Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Block xxx rated pages redirections (CNAME -> A) - pfblockerng

    Scheduled Pinned Locked Moved General pfSense Questions
    25 Posts 4 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Ah good catch!. But it still shows the server as being 192.168.2.1 when returns the real IP address. 🤔

      1 Reply Last reply Reply Quote 0
      • S
        s3b0 @Gertjan
        last edited by

        @Gertjan switched to:
        78129f9d-0678-4b0d-a460-a98eefaa90c4-image.png

        same effect :(

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Hmm, must be something in your config I can't replicate that here:

          [24.11-RELEASE][admin@fw1.stevew.lan]/root: dig www.doubleclick.com +short
10.10.10.1
[24.11-RELEASE][admin@fw1.stevew.lan]/root: dig www.doubleclick.com +short
10.10.10.1
[24.11-RELEASE][admin@fw1.stevew.lan]/root: dig www.doubleclick.com +short
10.10.10.1
[24.11-RELEASE][admin@fw1.stevew.lan]/root: dig www.doubleclick.com +short
10.10.10.1
[24.11-RELEASE][admin@fw1.stevew.lan]/root: dig doubleclick.com +short
10.10.10.1
[24.11-RELEASE][admin@fw1.stevew.lan]/root: dig doubleclick.com +short
10.10.10.1
[24.11-RELEASE][admin@fw1.stevew.lan]/root: dig doubleclick.com +short
10.10.10.1

          Where are you testing from? I had assumed it was from pfSense directly but now I look it can't be since it's not using localhost.

          So I still think it's either the client using a different DNS server directly or something cached at the client.

          S 1 Reply Last reply Reply Quote 0
          • S
            s3b0 @stephenw10
            last edited by s3b0

            @stephenw10 i have same results on pfsense

            [2.7.2-RELEASE][root@gateway.home]/root: dig www.pornhub.com

; <<>> DiG 9.18.19 <<>> www.pornhub.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63322
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1432
;; QUESTION SECTION:
;www.pornhub.com.               IN      A

;; ANSWER SECTION:
www.pornhub.com.        11712   IN      CNAME   pornhub.com.
pornhub.com.            11712   IN      A       66.254.114.41

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Wed Jan 22 12:34:17 CET 2025
;; MSG SIZE  rcvd: 74

            [2.7.2-RELEASE][root@gateway.home]/root: dig pornhub.com

; <<>> DiG 9.18.19 <<>> pornhub.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44379
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1432
;; QUESTION SECTION:
;pornhub.com.                   IN      A

;; ANSWER SECTION:
pornhub.com.            60      IN      A       10.10.10.1

;; Query time: 14 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Wed Jan 22 12:36:22 CET 2025
;; MSG SIZE  rcvd: 56

            And still: after restarting unbound url with www at the begging returns 10.10.10.1 and second try returns real ip ... have no clue why.

            1 Reply Last reply Reply Quote 0
            • S
              s3b0
              last edited by s3b0

              Maybe i has something to do with my rules - don't know just asking more wiser users ;)

              I blocked traffic to other dnses than my by fw rule and NAT forwarding like so:
              NAT
              4dffe770-4fe3-4f5b-ab64-032dfcca1d01-image.png
              FW rules(LAN tab):
              cd595e90-865d-4c58-bd5c-d0ee3d87bee3-image.png

              GertjanG 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @s3b0
                last edited by

                @s3b0

                This one :

                14793e92-d582-4e3c-94bf-5e25b312c340-image.png

                and related firewall rule doesn't need UDP.
                TLS is always TCP.

                If you do not set up DNS over TLS on port 853 on your LAN clients, it won't get used.
                Just look at the related firewall rule of that NAT rule : the counters will always stay at "0/0" = the rule never applied.

                And even better : 853 uses TLS, so a certificate is used.
                Let say you do DNS over TLS using port 853 to 1.1.1.1. Your rule will match, and redirect TLS traffic to 127.0.0.1.
                The server that replies ( aha : unbound on its 853 port !) will it have a certificate that says it's "I am one.one.one.one !" ? Nope. Impossible. You are not 1.1.1.1 (one.one.one.one) so the very first ground rule of the TLS connection is already broken, it will probably fail.
                So, don't bother NATting that DNS TLS traffic. If you don't want it, block it. This will signal the LAN client that DNS over TLS isn't available It will fall back to classic UDP/TCP traffic over port 53.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                S 1 Reply Last reply Reply Quote 0
                • S
                  s3b0 @Gertjan
                  last edited by

                  @Gertjan thx, I just corrected those settings (NAT removed for Dns over TLS, and fw rule changed to block that traffic).
                  But issue with CNAME still unsolved :(

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Did you try turning up the Unbound logging level and checking what it's actually seeing yet?

                    I suspect it's not seeing that second request at all for some reason.

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      s3b0 @stephenw10
                      last edited by

                      @stephenw10 i think that unbound works as expected(?):

                      139ef85e-ba87-40f3-860c-0fe24b7d49f9-image.png

                      info from pfblockerng unified report:

                      da49dd54-3c7a-4e77-bc35-63c5248d48b5-image.png
                      df7f334c-154b-4648-97eb-3b779bca4911-image.png

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @s3b0
                        last edited by Gertjan

                        @s3b0 said in Block xxx rated pages redirections (CNAME -> A) - pfblockerng:

                        But issue with CNAME still unsolved :(

                        AS I don't have DNSBL that blocks this porn site, I activated the heavy artillery (regex) :

                        83713cb1-6edb-431a-90e6-f481d9d870ee-image.png

                        ^pornhub.* #Comment-line-1
^www.pornhub.* #Comment-Line-2

                        and now :

                        8c73246b-4fbd-4702-a2c7-441acbcfc228-image.png

                        same thing for the the domain without "www."

                        Still a (small) problem, for me, as suddenly "10.10.10.1" (The default web server "You are blocked" IP is returned, and not the 0.0.0.0 == NULL logging and blocking).

                        From none of my device I can access p#rnhub anymore.
                        And that's a problem for me, as I have a hotel here 😊 (kids are not my problem, they don't pay the bills here)

                        dit :
                        Intercepted :

                        8960cf06-85fa-46c4-bdbf-853343cdec3b-image.png

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        S 1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Hmm, so you are seeing all queries reach Unbound and be answered? But it just looks like the TLD option fails to match the list on the repeat query.... 🤔

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            s3b0 @stephenw10
                            last edited by

                            @stephenw10 i think that is the problem here - maybe bug?

                            1 Reply Last reply Reply Quote 0
                            • S
                              s3b0 @Gertjan
                              last edited by

                              @Gertjan as a last resort i will enable that ;). If i would be owner of hotel i also would not enable that ;)

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.