block custom domains in pfblocker

GregBinSD

Sorry, Tom. Try one more thing.

Looking above a little, johnpoz pasted just these lines into the Customs options box, leaving out the pfblocker line:

server:
local-zone: "facebook.com" redirect
local-data: "facebook.com A 127.0.0.1"

So, clear out the Customs options box and paste in the 3 lines above, like johnpoz did.

BTW, at Windows cmd prompt, clear the DNS cache by typing:
ipconfig /flushdns

...and clear your browser's cache of history and files, as well, before testing your results.

Greg

TopperTom

@GregBinSD

But isn't the pfblocker line responsible for loading the blocklist feeds?

GregBinSD

Tom, johnpoz knows for sure, but from what I have gathered, the DNS used by pfSense is called "unbound", and it can be seen running in the background if you go to Status/Services. Unbound can read those 3 lines without the help of pfBlockerNG. In fact, I am experimenting with a TLS encrypted DNS service, without using pfBlockerNG. The developer had me put 8 lines into the Custom options box, along with setting some parameters giving me an account on his web interface. None of those lines reference pfb.

stephenw10

I would add them through pfBlocker as I outlined above. But pfBlocker just adds it's own additional config there so you can add it manually to Unbound if you want.

If the pfb_dnsbl include file already has a zone defined for facebook.com you might be conflicting. Try adding something completely different there.

Steve

OlofTheBald

@TopperTom Hey Tom, I made an account just to answer your question here, as you're very very close to having this correct.

You can put the include for your conf file at the bottom of the box and any server includes you need at the top. I run this exact thing on my box while I'm experimenting with blocking Youtube ads. Here's what my custom options look like:

server:
local-zone: "manifest.googlevideo.com" redirect
local-data: "manifest.googlevideo.com A 10.10.10.1"
include: /var/unbound/pfb_dnsbl.*conf

I hope this helps relieve the frustrations you've had with this so far.

stephenw10

Yes, that should work as long as manifest.googlevideo.com is not defined as a local-zone in pfb_dnsbl.conf already. I think that was the problem previously. Once we removed the two server entries.

Steve

OlofTheBald

@stephenw10 said in block custom domains in pfblocker:

Yes, that should work as long as manifest.googlevideo.com is not defined as a local-zone in pfb_dnsbl.conf already. I thing that was the problem previously. Once we removed the two server entries.

Steve

Ah, that makes sense. After reading back through the thread again, I see that GregBinSD made the same recommendation that I did and Tom still had problems with that. In this use case, I'd have to echo what others have already said about just making a custom feed and putting any entries needed in there.

SteveITS

This is an old topic but it's the second search result. In the current (ex-devel, now same as -devel) version of pfBlockerNG it is under:

Firewall/pfBlockerNG/DNSBL/DNSBL Groups
edit an existing group or create a new group
expand DNSBL Custom_List towards the bottom (below Advanced Tuneables)
add hostnames to the large text box

Save. If you created a new group remember to set Action=Unbound (instead of Disabled). Run a pfB Update.

orangehand

@SteveITS I'm trying to use StevenBlack's list. How would I link to it's online location as opposed to pasting in a vast list of url's?

I pasted https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn/hosts into the source filed but it complains it needs a header - any idea what it is aksing for?
The entries in the list are in the format of

0.0.0.0 ck.getcookiestxt.com
0.0.0.0 eu1.clevertap-prod.com
0.0.0.0 wizhumpgyros.com
0.0.0.0 coccyxwickimp.com

etc

Many thanks

stephenw10

Just add a new feed and enter the URL.