How to block web site, simple step by step
-
Hi, I need help on how to block web site from being accessed from LAN through pfSense in simple step by step instructions, if possible. I tried most if not all online articles for this subject and still I can access, for example, cnn.com so I must be doing something wrong.. I have installed "snort", "squid", "squid guard" and "pfBlockerNG" and running pfSense ver. 23.01. All is running great with exception of this.
-
@andrzejls simple solution would be to just block cnn.com from resolving this can be done in pfblocker, or just in unbound directly via a local-data pointing at bad IP, or a redirect if you want to do wildcards like anything.cnn.com
Keep in mind users quite often forget they are on a stateful firewall, and a state allows traffic before rules. If there is an existing state the traffic would be allowed even if you put in a block.
Also remember that clients and browsers have dns cache as well.. So even if you block cnn.com from being resolved at pfsense, the client most likely already has an IP cached for it in its local dns cache.
-
@johnpoz Thank you for your quick response. I tried to block website in pfBlockerNG and I am still able to access it. Can you provide more specific instructions?. Thanks
-
@andrzejls said in How to block web site, simple step by step:
pfBlockerNG and I am still able to access it
How did you block it? Again if your client looks up cnn.com and gets its IP, it doesn't have to ask for cnn.com again until the clients local cache has expired, or you have reset it, etc.
I don't use pfblocker to do rules, I only use it to create aliases that I use in my own rules. And I don't use any of those for outbound blocking. I only use them to filter who can talk to my open ports on my wan.
Keep in mind cnn.com for example is hosted on a CDN, so there is going to be multiple IPs
;; QUESTION SECTION: ;cnn.com. IN A ;; ANSWER SECTION: cnn.com. 40 IN A 151.101.3.5 cnn.com. 40 IN A 151.101.195.5 cnn.com. 40 IN A 151.101.67.5 cnn.com. 40 IN A 151.101.131.5Those can change all the time, and you could have a disconnect in where your trying to go for an IP and what IPs are being blocked - especially if your client isn't using pfsense for dns, etc.
Also don't forget IPv6
;; QUESTION SECTION: ;cnn.com. IN AAAA ;; ANSWER SECTION: cnn.com. 145 IN AAAA 2a04:4e42:e00::773 cnn.com. 145 IN AAAA 2a04:4e42:800::773 cnn.com. 145 IN AAAA 2a04:4e42::773 cnn.com. 145 IN AAAA 2a04:4e42:a00::773 cnn.com. 145 IN AAAA 2a04:4e42:600::773 cnn.com. 145 IN AAAA 2a04:4e42:400::773 cnn.com. 145 IN AAAA 2a04:4e42:c00::773 cnn.com. 145 IN AAAA 2a04:4e42:200::773 -
@johnpoz This is how I try to block these sites.
-
@andrzejls that is proxy.. is your client even using the proxy?
Why are you posting in pfblocker group if your using the proxy..
Here is how I would block cnn.com for example.
Now this is what happens in browser, when there is no local cache for cnn.com
-
@johnpoz I am really new to this, blocking specific web sites, so I have no idea where "custom options" would be. Is it pn pfBlockerNG DNSBL or where.
-
@andrzejls hey there,
if I am not mistaken, the last post by @johnpoz is related to proxy config whereas his first post related to pfblocker (sorry if I misunderstood).I would also rather choose blocking via pfblocker and dns-blocklists or individual entries. It is not as memory consuming and (imho) much easier to configure and not as hungry on hardware ressources...as said jm2c.
Also, there are other (already usable) blocklists: for dns searches (dnsbl), for IPv4 and IPv6 in case you have open ports running and do not want all those crappy IPs knocking and trying to enter.
I used to run pihole on a raspi, then tried out pfblockerng (pfsense ce here) and decided to switch over to pfblocker. It works fine here, is nicely integrated with pfsense (as mentioned: aliases work fine) and I can save some energy, not using another device for dns blocking.
BTW: big thanx to the developer of pfblockerng and some karma points to your account...
:) -
@andrzejls said in How to block web site, simple step by step:
so I have no idea where "custom options" would be
That is just in the unbound settings..
