Hyper-V

After the release of pfSense 2.2 it was time to upgrade some installations. They resides on Windows Server 2012 R2 Hyper-V. After the first reboot my test machine did not come up. The screen looks like this:

pfSense 2.2 Upgrade 01The error message is quite interesting at first:

Mounting from ufs:/dev/ad0s1a failed with error 19.

After little goggling I’ve found this article:

Mounting from ufs:/dev/adaxs1a failed with error 19.

and after simple entering of one ? the answer to the problem was in front of me:

pfSense 2.2 Upgrade 02The disk names were change from

ad0s1a

to

da0s1a

So to boot I’ve typed:

pfSense 2.2 Upgrade 03and voilàpfSense 2.2 Upgrade 04

Now the only thing that is left if to make changes to the boot configuration

You have the option to for form console

8) ShellpfSense 2.2 Upgrade 05and edit the file pfSense 2.2 Upgrade 06Mine looked like this:pfSense 2.2 Upgrade 07and after the change like thispfSense 2.2 Upgrade 08

Of if you will you can make the change using the web gui

go in the Diagnostics menu and selecting the Edit FilepfSense 2.2 Upgrade 09From there you just naviage to the “/etc/fstab” and edit the text.pfSense 2.2 Upgrade 10After changes test that the system is booting from the correct partition.

 

pfSense 2.2 Released!

It’s been a while since I’ve been digging in pfSense. A lot of things had happened. The good news is that currently I’ve got a few projects related to the topic and will make a few posts about them. Next post will be related to upgrading to 2.2 from 2.1.5.

In the meantime you can check what are the new features in this release here:

2.2 New Features and Changes

The official article about the release:

pfSense 2.2-RELEASE Now Available!

and of course the Upgrade Guide