Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    186 Posts 44 Posters 136.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hugovsky
      last edited by

      I've found that I had to use the "server:" by accident. I'm using this to block dns from ads and spyware. Just make a file and put it at /conf folder to survive updates. Then, use this syntax:

      server:
      include: /conf/local-blocking-data.conf
      include: ………
      ….

      and it works. Free ad internet.

      the file itself is in this format:

      local-data: "000freexxx.com A 0.0.0.0"
      local-data: "004.frnl.de A 0.0.0.0"
      local-data: "01sexe.com A 0.0.0.0"
      local-data: "01viral.com A 0.0.0.0"
      local-data: "039068a.dialer-select.com A 0.0.0.0"
      local-data: "0427d7.se A 0.0.0.0"
      local-data: "0702.de A 0.0.0.0"
      ……

      I use a script to generate it from varius sources like http://pgl.yoyo.org/adservers/ or https://github.com/jodrell/unbound-block-hosts.

      1 Reply Last reply Reply Quote 0
      • H
        Hugovsky
        last edited by

        But there seems to be something wrong. If I use advanced options, I can't use "Register DHCP leases in the DNS Resolver" enabled. Although it works fine.

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          Yeah I see this

          Below is a minimal config file. The  source  distribution  contains  an
                extensive example.conf file with all the options.

          # unbound.conf(5) config file for unbound(8).
                server:
                      directory: "/etc/unbound"

          But I assume the stuff in this box is for the server, so didn't think would have to add that, etc.  Be nice to be able to use the include: directive as well to load a specific file with say host over rides in it, etc.  But can not seem to be able to figure out how to get include: to work using this advanced box?

          from your unbound doc link

          Files  can be included using the include: directive. It can appear any-
                where, it accepts a single file name as argument.  Processing continues
                as  if  the text from the included file was copied into the config file
                at that point.

          If that would work - that would be pretty slick ;)

          the only notes on the advanced box are
          "Enter any additional configuration parameters to add to the DNS Resolver configuration here, separated by a newline"

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            include: works, already used by default

            
            $ grep include: /var/unbound/unbound.conf
            include: /var/unbound/access_lists.conf
            include: /var/unbound/host_entries.conf
            include: /var/unbound/dhcpleases_entries.conf
            include: /var/unbound/domainoverrides.conf
            include: /var/unbound/remotecontrol.conf
            
            

            Though, the issue is… if you create something there outside of pfS awareness, the files will vanish sooner or later, at least on nanobsd.

            1 Reply Last reply Reply Quote 0
            • H
              Hugovsky
              last edited by

              I think I've answered both of you in my previous post. I think we're talking about the same.

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                Oh so you need to have .conf on the end of it?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • H
                  Hugovsky
                  last edited by

                  I've made a file to put in /conf folder and inside the file I've put:

                  local-data: "000freexxx.com A 0.0.0.0"
                  local-data: "004.frnl.de A 0.0.0.0"
                  local-data: "01sexe.com A 0.0.0.0"
                  local-data: "01viral.com A 0.0.0.0"
                  local-data: "039068a.dialer-select.com A 0.0.0.0"
                  local-data: "0427d7.se A 0.0.0.0"
                  local-data: "0702.de A 0.0.0.0"
                  etc…

                  Save file as something.conf and it works.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    yeah that is exactly what others were looking for!  Thanks!

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • ?
                      Guest
                      last edited by

                      @doktornotor:

                      include: works, already used by default

                      
                      $ grep include: /var/unbound/unbound.conf
                      include: /var/unbound/access_lists.conf
                      include: /var/unbound/host_entries.conf
                      include: /var/unbound/dhcpleases_entries.conf
                      include: /var/unbound/domainoverrides.conf
                      include: /var/unbound/remotecontrol.conf
                      
                      

                      Though, the issue is… if you create something there outside of pfS awareness, the files will vanish sooner or later, at least on nanobsd.

                      Open a bug ('feature request'), and maybe this can be addressed in a 2.2.1 or 2.3.

                      Jim

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        Seriously, I think all that's needed now it to tell people to prefix their advanced configuration with a proper clause (with a wiki/manpage link or whatever.) Prevents invalid bugs as well. (Persistent includes could be done right now via one of the file manager packages that store the files in config.xml, I guess.)

                        1 Reply Last reply Reply Quote 0
                        • W
                          wagonza
                          last edited by

                          @johnpoz has made a note of it at https://doc.pfsense.org/index.php/Unbound_DNS_Resolver#Configuration - it can always be revisited for 2.2.1 or whatever in the future. To late now.

