Bypassing DNSBL for specific IPs

Gertjan · Jun 28, 2021, 5:28 AM

Yep, this box should be checked :

turbotater19 · Nov 7, 2021, 4:43 AM

Here from Reddit, then Mayfield IT...
I've got a setup where I'd like to bypass pfBlockerNG for one single entire interface but keep it enabled for my other 2 interfaces. Interfaces "LAN1" (10.0.0.0 /24) and "Crapwork" (192.168.0.0 /24) should still get the full pfBlockerNG treatment (DNSBL+IPBL) while the unlucky guests on interface "BARN" (172.16.0.0 /24) won't and will have to see ads and get random IPs from bad places poking around!

Would I need to enter the below into the "custom options" box in DNS resolver settings and then also make sure interface "BARN" is not selected (while LAN1 and Crapwork are) in the "Outbound Firewall Rules" section of IP tab under pfBlockerNG?

server:
    access-control-view: 172.16.0.0/24 bypass
    access-control-view: 10.0.0.0/24 dnsbl
    access-control-view: 192.168.0.0/24 dnsbl
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
    include: /var/unbound/pfb_dnsbl.*conf

Or should I update pfSense (on 2.4.5 yikes) and then update pfBlockerNG (on 2.2.5_30) and use the Bypass IPs field where I'd put (presumably) 172.16.0.0/24 and then same as above for IPBL settings?

Gertjan · Nov 7, 2021, 2:27 PM

@turbotater19 said in Bypassing DNSBL for specific IPs:

Or should I update pfSense (on 2.4.5 yikes)

Back then, as for as I can remember, you had to enter the custom unbound parameters (like you showed - can't tell if they are correct, though).

The latest pfSense, and the latest pfBlockerNG makes it possible to exclude IP (or even networks ?) using the pfBlockerNG GUI.
Select the (DNSBL) 'Python Group Policy' option and fill in the IP's.

turbotater19 · Nov 7, 2021, 3:22 PM

@gertjan said in Bypassing DNSBL for specific IPs:

Back then, as for as I can remember, you had to enter the custom unbound parameters (like you showed - can't tell if they are correct, though).

The latest pfSense, and the latest pfBlockerNG makes it possible to exclude IP (or even networks ?) using the pfBlockerNG GUI.
Select the (DNSBL) 'Python Group Policy' option and fill in the IP's.

Thanks for the reply. I guess then what I'm asking for is if anyone thinks my code is correct for keeping DNSBL active on 2 of my 3 interfaces while the one interface gets bypassed. All the examples I've seen appear to show a single IP bypassed while the rest are blocked or 2 VLANs.

Also, to implement this (provided I don't just update pfSense and then update pfBlockerNG), do I disable pfBlockerNG, add lines into custom options, save, then start pfBlockerNG? Or do I add this into custom options while pfBlockerNG is enabled?

turbotater19 · Nov 8, 2021, 4:48 AM

I pasted my code in and initially it didn't work. Took out the leading spaces on each line and that fixed it, working as I'd hoped!

Overlord · Jan 28, 2022, 11:25 AM

@gertjan
I can't find it? Is it removed?

I'm trying to find a solution to unblock an IP, which is one of my blocklist as false positive.

Gertjan · Jan 28, 2022, 12:12 PM

@overlord said in Bypassing DNSBL for specific IPs:

I can't find it?

Find what ?
The initial - see above - is "how to bypass a specific IP".
Reading the post shows that @Ns8h wanted to exclude a LAN device from being DNSBL'ed by pfBlocker - this was in 2018.

Or do you man : You want to whitelist an IP ( or DNSBL ?) from a list/feed you use ?
In that case, go to Firewall > pfBlockerNG > Alerts and look up the line where the IP was blocked. Example :

login-to-view

if I want to unblock "8.8.8.8" blocked by the firewall rule pfB_DoH_IP_v4 (uses an alais that contains all the IPs from the TheGreatWall_DoH... DNDBL feed, I have to move the mouse to the red padlock, click and follow the instructions.
This measure is temporary - as stated.

