pfSense Software Tip - Secure DNS
pfSense Plus and pfSense CE are used in home, SMB, Enterprise, and government installations. A simple firewall implementation usually just uses whatever DNS server is provided by the ISP, whether it’s a traditional ISP or your IT team. DNS configuration is easy to overlook during setup, but that could be the fatal mistake that allows an intruder or malware through the firewall. About 85% of malware uses (and abuses) DNS to develop its attack, according to IDC and other security researchers, but you can configure the DNS implementation on your pfSense firewall to provide much better protection, and it might be well worth the time to do so.
By default, DNS queries are not encrypted or authenticated and are thus available in plaintext as they travel from a client to a DNS resolver, DNS forwarder, or nameserver. This leaves them open to inspection and even attack.
DNSSEC is a set of security extensions for verifying the identity of DNS root servers and authoritative nameservers when communicating with DNS resolvers. It is designed to prevent DNS cache poisoning/spoofing, DNS tunneling, DNS hijacking, and other attacks. It also defends against NXDOMAIN, phantom, random subdomain, domain lock-up, and botnet-based CPE attacks. DNSSEC works by digitally signing data to help ensure its validity. Cloudflare published a blog post on DNSSEC in 2014.
DNSSEC allows you to detect whether DNS records have been modified during transmission. This protects your network from attacks in which DNS queries are changed, and users are redirected to fake websites. This protection only works for DNS zones that have DNSSEC enabled.
Since DNSSEC does not encrypt DNS traffic, network operators and ISPs can view DNS requests. This information can be used to create behavioral profiles, which are often sold for advertising purposes. Defeating this requires DNS over TLS.
DNS over TLS (DoT) is a standard for encrypting the communication between a device and its DNS server(s), making it impossible to eavesdrop, intercept or modify DNS messages traveling the “last hop.” The messages inside this encryption envelope are not checked for authenticity or integrity.
Configure DoT
While a traditional home ISP may or may not support DoT, there are plenty of other, more secure (and some free) DNS providers that may be more reliable and who promise not to track your internet activity. Cloudflare, Quad9, and Google Public DNS are good examples of this type of DNS provider. Configuring DoT should be considered the “bare minimum” DNS security improvement you make. The steps to accomplish this are pretty easy; you can find them here.
NOTE: This feature is only supported by the DNS Resolver. If the firewall currently uses the DNS Forwarder, convert to the DNS Resolver before proceeding. Also, when the firewall uses DoT, every DNS server used by the firewall must support DoT.
Make Sure Your DNS Service Supports DNSSEC
While pfSense enables DNSSEC by default, your ISP might not support it, which would then cause pfSense to default back to the less secure DNS mechanisms. We suggest switching to a DNS service that supports DNSSEC, as it is likely to provide greater security in other ways.
For the Enterprise: Time to Invest in DNS
There are many free DNS options, but Enterprises with a lot to lose might consider subscribing to a higher-end DNS service that can ensure your security, protect you from DDoS attacks, and provide many additional features; pfSense supports these higher-end services. If you are a “sensitive infrastructure Enterprise” such as a healthcare facility, a utility, or a civilian US government agency, you can have the best of both worlds (free and effective). Check out the US government’s “Protective DNS” service. It’s free to you, secure, fast, and global.
While the pfSense firewall can do a lot to protect your home, office, or agency, you must be aware of all possible threat vectors, and DNS is a huge one. If nothing else, stop using your ISP’s DNS by default, and turn on DoT because your ISP could be collecting and selling your data! |
|
%201000px-1.png?upscale=true&width=600&upscale=true&name=Netgate%20Logo%20White%20(horizontal)%201000px-1.png)
