Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    What's up with the whitelist not working on DNSBL?

    Scheduled Pinned Locked Moved pfBlockerNG
    13 Posts 3 Posters 7.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      motific
      last edited by

      Do a DNS query in pfSense.  That will return either a CNAME or an IP address.

      If the result is a CNAME then requery on that until a query returns the IP of pfBlockerNG's web server.

      Whatever domain resolves to that IP is the one you need to whitelist.

      As an aside, I have noticed many of the list authors are quite harsh on blocking MS and Apple domains, yet are quite content to allow google to be vastly more invasive in terms of privacy and tracking; I wonder if that is more of a reflection on google's wholesale monopoly abuse, or the list authors' preferences?

      1 Reply Last reply Reply Quote 0
      • P
        pfBasic Banned
        last edited by

        I ran the DNS lookup, got four IP's. I re-queried each IP and none resolved 10.10.10.1.

        Is that what you meant? I'm not getting any returns for CNAME's.

        Untitled.png
        Untitled.png_thumb
        Untitled1.png
        Untitled1.png_thumb

        1 Reply Last reply Reply Quote 0
        • M
          motific
          last edited by

          It is what I meant - I checked it here, the problem is you're checking the wrong domain.

          HTTP queries for icloud.com issue an 301 (permanently moved) response redirecting to (drum roll) www.icloud.com - try searching on that and see how you get on?

          (Yes, I could just tell you which domain to whitelist, but I'm trying to teach you to fish here in case it happens again.)

          1 Reply Last reply Reply Quote 0
          • P
            pfBasic Banned
            last edited by

            Well, doing a DNS lookup for www.icloud.com does resolve 10.10.10.1…. But I'm not seeing what good this is doing?

            In my Custom Whitelist I placed

            .icloud.com

            Which whitelist all subdomains of icloud.com.

            Prefix Domain with a "." to Whitelist all Sub-Domains.  IE: (.example.com)

            I tried adding

            www.icloud.com

            saving & force reloading.
            But it doesn't make any difference.

            DNSBL is already identifying that the site is whitelisted, but is still redirecting to a blackhole.

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              This command will list any CNAMES for a domain… it will use @8.8.8.8 (You can change that to any external NS server)... You don't want to use the pfSense resolver as it would return the DNSBL VIP.

              I don't see any of these domains/CNAMES in any Feed... But try to grep for those and see if they come up... grep for the start of the domain name. IE:  ".akadns.net" etc...

              drill @8.8.8.8 www.icloud.com

              ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 4609
              ;; flags: qr rd ra ; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0
              ;; QUESTION SECTION:
              ;; www.icloud.com.      IN      A

              ;; ANSWER SECTION:
              www.icloud.com. 3119    IN      CNAME  www-cdn.icloud.com.akadns.net.
              www-cdn.icloud.com.akadns.net.  73      IN      CNAME  www.icloud.com.edgekey.net.
              www.icloud.com.edgekey.net.    17250  IN      CNAME  e4478.a.akamaiedge.net.
              e4478.a.akamaiedge.net. 9      IN      A      23.15.152.140

              ;; AUTHORITY SECTION:

              ;; ADDITIONAL SECTION:

              ;; Query time: 17 msec
              ;; SERVER: 8.8.8.8
              ;; WHEN: Thu Jun 29 19:13:56 2017
              ;; MSG SIZE  rcvd: 161

              You can also run the following and if it replies back with the DNSBL IP, then its blocked… Did you try to clear your browser and /OS cache... Or reboot the LAN device?

              host -t A www.icloud.com

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • P
                pfBasic Banned
                last edited by

                I had already added

                www-cdn.icloud.com.akadns.net

                With no effect, I'll see if I can find any more to add, try the rest of what you mentioned and report back.

                Thanks for the help!

