Bypassing DNSBL for specific IPs
-
Revisiting this thread as I needed to exclude my Roku devices on my network as they need to reach ad sites for the news feeds to work. (sucks) Getting it to work has raised some questions that maybe others can chime in on and maybe my configuration / findings may help others.
I am using Cloudflares DNS over TLS hence the forward-zone configuration. In addition I run a Plex server at home and need to define the private-domain to allow internal resolution to a private IP address.
I have three Roku devices that use the "bypass" view
Everything else on my three network segments uses DNSBL to block ads.
I have native IPv6 and hence need to add access control as some hosts use IPv6 for DNS transport.
There are a number of host overrides configured to resolve private IP addresses and hidden hosts from the internal Intranet and not use the public IP addresses resolved by my external NS.
Example of my custom options: -server: private-domain: "plex.direct" access-control-view: 192.168.1.51/32 bypass access-control-view: 192.168.1.61/32 bypass access-control-view: 192.168.1.83/32 bypass access-control-view: 2601:abcd:abcd:abc0::/64 dnsbl access-control-view: 2601:abcd:abcd:abc1::/64 dnsbl access-control-view: 2601:abcd:abcd:abc2::/64 dnsbl access-control-view: 192.168.1.0/24 dnsbl access-control-view: 192.168.2.0/24 dnsbl access-control-view: 192.168.3.0/24 dnsbl rrset-roundrobin: yes forward-zone: name: "." forward-ssl-upstream: yes # Cloudflare DNS forward-addr: 1.1.1.1@853 forward-addr: 1.0.0.1@853 forward-addr: 2606:4700:4700::1111@853 forward-addr: 2606:4700:4700::1001@853 view: name: "bypass" view-first: yes #include: /var/unbound/host_entries.conf view: name: "dnsbl" view-first: yes include: /var/unbound/host_entries.conf include: /var/unbound/pfb_dnsbl.*confWhat I have found is if I use a 192.168.0.0/22 mask (CIDR) for the IPv4 subnets it does not work, I instead had to define each subnet with /24. Maybe a /16 would have worked?
Same problem with IPv6. (note, the examples mask my real IPv6 prefix), I had to define multiple /64's as a single /62 did not work.
The dnsbl view needed to have include: /var/unbound/host_entries.conf otherwise the host overrides did not resolve. For some reason however that was not required for the bypass view, which seems to operate quite happily without the include: hence it is commented out. Not what I expected.
I also, had a number of issues, that I did not continue confirming exactly the behavior, when trying to format for readability the custom options by indenting some lines using spaces. This caused it to fail. so no leading spaces on any line. :-)
unbound "view" is not very well documented, but does provide some potential for client specific workarounds that I've needed every now and then. Debug seems limited in the log files regarding matching of access-control-view and which view is being used. Maybe I had too much verbosity enabled and message were deep and I missed them?
With multiple hosts for testing and having dig/nslookup forced to use IPv4 or IPv6 I was able to finally reproduce what I believe is a working config. Albeit with some configuration options that I don't fully understand why they work how they do. Will see how it goes . . . .
If anyone can comment on the subnet masks and the include:
-
One topic I keep not seeing is what if you want to block X for all. But by pass Y for a few and still block X.
-
Hi.
Following this topic, we need to first create the ACL or u put the settings directly on the custom field?
Regards.
-
@periko Put the settings directly into a custom field, this is the only place the ACLs are defined.
Reference: https://jpmens.net/2016/12/20/unbound-supports-views-for-local-data/
My implementation using the information in this post: https://mitky.com/pfblockerng-pfsense-filter-specific-clients-computers-network/
-
I had tested and works, in my layout, I got 2 networks:
-LAN
-VLANI setup my vlan not to use the dnsbl and works.
Thanks guys!!!
-
Hi,
I too have managed to get this working thanks to the above.
One question though, if I use DNSBL Category (shallalist) instead of DNSBL Feeds I've noticed that the bypass no longer works.
I'm guessing this is because the name 'dnsbl' isn't correct when using a category. Any ideas please on the correct syntax? or other cause?
server: access-control-view: 192.168.2.3/32 bypass access-control-view: 192.168.2.0/24 dnsbl access-control-view: 192.168.1.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes server:include: /var/unbound/pfb_dnsbl.*confThanks
-
@yeleek Try removing the second 'server' from your options here. Your custom options should look like:
server: access-control-view: 192.168.2.3/32 bypass access-control-view: 192.168.2.0/24 dnsbl access-control-view: 192.168.1.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes include: /var/unbound/pfb_dnsbl.*confI've also noticed more problems with this when trying to set view 'bypass' for specific addresses inside of a subnet that is also a member of your 'dnsbl' view. I can't confirm whether this is actually an issue or just misconfiguration on my part, but I'd try the above and see if it works for you, even temporarily.