Clicking on the black + sign is permanent :

login-to-view

Just follow the instructions.

shon · Jan 28, 2022, 2:45 PM

@gertjan said in Bypassing DNSBL for specific IPs:

Yep, this box should be checked :

login-to-view

This did not work for me at all, and neither using custom unbound views. Not sure where else to look.

Gertjan · Jan 28, 2022, 4:47 PM

@shon

Just checking "Python Group Policy" does nothing.
It's stated that "Enable the Python Group Policy functionality to allow certain Local LAN IPs to bypass DNSBL"

So certain local IPs have to be entered.

Like :

login-to-view

edit :

I didn't have any DNSBIl activated, so I activated one.
This one :

login-to-view

Take a look at the feed text, and you find the last entry :
avsvmcloud.com

On my PC with the IP 192.168.1.2 (on the policy list - see my image above) I could obtain an IP :

login-to-view

Or, on another PC using IP 192.168.1.9, I obtained "0.0.0.0" == DNSBL blocked ( I'm not using the build in pfBlockerNG web server, if I was, I would have received 10.10.10.1 ).

My conclusion : Group policy works.

I did not test IPv6 here. For IPv4 it worked.

shon · Jan 28, 2022, 5:39 PM

@gertjan I added my local IP4 addresses under the group policy as host IP's with no subnet mask range e.g. /32 /24 etc.. I restarted pfsense, unbound, ran , update force, reload and still no dice. I love the way it works but I need to whitelist IP's to get around pfblocker/dnsbl/geoip restrictions I've set already. thanks!

Overlord · Jan 31, 2022, 1:02 PM

@gertjan
As I can see there are no rules under "Deny". I have read there, that this issue could be from the installed version (2.1.4_26). Is this 2x version still in development? Is there a release date for the 3.x devel version? (Devel becomes non devel)

michmoor · Mar 11, 2022, 5:04 PM

@smokinmojoe I was literally saying this out loud to myself. This package has been available for quite some time and the fact that this request which is very reasonable and very obvious that is needed is not implemented really hurts my soul.

Yes, DNS sinkholing is great. You would think along the way someone would've thought to themselves "Gee, what if there's a user that shouldn't be restricted". Pretty much the follow-up to that thought was "ehh that would never happen. what an unlikely thing to think".

Gertjan · Mar 14, 2022, 7:45 AM

@michmoor

Not implemented ?

I just spend looking some time why my DNSBL didn't seem to work. Then I found out out wasn't working for the PC is was using, but it was working, for the PC right next to me.
I recalled : I've added the IPv4 and IPv6 of the PC I'm using on the "Python Group Policy" list.

Btw : Python Group Policy was added to the "pfBlockerNG-devel 3.1.0_1"", not the ancient 'pfBlockerNG 2.1.4_26'.

pftdm007 · Apr 8, 2022, 2:14 AM

Unless there's something wrong in my config, I think I found a bug with bypassing DNSBL with the python feature...

For example, that if I add a client to the exclusion list (Python group policy) to bypass DNSBL, almost immediately after, DNSBL starts behaving very weirdly by allowing traffic from the unblocked client as it should, but randomly also from other clients. Sometimes it returns the 1x1 gif thingy, sometimes the webpage with "This website BLABLABLA has been blocked by the Network Administrator!"

(Edited this post after more troubleshooting)

Gertjan · Apr 8, 2022, 7:58 AM

@pftdm007

Your are using the correct IP addresses ? Like :

login-to-view

When you change DNSBL settings :
Do a force realod all for pfBlocker.
Reset for every LAN device the local DNS cache.
Windows will need a

ipconfig /flushdns

@pftdm007 said in Bypassing DNSBL for specific IPs:

Sometimes it returns the 1x1 gif thingy, sometimes the webpage with "This website BLABLABLA has been blocked by the Network Administrator!"

That what's left over from the DNSBL web server that wants to tell you a page has been blocked.
To make a long story short : don't use the DNSBL web server, because (repeat after me) "it is impossible to redirect a https request".

