Identifying Clients on Pfsense with NextDNS

Networking & Firewalls
1

Hi I’m running Pfsense with NextDNS set as external DNS resolver (NextDNS).

But when I go to the NextDNS dashboard, I only see a single device - which is expected, since it’s the Pfsense router.

What I’d like to do/happen is to see all (40+) devices that are on my home network on the NextDNS dashboard. So that I can see which device is doing what and see which websites my kids are going to (or trying to).

I can’t see a setting in the Pfsense dashboard which allows me to somehow forward the DNS requests to NextDNS so that I can identify the actual device and not the Pfsense router.

By the way, I have set it up that all my devices are getting static leases based off their MAC addresses. And have given all the devices a name and description too.

I have used Pfsense for almost 2 yrs now, but still consider myself a newbie as i’m learning the more advanced side of things…

Thank you for your help.

2

I don’t use NextDNS but since the clients are behind the pfsense there is not any way for NextDNS to know each client individually. They do have a Windows client (I am assuming you are running Windows) and that should work to get the data to them.

3

Hi Tom, thanks for your fast reply.

Actually I’m running Ubuntu as my main PC. The Pfsense is installed on Netgate 1100 entry level appliance.

Anyway, so if you look at the settings page on NextDNS, they mention how you can use DNS-over-TLS or DNS-over-HTTPS and can identify devices by, For example “John’s Firefox”, you would use 'https://dns.nextdns.io/e1d5b8/John’s%20Firefox’ as your DNS-over-HTTPS endpoint."

So I was thinking that the Netgate 1100 knows what a particular host is trying to connect to, and keeping in mind that I’ve properly named the devices as well, wouldn’t it be possible to have some kind of ‘URL re-write’ code to forward those DNS requests to NextDNS? So, for example, my Alexa Echo Show in the living room can be URL-rewritten to: ‘https://dns.nextdns.io/e1d5b8/Echo_Show_LR’

But I don’t know where I could do this. I mean, there is a ‘custom options’ box on the DNS Resolver page. It feels that’s the place where you’d put that command/script, but what would it be?

M

4

The usual way I see this done is by having the dhcp server dynamically register addresses with the dns server. Im not intimately familiar with nextdns, but I know Technitium and dnsmasq have fascilities for this.

There’s also a great article on arstechnicq about doing this with bind9 and dhcpd. Here’s the first chapter on that: Doing DNS and DHCP for your LAN the old way—the way that works - Ars Technica.

5

When using those the browser is creating an encrypted connection directly to NextDNS and pfsense would not have visibility into that connection.