-
@kevinmitky That appears to be working for now. Thank you :)
-
@yeleek Please note, if you do an update, disable and re-enable DNSBL that line will be modified again back to the standard entry. You will need to check each time and remove any leading "server:" to ensure your expected behavior works as expected.
Just an FYI as it caught me out and is now part of my standard checks following any modifications to the configuration of my pfSense
@ kevinmitky I am doing exactly what you described. I have my dnsbl view as the subnets and am specifying specific hosts on those subnets to bypass. These are Roku's devices that had news feeds that used block sites and I made a choice to allow it access for the convenience. Ensuring the host specific acl was before the subnet based ones was something I just do based on my background, but if you don't have it in that order, maybe that's an area to check. That and having to clear any host DNS caches made this a little more time consuming to test if I screwed up the config on pfSense :-)
-
Current syntax under Services > DNS Resolver > Custom Options with Pfblockerng enabled is:
private-domain: "plex.direct"
server:include: /var/unbound/pfb_dnsbl.conf**I have a multiple devices I want to bypass dnsbl (192.168.1.50, 192.168.1.51, 192.168.1.52) but everything else on 192.168.1.0/24 I want running through dnsbl so as I understand it I should just copy and paste the following into the custom options field of the DNS resolver for this:
*server: private-domain: "plex.direct" access-control-view: 192.168.1.50/32 bypass access-control-view: 192.168.1.51/32 bypass access-control-view: 192.168.1.52/32 bypass access-control-view: 192.168.1.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes include: /var/unbound/pfb_dnsbl.*conf -
@TupleButter Basically yes. although in your samples you have some "*" in places I don't expect. i.e. *server:
In my active config the last line is: -
[Edited] My original was incorrect as it was changed following an update. You will need to keep checking this line if there are any changes, as it gets auto added with server: prefixing it.include: /var/unbound/pfb_dnsbl.*confTBH its been a while since I set this up, so not sure if you need to repeat the server: tag again.
As a note, if you ever enable blocking of banned or emerging hosts you will need to include that config file in each view
My custom options currently are: -
server: so-reuseport: no private-domain: "plex.direct" # bypass view for Roku IP addresses access-control-view: 192.168.1.51/32 bypass access-control-view: 192.168.1.61/32 bypass access-control-view: 192.168.1.83/32 bypass access-control-view: 2601:xxxx:xxxx:xxxx::/64 dnsbl access-control-view: 2601:xxxx:xxxx:xxxx::/64 dnsbl access-control-view: 2601:xxxx:xxxx:xxxx::/64 dnsbl access-control-view: 192.168.1.0/24 dnsbl access-control-view: 192.168.2.0/24 dnsbl access-control-view: 192.168.3.0/24 dnsbl view: name: "bypass" view-first: yes include: /var/unbound/host_entries.conf view: name: "dnsbl" view-first: yes include: /var/unbound/host_entries.conf # local-zone: "youtube.com" inform_deny # local-zone: "facebook.com" inform_deny include: /var/unbound/pfb_dnsbl.*confThis ensures plex works, unbound is multithreaded, includes my IPv6 subnets (obscured in example) provide bypass for selected hosts (in this case only Roku and they are IPv4 only), denies access to banned or emerging hosts.
The two commented out local-zone's are my sledge hammer approach to blocking social media for some of the younger members in the house when they get grounded! They are not currently grounded :-) -
I have followed the above and put this in my unbound custom options and it doesnt block the ads
server:
private-domain: "plex.direct"
access-control-view: 10.10.0.0/24 bypass
access-control-view: 10.0.0.0/24 dnsbl
access-control-view: 10.0.8.0/24 dnsbl
view:
name: "bypass"
view-first: yes
view:
name: "dnsbl"
view-first: yes
include: /var/unbound/pfb_dnsbl.*confif i get rid of everything and put it back to what it was before which was the below then i get adblocking but of course it happens on every network. I just want adblocking on my guest network and openvpn network for now
server:
private-domain: "plex.direct"
server:include: /var/unbound/pfb_dnsbl.*confMay someone help please?
-
@ryk48 said in Bypassing DNSBL for specific IPs:
rivate-domain: "plex.direct"
server:include: /var/unbound/pfb_dnsbl.*coRemove the server: from this line.
server:include: /var/unbound/pfb_dnsbl.*confIt should be like this: include: /var/unbound/pfb_dnsbl.*conf
Note that every time you perform a change in pfblocker, you will have to remove the "server:" from unbound custom options.
-
@mcury
Right.. Its what i did above and what my current config is. What i mentioned is what i had before i made the changes which was the config below without all access control stuff.I think my problem might be because im running an active directory domain and all my computers are set to use a windows dns server which forwards to pfsense to do dns over tls so im thinking no matter what network i put in the access control view it will be blocked if i do dnsbl on that network since pretty much everything has its dns set to my windows dns server, except the guest lan.