                1 Reply Last reply Reply Quote 0
                • P
                  pfBasic Banned
                  last edited by 

                  [2.4.0-BETA][admin@netbox.network]/root: grep ".akadns.net" /var/db/pfblockerng/dnsbl/*
/var/db/pfblockerng/dnsbl/Cameleon.txt:local-data: "adfarm.mplx.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/Cameleon.txt:local-data: "img.mplx.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/Cameleon.txt:local-data: "www.burstnet.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SBh_p.txt:local-data: "sls.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SBh_p.txt:local-data: "statsfe2.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "ads.adxpose.mpire.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "ads1.perfadbrite.com.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "lb1.www.ms.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "schemas.microsoft.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/SWC.txt:local-data: "track-apmebf.cj.akadns.net 60 IN A 10.10.10.1"
/var/db/pfblockerng/dnsbl/sh2pfB_0.txt:local-data: "ads.as4x.tmcs.akadns.net 60 IN A 10.10.10.1"
[2.4.0-BETA][admin@netbox.network]/root: grep ".akadns.net" /var/unbound/pfb_dnsbl.conf
local-data: "adfarm.mplx.akadns.net 60 IN A 10.10.10.1"
local-data: "img.mplx.akadns.net 60 IN A 10.10.10.1"
local-data: "www.burstnet.akadns.net 60 IN A 10.10.10.1"
local-data: "ads.adxpose.mpire.akadns.net 60 IN A 10.10.10.1"
local-data: "ads1.perfadbrite.com.akadns.net 60 IN A 10.10.10.1"
local-data: "lb1.www.ms.akadns.net 60 IN A 10.10.10.1"
local-data: "schemas.microsoft.akadns.net 60 IN A 10.10.10.1"
local-data: "track-apmebf.cj.akadns.net 60 IN A 10.10.10.1"
local-data: "ads.as4x.tmcs.akadns.net 60 IN A 10.10.10.1"
local-data: "sls.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
local-data: "statsfe2.update.microsoft.com.akadns.net 60 IN A 10.10.10.1"
[2.4.0-BETA][admin@netbox.network]/root: host -t A www.icloud.com
www.icloud.com has address 10.10.10.1
                  1 Reply Last reply Reply Quote 0
                  • P
                    pfBasic Banned
                    last edited by

                    I've added all of these so far and still blackholing.

                    www.icloud.com
.www.icloud.com
icloud.com
.icloud.com
www-cdn.icloud.com.akadns.net #CNAME for icloud.com
.icloud.com.akadns.net
.icloud.com.edgekey.net
www.icloud.com.edgekey.net
e4478.a.akamaiedge.net
                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      Hmm I checked again and that domain is listed in hpHosts_PSH Feed… Will have to contact the maintainer of that feed.

                      grep "www.icloud.com" /var/db/pfblockerng/dnsblorig/*

                      /var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-findi.top
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-ios9.cc
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-manage.net
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com-na.cc
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.21.0x7.pn.ci.fmip-12.in
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.ht
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.iphonc.win
/var/db/pfblockerng/dnsblorig/hpHosts_PSH.orig:127.0.0.1        www.icloud.com.reported.me

                      I used the Alerts Tab to whitelist "www.icloud.com" and it automatically added the following to the DNSBL Whitelist:

                      .www.icloud.com
.www-cdn.icloud.com.akadns.net # CNAME for (www.icloud.com)
.www.icloud.com.edgekey.net # CNAME for (www.icloud.com)
.e4478.a.akamaiedge.net # CNAME for (www.icloud.com)

                      It was blocked before whitelisting it but now replies back with:

                      host -t A www.icloud.com

                      www.icloud.com is an alias for www-cdn.icloud.com.akadns.net.
                      www-cdn.icloud.com.akadns.net is an alias for www.icloud.com.edgekey.net.
                      www.icloud.com.edgekey.net is an alias for e4478.a.akamaiedge.net.
                      e4478.a.akamaiedge.net has address 173.222.186.46

                      Remove all those Whitelist entries that you manually added. Then browse to www.icloud.com, then whitelist it from the Alerts tab and see how that goes…

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 1
                      • P
                        pfBasic Banned
                        last edited by

                        Remove all those Whitelist entries that you manually added. Then browse to www.icloud.com, then whitelist it from the Alerts tab and see how that goes…

                        Perfect, that did it!

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.