block custom domains in pfblocker

orangehand

@SteveITS I'm trying to use StevenBlack's list. How would I link to it's online location as opposed to pasting in a vast list of url's?

I pasted https://raw.githubusercontent.com/StevenBlack/hosts/master/alternates/porn/hosts into the source filed but it complains it needs a header - any idea what it is aksing for?
The entries in the list are in the format of

0.0.0.0 ck.getcookiestxt.com
0.0.0.0 eu1.clevertap-prod.com
0.0.0.0 wizhumpgyros.com
0.0.0.0 coccyxwickimp.com

etc

Many thanks

stephenw10

Just add a new feed and enter the URL.

guile

It's possible to create a blocklist only to 1 host?

Lets say: I want to block youtube to host 192.168.0.10.

What i've tried:

Add custom "DNSBL Group"
Add youtube.com in DNSBL Custom_List option
Save and Reload
Add LAN Firewall Rule to block the custom list in destination option. In source option add host IP (192.168.0.10).

But it doesn't work.

stephenw10

Right you can't use DNS based lists in firewall rules. Potentially you could create a custom view in Unbound for just that host to prevent it resolving youtube. That's not in pfBlocker though, you should open a new thread for that if you choose to try it.

Gertjan

@guile said in block custom domains in pfblocker:

Add LAN Firewall Rule to block the custom list in destination option.

A firewall rule is build with source and destination IP addresses or networks, source and destinations port.
The thing is, youtube.com doesn't have 'one' IP, but several, or worse , a lot of IP addresses.
Even if you were able to get them all, that list would be valid for a small amount of time - a couple of minutes.

Let's test :

[25.03-BETA][root@pfSense.bhf.tld]/root: host www.youtube.com
www.youtube.com is an alias for youtube-ui.l.google.com.
youtube-ui.l.google.com has address 172.217.18.206
youtube-ui.l.google.com has address 142.250.74.238
youtube-ui.l.google.com has address 142.250.75.238
youtube-ui.l.google.com has address 216.58.214.174
youtube-ui.l.google.com has address 172.217.20.174
youtube-ui.l.google.com has address 172.217.20.206
youtube-ui.l.google.com has address 216.58.215.46
youtube-ui.l.google.com has address 216.58.213.78
youtube-ui.l.google.com has address 142.250.179.78
youtube-ui.l.google.com has address 142.250.179.110
youtube-ui.l.google.com has address 142.250.178.142
youtube-ui.l.google.com has address 142.250.201.174
youtube-ui.l.google.com has IPv6 address 2a00:1450:4007:80c::200e
youtube-ui.l.google.com has IPv6 address 2a00:1450:4007:810::200e
youtube-ui.l.google.com has IPv6 address 2a00:1450:4007:80d::200e
youtube-ui.l.google.com has IPv6 address 2a00:1450:4007:80e::200e

So, throw "www.youtube.com" in a Alias :

and now, go check this Alias :

and by magic, the Alias get filled with the actual IPs. Even better : the alias will get refreshed this IP list every 300 seconds or 5 minutes.

This works pretty well, and probably enough so the owner of "192.168.0.10" stops trying to visit "www.youtube.com".

Now, all you have to do is : create a block firewall rule on your LAN, with the source IP set to the IP of the victim : 192.168.0.10 - and a destination set the name of the alias : "youtube". Ports and other are not important = 'any'. The protocol should be set to TCP.
save the rule, and have a casual visit to the owner of 192.168.0.10 and ask if "all is well ?" ;) If you don't, he'll be visiting you shortly after.

Be aware : if this owner knows how to look things up, he'll find out that changing his IP to "192.168.0.11" will by pass your firewall rule ...
( and randomize its MAC, etc etc - and eventually just not using your (LAN) network anymore )

guile

@Gertjan

I tried what u said and sometimes works, sometimes dont.

I think the alias table refresh the IPs, and dont keep the "old" IPs.

stephenw10

Yes, the number of IPs used by Youtube is potentially huge and varies rapidly.

You can try to block by ASN but that will almost certainly catch a lot of Google's other services.

guile

@stephenw10

yea, i tried ASN but it blocks not ONLY youtube but google search, gmail, maps.. etc

Ill try unbound view like u said.. never tried this before.

Gertjan

@guile said in block custom domains in pfblocker:

and sometimes works, sometimes dont.

That's what the second Yellow "Warning" is all about : Hostnames in Aliases.

The TTL of all Google, Microsoft, Apple, Yahoo, Facebook, etc etc is very low. And they used thousands of IP addresses, that they 'activate' and 'de activate'. So DNS re re resoltuion will happen all the time, new IPs pop up, and before the Alias thus firewall gets relaoded, a LAN client device can alreayd us an IP that wasn't listed.
And ones the firewall state says ok, even if the Ip gets blocked a second later, the active state will allow traffic up until the state expires.
Their (Google, and so on) hire system admins with one mission in mind : that their potential clients, and that will be the entire planet, can always reach them, whatever it takes. For the simple reason that billions ($, €, #) are at stake here. So they hired the best.

As said above : you could, with pfBlockerng, go the ASN way. An ASN is an ID that contains all IPs used by the owner of that ISD (ASN).L Google has ASN 15169.
Using that ASN ID, all Google (Meta) related IPs will be blocked, that will includes maps, mails, the search engine, all the addware sites, etc etc etc etc. A sledge hammer approach.
It works, because Google (Youtube) won't use ASN 8075 (Microsoft owned) IPs.

edit : ok, you've tried that. Works great, right and I get it, it works to well.

Another solution, if you have full cooperation with the 192.168.0.10 owner, is using a proxy. The rpoxy will intercept all https requests, and filter all the web requests. If it find a "youtube.com", you could drop that request.
Setting up a a proxy is a very advanced filter is complex, and imho, a real pain-in-the-admin's-but, as things constantly breaks, changes, and you have to understand how Internet actually works so you can bend the rules (a bit).

guile

@Gertjan

Before using pfSense I used CentOS (iptables and squid) for yearssss.. But proxy is pain, no more that for me.. lol.

Im thinking to change the local host file of that machine. The user of that machine, barely knows how to send a email, so i think this should work. I was trying doing this on firewall, to learn if i need this in the future for more machines on my lan.

I can change the host file OR the unbound view method.