For example:
My windows dns server is on 10.10.0.0/24 network
my windows pcs are on 10.0.0.0/24
opendns computers are on 10.0.8.0/24
guest is on 192.168.10.0/24my windows pcs have their dns server set to the dns server on the 10.10 network so i think if i dnsbl on the 10.0.0.0/24 network its not working because windows computers dns are pointed to the dns server on the 10.10.0.0/24 network which wouldnt be dnsbl. Also i think id have the same problem on my opendns network as well since its dns servers also point to my windows dns server so i can rdp into network pcs. If i am wrong in how this works please chime in. Sounds like i might need dns servers for each network?
Ideally i just want to do dnsbl on my guest and opendns networks because i want guests to have adblock. I also want to connect to my openvpn server from my phone and browse the net on my phone with no ads and in addition have the ability to rdp into my pcs and servers but how can i achieve that when the opendns network dns points to the windows server network?
-
@ryk48 I have been looking for a pfsense solution to this for awhile. It seems the Unbound views might accomplish what I need as well, but what a pain in the ass to setup and manage. I have been investigating the Sensei plugin for Opnsense. It looks sooooo amazing and does exactly what you are asking about with ease. Policy based filtering! I just really like pfsense and didn’t want to have to reinstall my home router for one feature, but I am not seeing another option. Was hoping Sensei would be migrated to pfsense :P!
We’re you able to get this setup using unbound in pfsense?
-
@kezzla I was not. I figured since im having all of my devices on my network point to my AD DNS Server this wouldnt work. Guest lan would probably work but since i want to rdp from my phone and also block ads on my phone while connected to vpn to home this wouldnt work without affecting all pcs that use my ad dns servers.
-
Just found this thread and I think it might save my a$$ while stuck at home because of the covid19 pandemic... If I'm hijacking an existing thread, I'll move to a new one.
Basically I want all traffic on a specific VLAN (named DMZ with 192.168.2.0/24) totally bypass pfblocker & DNSBL in both directions (incoming and outgoing)... Based on OP's post, I added the following in unbound's custom options:
server: access-control-view: 192.168.2.0/24 bypass access-control-view: 192.168.1.0/24 dnsbl access-control-view: 192.168.3.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes include: /var/unbound/pfb_dnsbl.*confFor some reasons, even after restarting unbound, DNSBL and even rebooting pfsense, I still see tons of alerts in the Reports tab of pfblocker. Using a machine on VLAN, pages are still being blocked. Clearly this is not working for me. What am I doing wrong?
Some of my settings (if it helps):
- WAN is WAN... LAN1, LAN2 and DMZ are VLAN's based on LAN physical interface
- WAN is the only interface selected in pfblockerNG's Inbound Firewall Rules
- LAN1 & LAN2 are the only interfaces selected in pfblockerNG's Outbound Firewall Rules
- LAN1 & LAN2 are the only interfaces selected in DNSBL's "Permit Firewall Rules"
-
I did a quick check on my pfSense version 2.4.5-RELEASE and pfBlockerNG 2.1.4_22 and checked I can bypass a single hosts (/32) and also changed my LAN subnet to bypass (/24) and all worked as expected.
On my setup however I do have to make sure my test PC has IPv6 disabled for DNS so it correctly matched the unbound views.
Clutching at straws, my config is not nicely indented like yours, as you will see from my original reply earlier in this thread, that did seem to cause me problems, but did not spend much time verifying it as I just removed all leading spaces and it mainly worked as expected after that.
-
This is really strange....
- If I remove the leading spaces, I cannot save the config
The following input errors were detected: The generated config file cannot be parsed by unbound. Please correct the following errors: [1586258288] unbound-checkconf[11766:0] error: local-data in redirect zone must reside at top of zone, not at zz.zeroredirect1.com 60 IN A 10.10.10.1 [1586258288] unbound-checkconf[11766:0] fatal error: Could not set up views- I had removed the leading "server:" in front of the last line to look like this:
include: /var/unbound/pfb_dnsbl.*confBut every time I login to pfsense and try to modify the unbound settings, it is back to this:
server:include: /var/unbound/pfb_dnsbl.*confIs the package pfblockerNG doing this???
-
@pftdm007 said in Bypassing DNSBL for specific IPs:
Is the package pfblockerNG doing this???
Yep.
You know now how pfBlockerNG-devel communicates the list with IPs to be blocked to unbound ^^Before you install, the custom options box (unbound) is empty :
When you dissable pfBlockerNG-debel, and re activate it :
it will add this line to the custom options (unbound) :
The first time you installed pfBockerng-devel, there was even a first comment line :
