Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bypassing DNSBL for specific IPs

    Scheduled Pinned Locked Moved pfBlockerNG
    114 Posts 28 Posters 79.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      horse2370
      last edited by

      I did a quick check on my pfSense version 2.4.5-RELEASE and pfBlockerNG 2.1.4_22 and checked I can bypass a single hosts (/32) and also changed my LAN subnet to bypass (/24) and all worked as expected.

      On my setup however I do have to make sure my test PC has IPv6 disabled for DNS so it correctly matched the unbound views.

      Clutching at straws, my config is not nicely indented like yours, as you will see from my original reply earlier in this thread, that did seem to cause me problems, but did not spend much time verifying it as I just removed all leading spaces and it mainly worked as expected after that.

      1 Reply Last reply Reply Quote 0
      • P
        pftdm007
        last edited by

        This is really strange....

        1. If I remove the leading spaces, I cannot save the config
        The following input errors were detected:
        
            The generated config file cannot be parsed by unbound. Please correct the following errors:
            [1586258288] unbound-checkconf[11766:0] error: local-data in redirect zone must reside at top of zone, not at zz.zeroredirect1.com 60 IN A 10.10.10.1
            [1586258288] unbound-checkconf[11766:0] fatal error: Could not set up views
        
        1. I had removed the leading "server:" in front of the last line to look like this:
        include: /var/unbound/pfb_dnsbl.*conf
        

        But every time I login to pfsense and try to modify the unbound settings, it is back to this:

        server:include: /var/unbound/pfb_dnsbl.*conf
        

        Is the package pfblockerNG doing this???

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @pftdm007
          last edited by

          @pftdm007 said in Bypassing DNSBL for specific IPs:

          Is the package pfblockerNG doing this???

          Yep.
          You know now how pfBlockerNG-devel communicates the list with IPs to be blocked to unbound ^^

          Before you install, the custom options box (unbound) is empty :

          39b28cd9-0dcd-4f6c-8b7c-06ead4a43747-image.png

          When you dissable pfBlockerNG-debel, and re activate it :

          9e0330ee-bd57-4cf9-b5b7-961c7c5973cf-image.png

          it will add this line to the custom options (unbound) :
          0dcaf0e2-0ff8-4467-a1ba-82dc39552db6-image.png

          The first time you installed pfBockerng-devel, there was even a first comment line :

          93ea5b1c-31b5-473b-a232-6f2eeab9f4a6-image.png

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          P 1 Reply Last reply Reply Quote 0
          • P
            pftdm007 @Gertjan
            last edited by

            @Gertjan

            Okayyyy... but...? That doesnt explain why the custom options with views dont work (and dont work if I remove the leading spaces), and how to prevent pfblockerNG from adding the redundant "server:" statement in front of the line....

            Others in this thread have successfully used views while using pfblockerNG so there's something I am doing wrong...

            GertjanG 1 Reply Last reply Reply Quote 0
            • H
              horse2370
              last edited by

              Which version of pfBlockerNG is installed?
              Although I did upgrade mine last night to -deval 2.2.5_30 and quickly ran the same test and it still works fine.

              Note: upgrading, installing, disabling / enabling etc. will always add the "server:" prefix to the include line. I just have a note to always check and remove it. Am not aware of any workaround.

              Based on your error there is another thread from 2016
              DNS Resolver cannot be modified or changed

              Seems to be something regarding the System Domain Local Zone type setting. Mine is Transparent which seems to be OK and allows me to save the config and views do work. If its not this, there must be something else, so will need a little more info on your setup and config.

              i.e. Do you have IPv6 configured? That will change a number of things that need additional configuration.

              P 1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @pftdm007
                last edited by

                @pftdm007 said in Bypassing DNSBL for specific IPs:

                and how to prevent pfblockerNG from adding the redundant "server:" statement in front of the line....

                Well ...
                Have a keyboard ?
                Here it is :

                /usr/local/pkg/pfblockerng/pfblockerng.inc line 1289

                	$unbound_include = "server:include: {$pfb['dnsbl_file']}.*conf";
                

                Take note : this line is still added at the end of the unbound config file. No analyses is done for Custom options already present.
                When pfBlockerng installs, or when you re-enable DNSBL mode, that line is added.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • H
                  horse2370
                  last edited by horse2370

                  @Gertjan
                  Nice!