I do not use proxy, I do not use pfblocker to block outbound traffic, I do not use it to create rules... I only use it to create native aliases that contain IPs of stuff I want to block inbound to my pfsense on ports I have open.
You can for sure block domains in pfblocker - I just do not use it in that fashion, and so can not just show you a screen shot of how without major changes to my setup..
It seems like your goal is to block cnn.com - and really don't care how you do it. I am showing you the easy way to do it, and how I would do it. Since most anyone using pfsense would be using it as their dns for their network..
Its a simple entry in custom options of unbound.. Now if you have hundreds of domains your trying to block, or want to auto load in lists of bad domain names, etc. Then this would not be the way to skin that cat.
But for your question how to block cnn.com - this would be how I would skin that cat, 10 seconds total time to do it.. Now nobody using pfsense (unbound) for dns on your network is going to resolve cnn.com or anythingelse.whatever.other.cnn.com etc..
-
@johnpoz I thank you for your help, but please understand I am noob in setting individual sites blocking in pfsense. I do not know where, in pfsense, to go to do what you are showing me. My pf sense is setup for dns on my network.
-
@andrzejls in the resolver (unbound)
-
@johnpoz Great, thanks. Now I know where to go, but still I can acces that web site. Should I reboot pfsense, clear Brave cache?.
-
@andrzejls and again - clients have their own cache.. Clear the clients dns cache, on windows that can be done with ipconfig /flushdns, also browsers run their own cache as well.
No you would not need to reboot pfsense.
Do a query for cnn.com - do you get what IP you put in 0.0.0.0 or 127.0.0.1?
Keep in mind also if your actually using the proxy - the proxy is going there for your client and the client is not doing any dns for cnn.com..
-
@johnpoz I still can access web page. Maybe it is me but It seams strange that pfSense being such a powerfull firewall that is is so difficult to block individual web pages.
-
@andrzejls said in How to block web site, simple step by step:
is so difficult to block individual web pages.
It is not difficult - its childs play really with the tools that pfsense provides. But not understanding the tools and how they work, then sure it difficult trying to use a tool you do not understand.
You could block via pfblocker with couple different methods, you could sure block with proxy, or you could just block with simple dns. You could also block via just firewall rules to what IPs you want to block, etc. And you could even just have pfsense resolve some fqdn, and use that IP(s) in a firewall rule.
You could give a cave man a tricoder from star trek - do you think he would be able to use it?
I gave you the simpliest way I can think of to block a domain that has IPs that change, and has multiple IPs.. You just need to use a client that uses pfsense for its dns, and isn't using doh in its browser, etc.. Or using a proxy..
First step - if you setup your domain like I showed in unbound - do a query from your client using nslookup, dig, host - your fav dns tool.. Does it return the blocking IP you put in? If not then your client isn't using pfsense for dns, or you didn't setup unbound correctly to return that IP for that fqdn..
-
@johnpoz said in How to block web site, simple step by step:
@andrzejls said in How to block web site, simple step by step:
is so difficult to block individual web pages.
It is not difficult - its childs play really with the tools that pfsense provides. But not understanding the tools and how they work, then sure it difficult trying to use a tool you do not understand.
You are 100% correct. That is the reason I ask. I removed "squid" so I only run pfblockerNG and "snort"
Here are my "custom options:
-
@andrzejls ok that looks ok even if your loading the pfblocker.conf
So do a query to unbound on pfsense.. Does it return 0.0.0.0 like my examples.
If not - then your client is not using pfsense for dns and can still get to cnn.com, maybe your browser is using doh (dns over http) many browsers love to do that on their own, etc.
Or your local browser or os has the IP of cnn.com still cached.
-
@johnpoz You were right on the money. My Linux laptop Brave browser was set to use 1.1.1.1 DNS. Once I changed that to pfSense IP it works. Thanks for your assistance, patience and understanding my lack of knowledge on this subject.
-
@andrzejls glad you got it sorted.. btw your not really blocking cnn.com are you ;) hehe I take it that is just some test you doing on how to block a site..
-
@johnpoz Of course, it is just a "test" :) hahaha. I am also testing cbs,nbc, and other main stream media.
