Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to block web site, simple step by step

    Scheduled Pinned Locked Moved pfBlockerNG
    20 Posts 3 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @andrzejls
      last edited by

      @andrzejls in the resolver (unbound)

      unbound.jpg

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      andrzejlsA 1 Reply Last reply Reply Quote 0
      • andrzejlsA
        andrzejls @johnpoz
        last edited by

        @johnpoz Great, thanks. Now I know where to go, but still I can acces that web site. Should I reboot pfsense, clear Brave cache?.

        johnpozJ 1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @andrzejls
          last edited by

          @andrzejls and again - clients have their own cache.. Clear the clients dns cache, on windows that can be done with ipconfig /flushdns, also browsers run their own cache as well.

          No you would not need to reboot pfsense.

          Do a query for cnn.com - do you get what IP you put in 0.0.0.0 or 127.0.0.1?

          Keep in mind also if your actually using the proxy - the proxy is going there for your client and the client is not doing any dns for cnn.com..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.7.2, 24.11

          andrzejlsA 1 Reply Last reply Reply Quote 0
          • andrzejlsA
            andrzejls @johnpoz
            last edited by

            @johnpoz I still can access web page. Maybe it is me but It seams strange that pfSense being such a powerfull firewall that is is so difficult to block individual web pages.

            johnpozJ 1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @andrzejls
              last edited by

              @andrzejls said in How to block web site, simple step by step:

              is so difficult to block individual web pages.

              It is not difficult - its childs play really with the tools that pfsense provides. But not understanding the tools and how they work, then sure it difficult trying to use a tool you do not understand.

              You could block via pfblocker with couple different methods, you could sure block with proxy, or you could just block with simple dns. You could also block via just firewall rules to what IPs you want to block, etc. And you could even just have pfsense resolve some fqdn, and use that IP(s) in a firewall rule.

              You could give a cave man a tricoder from star trek - do you think he would be able to use it?

              I gave you the simpliest way I can think of to block a domain that has IPs that change, and has multiple IPs.. You just need to use a client that uses pfsense for its dns, and isn't using doh in its browser, etc.. Or using a proxy..

              First step - if you setup your domain like I showed in unbound - do a query from your client using nslookup, dig, host - your fav dns tool.. Does it return the blocking IP you put in? If not then your client isn't using pfsense for dns, or you didn't setup unbound correctly to return that IP for that fqdn..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.7.2, 24.11

              andrzejlsA 1 Reply Last reply Reply Quote 0
              • andrzejlsA
                andrzejls @johnpoz
                last edited by

                @johnpoz said in How to block web site, simple step by step:

                @andrzejls said in How to block web site, simple step by step:

                is so difficult to block individual web pages.

                It is not difficult - its childs play really with the tools that pfsense provides. But not understanding the tools and how they work, then sure it difficult trying to use a tool you do not understand.

                You are 100% correct. That is the reason I ask. I removed "squid" so I only run pfblockerNG and "snort"
                Here are my "custom options:
                Screenshot from 2023-05-12 13-36-04.png

                johnpozJ 1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator @andrzejls
                  last edited by johnpoz

                  @andrzejls ok that looks ok even if your loading the pfblocker.conf

                  So do a query to unbound on pfsense.. Does it return 0.0.0.0 like my examples.

                  If not - then your client is not using pfsense for dns and can still get to cnn.com, maybe your browser is using doh (dns over http) many browsers love to do that on their own, etc.

                  Or your local browser or os has the IP of cnn.com still cached.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                  andrzejlsA 1 Reply Last reply Reply Quote 0
                  • andrzejlsA
                    andrzejls @johnpoz
                    last edited by

                    @johnpoz You were right on the money. My Linux laptop Brave browser was set to use 1.1.1.1 DNS. Once I changed that to pfSense IP it works. Thanks for your assistance, patience and understanding my lack of knowledge on this subject.

                    johnpozJ 1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator @andrzejls
                      last edited by

                      @andrzejls glad you got it sorted.. btw your not really blocking cnn.com are you ;) hehe I take it that is just some test you doing on how to block a site..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      andrzejlsA 1 Reply Last reply Reply Quote 0
                      • andrzejlsA
                        andrzejls @johnpoz
                        last edited by

                        @johnpoz Of course, it is just a "test" :) hahaha. I am also testing cbs,nbc, and other main stream media.

                        1 Reply Last reply Reply Quote 1
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.