@johnpoz:
if your goal is to just strip out netflix AAAA you can do that much easier with a python script you can get running in unbound..
https://forum.pfsense.org/index.php?topic=134352.0
Netflix and HE.net tunnel fixed using Unbound python module
That is… not what I would call "much easier", given how much hand-hacking is required. The nice feature of the DNS method is that it's all standard packages, entirely controlled via the webconfigurator, using built-in features (Unbound's domain overrides and BIND's AAAA-stripping). The only tweaking by hand that I've done is to work around what strikes me as a package misconfiguration, in that neither resolver can be told to listen on a different port for remote controls. The fact that Unbound's configuration includes the defaults at the end rather than the beginning seems to me to be a bug, but I don't want to have that fight.
And in fact, I bet that somebody really good at BIND configs could accomplish the same thing using only named, no script fiddling needed, and turning off Unbound entirely. (I am not that person. I've spent too much of my life being pissed off at BIND.)
But it's good that there are multiple ways to solve Netflix and other organizations' stupidity! The people who love getting their hands into scripts will prefer the method you linked. I was that person when I was younger, but I don't want that kind of thing on my homelab anymore. :-) I do like that Unbound can use python that way now.
@Napsterbater:
Unrelated, safe to ignore. pfSense/kernel does not currently support TCP Fast Open, which is all that warning is telling you.
Yeah, I just this morning found a discussion on a mailing list describing how ISC's configuration on this feature is really, really braindead. It's apparently turned on/off by what the kernel on the build machine can do, and there's no way to control it other than editing the generated header file, e.g., post-config sed script. Anything at runtime not matching what the build machine used ends up reported as "unexpected error".
Come to think of it, stuff like this is why I stopped using BIND… auuugh I drank heavily to purge the memories of those years now it's all coming back noooo
