Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNS Resolver

    Scheduled Pinned Locked Moved 2.2 Snapshot Feedback and Problems - RETIRED
    186 Posts 44 Posters 136.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hugovsky
      last edited by

      I've made a file to put in /conf folder and inside the file I've put:

      local-data: "000freexxx.com A 0.0.0.0"
      local-data: "004.frnl.de A 0.0.0.0"
      local-data: "01sexe.com A 0.0.0.0"
      local-data: "01viral.com A 0.0.0.0"
      local-data: "039068a.dialer-select.com A 0.0.0.0"
      local-data: "0427d7.se A 0.0.0.0"
      local-data: "0702.de A 0.0.0.0"
      etc…

      Save file as something.conf and it works.

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        yeah that is exactly what others were looking for!  Thanks!

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

        1 Reply Last reply Reply Quote 0
        • ?
          Guest
          last edited by

          @doktornotor:

          include: works, already used by default

          
          $ grep include: /var/unbound/unbound.conf
          include: /var/unbound/access_lists.conf
          include: /var/unbound/host_entries.conf
          include: /var/unbound/dhcpleases_entries.conf
          include: /var/unbound/domainoverrides.conf
          include: /var/unbound/remotecontrol.conf
          
          

          Though, the issue is… if you create something there outside of pfS awareness, the files will vanish sooner or later, at least on nanobsd.

          Open a bug ('feature request'), and maybe this can be addressed in a 2.2.1 or 2.3.

          Jim

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            Seriously, I think all that's needed now it to tell people to prefix their advanced configuration with a proper clause (with a wiki/manpage link or whatever.) Prevents invalid bugs as well. (Persistent includes could be done right now via one of the file manager packages that store the files in config.xml, I guess.)

            1 Reply Last reply Reply Quote 0
            • W
              wagonza
              last edited by

              @johnpoz has made a note of it at https://doc.pfsense.org/index.php/Unbound_DNS_Resolver#Configuration - it can always be revisited for 2.2.1 or whatever in the future. To late now.

              Follow me on twitter http://twitter.com/wagonza
              http://www.thepackethub.co.za

              1 Reply Last reply Reply Quote 0
              • dennypageD
                dennypage
                last edited by

                What is the advantage of putting this in the "Advanced" section instead of the "Host Overrides" section?

                @johnpoz:

                local-data: "click01.aditic.net A 10.10.10.1"

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  @dennypage:

                  What is the advantage of putting this in the "Advanced" section instead of the "Host Overrides" section?

                  Ever tried to put hundreds/thousands entries in there (like, ad blocking)? :D

                  1 Reply Last reply Reply Quote 0
                  • H
                    Hugovsky
                    last edited by

                    Exactly. I have 70.000+ domains excluded.

                    1 Reply Last reply Reply Quote 0
                    • ?
                      Guest
                      last edited by

                      @doktornotor:

                      Seriously, I think all that's needed now it to tell people to prefix their advanced configuration with a proper clause (with a wiki/manpage link or whatever.) Prevents invalid bugs as well. (Persistent includes could be done right now via one of the file manager packages that store the files in config.xml, I guess.)

                      Naw, we should make sure that feeds for this are bundled in pfSense Gold!

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        I have already added DNSBL to pfBlockerNG… I have been testing this with a few Testers for a couple weeks now... I think its best to use Unbound Resolver, but its not too difficult to format the lists for DNSMasq.

                        pfBlockerNG already has a download list scheduler so it was easy to add this functionality. I have added Domain parsers for the following lists so far:

                        1. yoyo
                        2. HPHosts
                        3. Adaway
                        4. Malware Domains
                        5. Someonewhocares
                        6. WinHelp
                        7. Malware Domain Lists
                          8 ) Phishtank (these are converted from URLs… so they can cause some FPs)
                        8. Emerging Threats IQRisk Domain list
                        9. Dshield
                        10. Bambenek GOZ
                        11. Squid Blacklists

                        The domains are placed into a single list for Unbound Resolver (about 2 million malicious domains and Advert Domain).

                        local-data: "googlesyndication.com A 10.10.10.1"

                        A NAT rule on the LAN interface will forward  10.10.10.1:80  to  127.0.01:8081. Which is a new Lighttpd Web server service on the pfSense Box (VIP and NAT are customizable) …  For http requests it will load the index.php file and record the event and update the widget counter. Still working on improving https alerts and trying not to do any MITM. Currently a "1x1" Gif is sent to fill the Browsers Advert space..

                        Unbound can also load a python script which would simplify some of this process where the script could record the Rejected Request. Other improvements could be ACL to customize the Domain Blocking as currently it will block for any DNS Request. I don't think that Unbound is currently compiled with python script ability.

                        Sample Logfile -

                        DNSBL Reject,Jan 9 22:42:16,b.scorecardresearch.com,xx.xx.xx.xx,/b?c1=1&c2=1000009&c3=Thomson%20Reuters%20LLC&c4=5Min_unknown_AOL&c5=040800&c6=News/General%20News

                        Here are some Screenshots of DNSBL in pfBlockerNG…

                        My Pull Request for pfBlockerNG v1.0 has been merged but is waiting for final review.

                        I hope to have the bugs worked out for DNSBL fairly soon and I will release this in v2.0

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • D
                          dstroot
                          last edited by

                          I know this is the Unbound Resolver thread but I wanted to chime in and say it would be really nice to get pfBlockerNG through the review process and into the packages repo.  I have been one of the testers and 1) it's solid and 2) it adds a great deal of security functionality.  Now that 2.2 is nearing release maybe that can happen - fingers crossed.

                          1 Reply Last reply Reply Quote 0
                          • R
                            raab
                            last edited by

                            @dstroot:

                            I know this is the Unbound Resolver thread but I wanted to chime in and say it would be really nice to get pfBlockerNG through the review process and into the packages repo.  I have been one of the testers and 1) it's solid and 2) it adds a great deal of security functionality.  Now that 2.22 is nearing release maybe that can happen - fingers crossed.

                            +1 to this, have enjoyed watching the progression bbcan177 has made

                            1 Reply Last reply Reply Quote 0
                            • W
                              wcrowder
                              last edited by

                              @doktornotor:

                              @dennypage:

                              What is the advantage of putting this in the "Advanced" section instead of the "Host Overrides" section?

                              Ever tried to put hundreds/thousands entries in there (like, ad blocking)? :D

                              Something like 45,618? Wouldn't it be nice to have a package that put's it all together? Ad blocking, is that really politically correct?  :P

                              DNSResolver.JPG
                              DNSResolver.JPG_thumb
                              Alerts.JPG
                              Alerts.JPG_thumb

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.