Pi hole not blocking TXT records with regex filters

Expected Behaviour:

Record types other than A/AAAA are also blocked when they match a regex filter

Actual Behaviour:

TXT records are being forwarded to the upstream DNS provider

Excerpt from /var/log/pihole-FTL.log

[2020-01-28 14:05:02.596 17213] Regex in line 2 "sophosxl\.net$" matches "qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net"
[2020-01-28 14:05:02.600 17213] Added qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net to cache
[2020-01-28 14:05:02.600 17213] **** forwarded qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net to 1.0.0.1 (ID 61, dnsmasq/forward.c:558)
[2020-01-28 14:05:02.601 17213] **** forwarded qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net to 1.1.1.1 (ID 61, dnsmasq/forward.c:558)

And the corresponding row in the UI is:

2020-01-28 14:05:02 	TXT	qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net	192.168.42.103	OK (forwarded)	N/A

Upstream doesn't reply with response, not sure if that should make any difference. These queries are actually used to send data to a service rather than to look up a name.

$ dig TXT @1.1.1.1 qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net

; <<>> DiG 9.10.6 <<>> TXT @1.1.1.1 qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 54763
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1452
;; QUESTION SECTION:
;qvfpbhefr.cv-ubyr.arg.w.00.a.sophosxl.net. IN TXT

;; Query time: 37 msec
;; SERVER: 1.1.1.1#53(1.1.1.1)
;; WHEN: Tue Jan 28 14:17:41 GMT 2020
;; MSG SIZE  rcvd: 70

see here, no longer a problem in beta5, apparently (not yet tested).

As noted above, this is not the expected behavior in V4.x.

Ah, thank you all for the info

-Gordon

also mentioned here (topic already closed, so no update)

The current `development` version already blocks all types of requests so you won’t need to do anything in addition.
FTL v4.x blocks only `A` and `AAAA`

I've been running Beta5 for a couple of days now, and can confirm pihole-FTL now blocks all types of requests (no SURICATA alerts anymore).

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.