@Kamel:
A better/preferred solution (IMHO) would be to redirect to an internal page hosted on pfsense explaining why it was rejected just like squidguard. The issue with redirecting to 127.0.0.1 or not responding is they trick your PC into thinking it's going to get something if it goes there, so it will take a long time and then ultimately 'not respond'. This can also sometimes look like something is broken, so if you have a larger network you may get lots of "why isn't this website working" – as opposed to the user seeing and immediately understanding the reason it was blocked was due to alleged spyware and/or malware and it will remove all question. This will also aid in the troubleshooting process, as you would know immediately the reason this or that page is not functioning.
Just my 2 cents, I highly support the idea though. I wonder if there are "lists" one could subscribe to like with pfblocker. BTW, sites simply being blocked with no explanation why (and system resource hogging) is why I don't use pfblocker.
Another thing - if a machine is infected or could be infected if it was to visit site xyz.com say by an exploit kit exploiting a Java exploit and then dropping a unknown EXE (you will see how often things like these are recognised on virustotal.com :p) do you really care if a user sees a reason? Pfblocker perhaps I can see your point if you block a site which is in a country you have blocked (though users usually let you know pretty quick) but if you block a site on malwaredomains.com - which based on its latests updates has blocked Zeus, Blackhole Exploit Kit Domains, Russian Business Network Malvertisements, Botnets, Malicious Iframes, Mavertisements, malicious javascript and more. These are all bad - would you rather they were blocked outright and users don't get a message (they shouldn't need to connect to them unless they want some trojans on their machines so they are never going to bother you saying they couldn't connect to some work resource) or connect and receive the trojan? Blocking them by DNS blackhole reduces your workload drastically by helping to prevent infections and sending people to reimage machines due to some unrecognised trojan trying to steal data.
