Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    What's up with the whitelist not working on DNSBL?

    Scheduled Pinned Locked Moved pfBlockerNG
    13 Posts 3 Posters 7.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      It might not be that domain that is the issue… You can see if the domain is still listed in DNSBL:

      grep ".icloud.com" /var/db/pfblockerng/dnsbl/*
      grep ".icloud.com" /var/unbound/pfb_dnsbl.conf

      It might be another domain, check F12 in the browser and goto Dev mode to see the console error msgs. Or review the Alerts tab logs...

      Sometimes its a CNAME that also needs to be whitelisted.

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • P
        pfBasic Banned
        last edited by

        I tried clearing console errors, then going to the webpage, no console errors. My alerts tab only shows one entry when I go to the page and it's the one I posted for icloud.com.

        Both of those greps returned a long list of entries.

        1 Reply Last reply Reply Quote 0
        • M
          motific
          last edited by

          Do a DNS query in pfSense.  That will return either a CNAME or an IP address.

          If the result is a CNAME then requery on that until a query returns the IP of pfBlockerNG's web server.

          Whatever domain resolves to that IP is the one you need to whitelist.

          As an aside, I have noticed many of the list authors are quite harsh on blocking MS and Apple domains, yet are quite content to allow google to be vastly more invasive in terms of privacy and tracking; I wonder if that is more of a reflection on google's wholesale monopoly abuse, or the list authors' preferences?

          1 Reply Last reply Reply Quote 0
          • P
            pfBasic Banned
            last edited by

            I ran the DNS lookup, got four IP's. I re-queried each IP and none resolved 10.10.10.1.

            Is that what you meant? I'm not getting any returns for CNAME's.

            Untitled.png
            Untitled.png_thumb
            Untitled1.png
            Untitled1.png_thumb

            1 Reply Last reply Reply Quote 0
            • M
              motific
              last edited by

              It is what I meant - I checked it here, the problem is you're checking the wrong domain.

              HTTP queries for icloud.com issue an 301 (permanently moved) response redirecting to (drum roll) www.icloud.com - try searching on that and see how you get on?

              (Yes, I could just tell you which domain to whitelist, but I'm trying to teach you to fish here in case it happens again.)

              1 Reply Last reply Reply Quote 0
              • P
                pfBasic Banned
                last edited by

                Well, doing a DNS lookup for www.icloud.com does resolve 10.10.10.1…. But I'm not seeing what good this is doing?

                In my Custom Whitelist I placed

                .icloud.com

                Which whitelist all subdomains of icloud.com.

                Prefix Domain with a "." to Whitelist all Sub-Domains.  IE: (.example.com)

                I tried adding

                www.icloud.com

                saving & force reloading.
                But it doesn't make any difference.

                DNSBL is already identifying that the site is whitelisted, but is still redirecting to a blackhole.

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  This command will list any CNAMES for a domain… it will use @8.8.8.8 (You can change that to any external NS server)... You don't want to use the pfSense resolver as it would return the DNSBL VIP.

                  I don't see any of these domains/CNAMES in any Feed... But try to grep for those and see if they come up... grep for the start of the domain name. IE:  ".akadns.net" etc...

                  drill @8.8.8.8 www.icloud.com

                  ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 4609
                  ;; flags: qr rd ra ; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0
                  ;; QUESTION SECTION:
                  ;; www.icloud.com.      IN      A

                  ;; ANSWER SECTION:
                  www.icloud.com. 3119    IN      CNAME  www-cdn.icloud.com.akadns.net.
                  www-cdn.icloud.com.akadns.net.  73      IN      CNAME  www.icloud.com.edgekey.net.
                  www.icloud.com.edgekey.net.    17250  IN      CNAME  e4478.a.akamaiedge.net.
                  e4478.a.akamaiedge.net. 9      IN      A      23.15.152.140

                  ;; AUTHORITY SECTION:

                  ;; ADDITIONAL SECTION:

                  ;; Query time: 17 msec
                  ;; SERVER: 8.8.8.8
                  ;; WHEN: Thu Jun 29 19:13:56 2017
                  ;; MSG SIZE  rcvd: 161

                  You can also run the following and if it replies back with the DNSBL IP, then its blocked… Did you try to clear your browser and /OS cache... Or reboot the LAN device?

                  host -t A www.icloud.com

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfBasic Banned
                    last edited by

                    I had already added

                    www-cdn.icloud.com.akadns.net

                    With no effect, I'll see if I can find any more to add, try the rest of what you mentioned and report back.