Select :

login-to-view

michmoor · Apr 8, 2022, 12:38 PM

@pftdm007 python mode is very iffy. I have found that using unbound custom dns options works way better to exclude hosts or networks from DNSBL where as python mode only allows /32 exclusions which isn’t very scalable at all. I would highly recommend that over python mode.

pftdm007 · Apr 8, 2022, 3:42 PM

@gertjan said in Bypassing DNSBL for specific IPs:

Your are using the correct IP addresses ?

Yes. Client assigned IP's from pfsense's DHCP server.

@gertjan said in Bypassing DNSBL for specific IPs:

When you change DNSBL settings :
Do a force realod all for pfBlocker.
Reset for every LAN device the local DNS cache.

I do a force reload on ALL (pfb and DNSBL). I usually close all browsers on all machines and retry, I haven't reset the local DNS cache per-se but will try. I only use linux boxes.

@gertjan said in Bypassing DNSBL for specific IPs:

don't use the DNSBL web server, because (repeat after me) "it is impossible to redirect a https request".

Okay I had No Global mode set and changed it to Null Block (logging). lets see if DNSBL is more stable and predictable.

shon · May 7, 2022, 5:36 PM

@gertjan

Just following up on this -- (Thanks for your help!)

The Python Group Policy action works for whitelisting any clients, per host address e.g. 192.168.1.100 that we do not want DNSBL to filter.

However I have another problem, sort of in the same neighborhood.

I am using GeoIP as well using a domain name white list alias (domain a/s lookup enabled) that I created called "domain_whitelist_v4"

This is the alias URL in the fw:

https://127.0.0.1:443/pfblockerng/pfblockerng.php?pfb=pfB_domain_whitelist_v4

I'm trying to use the same GeoIP alias file " domain_whitelist_v4" in a DNSBL Group Feed source definition to not take action/block on.

The URL I set of the DNSBL group feed source definition is https://127.0.0.1:443/pfblockerng/pfblockerng.php?pfb=pfB_domain_whitelist_v4.txt

I have the action set to "Disabled" instead of Unbound.

I figure that If I update the GeoIP alias "domain_whitelist_v4" section, that I do not have to then also update the DNSBL Whitelist section too since their (DNSBL & GeoIP) are both referencing the same domain name list (domain_whitelist_v4). Instead I have to update in 2 places for domain reachability sometimes depending if its also being blocked via GeoIP

Ideally, I don't want to remove all filtering for some clients, but instead I'd like to update one alias file that covers both DNSBL (permit) and GeoIP (permit)

JonathanLee · Jan 17, 2025, 5:07 PM

Is there a way to bypass just one url request so it always goes to 8.8.8.8 for example?

imap.gmail.com for example keeps getting saved inside my cache I use strict destination for my outgoing smtp and imap ports everything works except gmail because it uses so many rotating ip addresses.

login-to-view

I have an alias that only allows outbound mail to go to servers we use.

Example outlook, gmail, yahoo, apple mail, and nothing else.

login-to-view

Maybe something like???

server: 
       access-control-view: imap.gmail.com bypass
view:
       name "bypass"
       view-first: yes
       forward-addr: 8.8.8.8@853????

The goal is to never check the cache database for this address to just send it up stream so the authoritative server resolves it every time it is requested

You remember a couple of years ago some government offices were hacked because they had any any for outbound mail ports? This is my solution to fix this but gmail makes it difficult it is the only one that you have to refresh to get it to connect in mail applications everything else is fine with timeouts, google must change ip addresses every min or less at times for gmail.

mcury · Jan 17, 2025, 5:28 PM

@JonathanLee Try this:

forward-zone:
        name: "imap.gmail.com"
        forward-addr: 8.8.8.8
        forward-no-cache: yes

Didn't test it, so not sure if its going to work.
Got this info from the following link: https://unbound.docs.nlnetlabs.nl/en/latest/manpages/unbound.conf.html