Configuration Problem With Interface/Policies and PiHole

MikeProjectsMikeProjects
in Firebox - Networking, Multi-Wan, VLAN, NAT, SD-WAN

Hello everyone. I have a configuration problem that I can't solve. I configured a raspberry with pihole. If I connect it to interface no. 5 - DNS - gives me back a series of errors and I can't even connect via the web interface. always refuses the connection as well as giving me a spoofing problem (which you see in the attached images). While if I connect it to interface no. 4 - Direzione_Apl - I have no problem and I can connect without problems and I have no error whatsoever. Attached in addition to the "traffic monitor" of the error, also the "policies" active at the moment. Can anyone help me understand how to fix it? Thanks a lot in advance


Comments

  • Bruce_BriggsBruce_Briggs

    Spoofing source indicates that you have that subnet defined someplace else in your config.
    Perhaps for a VPN or Secondary network?

  • Bruce_BriggsBruce_Briggs

    You can save your config to disk and then use a text editor to search for 192.168.3.

    System -> Configuration File -> Download the Configuration File
    Note: This downloaded file is in a compressed format (.gz). Be sure to decompress the file before trying to open it using a text editor,such as Notepad etc.

  • MikeProjectsMikeProjects

    Okay, thank you! There should be nothing other than what I have attached (like VPN or Secondary Network). Tomorrow I go back to the office and check according to your advice. Possibly if I had to change IP and from 192.168.3 to 192.168.6-9 could I solve without changing anything else?

  • Bruce_BriggsBruce_Briggs

    Yes it probably will

  • MikeProjectsMikeProjects

    Perfect. Tomorrow i'll try both solution! Thanks.

  • MikeProjectsMikeProjects

    Hi. I downloaded the configuration and found a strange thing, but I solved it by simply changing the IP to port 5, as you see in the attached photo, which is 192.168.20.1. I can connect to the pihole without problems via web interface. Everything works if I directly set the pihole address - 192.168.20.2 - as the DNS server address (directly from the Windows control panel). But if I set 192.168.1.1 as DNS I have no connection. The firewall blocks it. In the tab where there are all the "interfaces" I set both the internal IP of PiHole and the DNS of Cloudflare (1.1.1.1), but the firewall continues to block the connection on port 53, even though I had already set a rule yesterday to leave it open. Any suggestions? Attached are all the screens.



  • Bruce_BriggsBruce_Briggs

    The firewall is not a DNS server.
    The firewall can be a DNS forwarder, but only if you enable this option.

    About DNS Forwarding
    https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/networksetup/dns_forwarding_about.html

  • MikeProjectsMikeProjects

    Hi.
    I followed the advice in the guide but it doesn't work.

    I'm attaching a screenshot of the situation.

    I set the interface of firebox as DNS address on the PC, created the rule on the Firebox, but it still doesn't resolve the addresses.
    On the traffic monitor it no longer returns any errors, unlike yesterday, after setting the voice "to" to "ANY" in the "DNS offices" rule.

    (The DNS server in on interface n. 5 with IP 192.168.20.2 and it works properly.)

  • Bruce_BriggsBruce_Briggs

    You have not provided a screen shot showing that DNS Forwarding has been enabled.

    Consider opening a support case on this to get help from WG in getting this working as desired.
    Click the SUPPORT CENTER link above and select Create New Case

  • MikeProjectsMikeProjects

    Ah ok, thanks. Now is clear. I've checked the firmware version and the latest available for M200 is 11.10.4. So i've to activate DNS Forwarding through the CLI interface? Right?

  • Bruce_BriggsBruce_Briggs

    Yes

  • Bruce_BriggsBruce_Briggs

    Actually, there is a free update to Fireware 12.5.9 Update 2 to address the Cyclops Blink vulnerability.

    https://www.watchguard.com/support/release-notes/fireware/12/en-US/EN_ReleaseNotes_Fireware_12_5_9/index.html

    You probably need to contact Customer Care to get a link to this version for a M200
    You can do that via a support case,
    Select Record Type = Customer Care

  • james.carsonjames.carson Moderator, WatchGuard Representative

    (12.5.9 Update 2 for M200/M300 exe for WSM install)
    https://cdn.watchguard.com/SoftwareCenter/Files/XTM/12_5_9_U2/Firebox_OS_M200_M300_12_5_9_U2.exe

    (12.5.9 Update 2 for M200/M300 sysa-dl for WebUI install)
    https://cdn.watchguard.com/SoftwareCenter/Files/XTM/12_5_9_U2/firebox_M200_M300_12_5_9_U2.zip

    There have been a number of updates to Fireware since 12.5.9 Update 2. I would suggest upgrading to a newer device that can run the latest version of Fireware.

    -James Carson
    WatchGuard Customer Support

Sign In to comment.