                    Thanks for the help!

                    1 Reply Last reply Reply Quote 0
                    • P
                      pfBasic Banned
                      last edited by 

                      [2.4.0-BETA][admin@netbox.network]/root: grep ".akadns.net" /var/db/pfblockerng/dnsbl/*
/var/db/pfblockerng/dnsbl/Cameleon.txt:local-data: "adfarm.mplx.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/Cameleon.txt:local-data: "img.mplx.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/Cameleon.txt:local-data: "www.burstnet.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SBh_p.txt:local-data: "sls.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SBh_p.txt:local-data: "statsfe2.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "ads.adxpose.mpire.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "ads1.perfadbrite.com.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "lb1.www.ms.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "schemas.microsoft.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "track-apmebf.cj.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/sh2pfB_0.txt:local-data: "ads.as4x.tmcs.akadns.net 60 IN A 10.10.10.1"
[2.4.0-BETA][admin@netbox.network]/root: grep ".akadns.net" /var/unbound/pfb_dnsbl.conf
local-data: "adfarm.mplx.akadns.net 60 IN A 10.10.10.1"
local-data: "img.mplx.akadns.net 60 IN A 10.10.10.1"
local-data: "www.burstnet.akadns.net 60 IN A 10.10.10.1"
local-data: "ads.adxpose.mpire.akadns.net 60 IN A 10.10.10.1"
local-data: "ads1.perfadbrite.com.akadns.net 60 IN A 10.10.10.1"
local-data: "lb1.www.ms.akadns.net 60 IN A 10.10.10.1"
local-data: "schemas.microsoft.akadns.net 60 IN A 10.10.10.1"
local-data: "track-apmebf.cj.akadns.net 60 IN A 10.10.10.1"
local-data: "ads.as4x.tmcs.akadns.net 60 IN A 10.10.10.1"
local-data: "sls.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
local-data: "statsfe2.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
[2.4.0-BETA][admin@netbox.network]/root: host -t A www.icloud.com
www.icloud.com has address 10.10.10.1
                      1 Reply Last reply Reply Quote 0
                      • P
                        pfBasic Banned
                        last edited by

                        I've added all of these so far and still blackholing.

                        www.icloud.com
.www.icloud.com
icloud.com
.icloud.com
www-cdn.icloud.com.akadns.net #CNAME for icloud.com
.icloud.com.akadns.net
.icloud.com.edgekey.net
www.icloud.com.edgekey.net
e4478.a.akamaiedge.net
                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          Hmm I checked again and that domain is listed in hpHosts_PSH Feed… Will have to contact the maintainer of that feed.

                          grep "www.icloud.com" /var/db/pfblockerng/dnsblorig/*

                          /var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-findi.top
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-ios9.cc
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-manage.net
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-na.cc
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.21.0x7.pn.ci.fmip-12.in
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.ht
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.iphonc.win
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.reported.me

                          I used the Alerts Tab to whitelist "www.icloud.com" and it automatically added the following to the DNSBL Whitelist:

                          .www.icloud.com
.www-cdn.icloud.com.akadns.net # CNAME for (www.icloud.com)
.www.icloud.com.edgekey.net # CNAME for (www.icloud.com)
.e4478.a.akamaiedge.net # CNAME for (www.icloud.com)

                          It was blocked before whitelisting it but now replies back with:

                          host -t A www.icloud.com

                          www.icloud.com is an alias for www-cdn.icloud.com.akadns.net.
                          www-cdn.icloud.com.akadns.net is an alias for www.icloud.com.edgekey.net.
                          www.icloud.com.edgekey.net is an alias for e4478.a.akamaiedge.net.
                          e4478.a.akamaiedge.net has address 173.222.186.46

                          Remove all those Whitelist entries that you manually added. Then browse to www.icloud.com, then whitelist it from the Alerts tab and see how that goes…

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 1
                          • P
                            pfBasic Banned
                            last edited by

                            Remove all those Whitelist entries that you manually added. Then browse to www.icloud.com, then whitelist it from the Alerts tab and see how that goes…

                            Perfect, that did it!

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.