                          Follow me on twitter http://twitter.com/wagonza
                          http://www.thepackethub.co.za

                          1 Reply Last reply Reply Quote 0
                          • dennypageD
                            dennypage
                            last edited by

                            What is the advantage of putting this in the "Advanced" section instead of the "Host Overrides" section?

                            @johnpoz:

                            local-data: "click01.aditic.net A 10.10.10.1"

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              @dennypage:

                              What is the advantage of putting this in the "Advanced" section instead of the "Host Overrides" section?

                              Ever tried to put hundreds/thousands entries in there (like, ad blocking)? :D

                              1 Reply Last reply Reply Quote 0
                              • H
                                Hugovsky
                                last edited by

                                Exactly. I have 70.000+ domains excluded.

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  Guest
                                  last edited by

                                  @doktornotor:

                                  Seriously, I think all that's needed now it to tell people to prefix their advanced configuration with a proper clause (with a wiki/manpage link or whatever.) Prevents invalid bugs as well. (Persistent includes could be done right now via one of the file manager packages that store the files in config.xml, I guess.)

                                  Naw, we should make sure that feeds for this are bundled in pfSense Gold!

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    I have already added DNSBL to pfBlockerNG… I have been testing this with a few Testers for a couple weeks now... I think its best to use Unbound Resolver, but its not too difficult to format the lists for DNSMasq.

                                    pfBlockerNG already has a download list scheduler so it was easy to add this functionality. I have added Domain parsers for the following lists so far:

                                    1. yoyo
                                    2. HPHosts
                                    3. Adaway
                                    4. Malware Domains
                                    5. Someonewhocares
                                    6. WinHelp
                                    7. Malware Domain Lists
                                      8 ) Phishtank (these are converted from URLs… so they can cause some FPs)
                                    8. Emerging Threats IQRisk Domain list
                                    9. Dshield
                                    10. Bambenek GOZ
                                    11. Squid Blacklists

                                    The domains are placed into a single list for Unbound Resolver (about 2 million malicious domains and Advert Domain).

                                    local-data: "googlesyndication.com A 10.10.10.1"

                                    A NAT rule on the LAN interface will forward  10.10.10.1:80  to  127.0.01:8081. Which is a new Lighttpd Web server service on the pfSense Box (VIP and NAT are customizable) …  For http requests it will load the index.php file and record the event and update the widget counter. Still working on improving https alerts and trying not to do any MITM. Currently a "1x1" Gif is sent to fill the Browsers Advert space..

                                    Unbound can also load a python script which would simplify some of this process where the script could record the Rejected Request. Other improvements could be ACL to customize the Domain Blocking as currently it will block for any DNS Request. I don't think that Unbound is currently compiled with python script ability.

                                    Sample Logfile -

                                    DNSBL Reject,Jan 9 22:42:16,b.scorecardresearch.com,xx.xx.xx.xx,/b?c1=1&c2=1000009&c3=Thomson%20Reuters%20LLC&c4=5Min_unknown_AOL&c5=040800&c6=News/General%20News

                                    Here are some Screenshots of DNSBL in pfBlockerNG…

                                    My Pull Request for pfBlockerNG v1.0 has been merged but is waiting for final review.

                                    I hope to have the bugs worked out for DNSBL fairly soon and I will release this in v2.0

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      dstroot
                                      last edited by

                                      I know this is the Unbound Resolver thread but I wanted to chime in and say it would be really nice to get pfBlockerNG through the review process and into the packages repo.  I have been one of the testers and 1) it's solid and 2) it adds a great deal of security functionality.  Now that 2.2 is nearing release maybe that can happen - fingers crossed.

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        raab
                                        last edited by

                                        @dstroot:

                                        I know this is the Unbound Resolver thread but I wanted to chime in and say it would be really nice to get pfBlockerNG through the review process and into the packages repo.  I have been one of the testers and 1) it's solid and 2) it adds a great deal of security functionality.  Now that 2.22 is nearing release maybe that can happen - fingers crossed.

                                        +1 to this, have enjoyed watching the progression bbcan177 has made

                                        1 Reply Last reply Reply Quote 0
                                        • W
                                          wcrowder
                                          last edited by

                                          @doktornotor:

                                          @dennypage:

                                          What is the advantage of putting this in the "Advanced" section instead of the "Host Overrides" section?

                                          Ever tried to put hundreds/thousands entries in there (like, ad blocking)? :D

                                          Something like 45,618? Wouldn't it be nice to have a package that put's it all together? Ad blocking, is that really politically correct?  :P

                                          DNSResolver.JPG
                                          DNSResolver.JPG_thumb
                                          Alerts.JPG
                                          Alerts.JPG_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.