Hi everybody,
I found indeed a solution to my problem and would like to share it here. It is not perfect, but what in this word is? ☺
My solution does not directly use pfSense. pfSense is only used to ...
a) configure a special DNS server address for selected DHCP clients (smart TVs and the like)
b) block access to the (uncensored) DNS resolver running on pfSense form said clients using the firewall
The special standalone DNS server (a Raspberry Pi in my case) runs the dnsmasq service. dnsmasq has two very handy configuration options. The magic incantations are the "server" directive and the "address" directive. (Note: One could also run dnsmasq on pfSense - but in my setup I already use unbound on pfSense and didn't want to risk messing with everybody elses DNS resolution just for this.)
With the server directive one can specify an address which we want to be resolved by a certain DNS server. The trick here: '#' as the target resolver means "use your configured standard server to forward the request to". Meaning: resolve normally. Im my case for Netflix I have:
server=/netflix.com/#
server=/netflix.ch/#
server=/nflxext.com/#
server=/nflximg.com/#
server=/nflximg.net/#
server=/nflxvideo.net/#
server=/nflxso.net/#
server=/netflix/#
server=/cloudfront.net/#
server=/d179kwmlpc4o47.cloudfront.net/#
server=/d2s336w63pl2vv.cloudfront.net/#
(the details seem to depend on geographic location - note I have a blanket "allow" for all of cloudfront.net here - the cloudfront host names are not necessarily stable)
The "address" option can then be used to implement the "DNS black hole" functionality:
address=/#/192.168.x.y
OR -
address=/#/
The first version makes dnsmasq return a fixed (fake) IP address for any DNS request not whitelisted using a server directive. The second returns NXDOMAIN instead of a wrong IP. I use the first. Look at the manpages of dnsmasq and dnsmasq.conf for details!
For some of my "smart" devices to function, I need to allow additional domains. One Samsung TV for example needs access to the domain time.samsungcloudsolution.com (among others). Otherwise it will not believe that it has internet access and will simply refuse to start the Netflix app - stupid "smart" thing!!
My solution kind of works, but adding a new "smart" device is always a hassle. And if you want to use another video streaming service, you have to find out the necessary domains to whitelist first.
This is the solution I am using. I hope this will help someone.
Andy