                  Keyboards still rule!, As "Alexa, please make change to pfSense /usr/local . . . . @ line 1289" just isn't going to hack it anytime soon :-)

                  1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan
                    last edited by

                    I really wouldn't ask Alexa to do this ......
                    Anyway, I tried it myself.

                    Disabled :
                    7b7e1ad8-ba4b-46d9-8876-7b908feb5742-image.png

                    and forced a Update > Reload >All.

                    My Unbound > Custom options box is now empty.
                    I added a single (needed !) line :

                    3e6cf01c-ba20-43c8-9da3-1e6b14e89e08-image.png

                    I edited the file mentioned above.
                    And activated DNSBL in pfBlokcerNG again :

                    The result :

                    73c0971d-d4af-4088-9e85-53a0426277dd-image.png

                    	$unbound_include = "# With some comments\n# while I was here.\n include: {$pfb['dnsbl_file']}.*conf";
                    

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 0
                    • P
                      pftdm007
                      last edited by pftdm007

                      @horse2370 : pfBlockerNG-devel v2.2.5_30 is installed on my system. Seems to be the latest one. Also the thread you referred me to, seems to be a bug in Unbound or its implementation in pfsense? Still unfixed? The thread ends up dead with no answer.

                      If "upgrading, installing, disabling / enabling etc." will always put the "server:" statement back in unbound's custom options, then to me, pfBlockerNG's devs never intended their package to work with Unbound views. This is highly confirmed by @Gertjan's workaround to manually edit "/usr/local/pkg/pfblockerng/pfblockerng.inc"...

                      IMO, and this is only personal opinion, we should never have to fiddle with internal files like this way, even if it works. Especially on production systems. Will this file be overwritten once pfblockerNG is updated?

                      At least now I start to have a better picture on how these components interact with each others....

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • P
                        pftdm007 @horse2370
                        last edited by pftdm007

                        @horse2370

                        Just saw the last line of your post... No, I do not use IPV6 at all. Pretty much everything else is stock, with the exception of pfblockerNG and Snort. I also use VLAN's. Could you specify which setting you need more specifically? I will be glad to provide!

                        EDIT: some Unbound settings
                        Port 53
                        Enable SSL/TLS: Unchecked
                        SSL/TLS Cert: stock setting
                        Network ifaces: VLANs (see my initial post on this thread for details)
                        Outgoing ifaces: WAN
                        System Domain Local Zone Type: Transparent
                        DNSSEC: Checked
                        Python Module: Unchecked
                        DNS query FW: Unchecked
                        DHCP Registrations: Checked
                        Static DHCP: Checked
                        OpenVPN : Unchecked
                        Custom Options: (see my initial post on this thread for details)

                        1 Reply Last reply Reply Quote 0
                        • GertjanG
                          Gertjan @pftdm007
                          last edited by

                          @pftdm007 said in Bypassing DNSBL for specific IPs:

                          Will this file be overwritten once pfblockerNG is updated?

                          It's part of the package - so a re install or upgrade will undo changes.
                          Or, before editing, make a copy of it.

                          @pftdm007 said in Bypassing DNSBL for specific IPs:

                          pfBlockerNG's devs never intended their package to work with Unbound views.

                          It's just a way to have unbound to include a file with IP's - the scope is just 'server' (unbound dns) wide.

                          Btw : in my case, this file is empty, I'm not using DNSBL part of pfBlockerNG-devel - so it'a a no-op for me.
                          I could even wipe this line in the custom options.
                          ( but shouldn't be surprised the DNDBL functionality wouldn't work anymore )

                          No "help me" PM's please. Use the forum, the community will thank you.
                          Edit : and where are the logs ??

                          1 Reply Last reply Reply Quote 0
                          • D
                            denx
                            last edited by

                            Does the order in which you put the networks in the custom configs make any difference? Like would

                            access-control-view: 192.168.2.0/24 bypass
                            access-control-view: 192.168.1.0/24 dnsbl
                            

                            be any different than

                            access-control-view: 192.168.1.0/24 dnsbl
                            access-control-view: 192.168.2.0/24 bypass
                            

                            ?

                            My custom configs were working fine but something broke so I'm trying to nail down what it might be.

                            1 Reply Last reply Reply Quote 0
                            • H
                              horse2370
                              last edited by

                              @pftdm007 Have you managed to save the config with the advanced options? Like remove everything and save, does that work? Just add the server: Include . . . line?
                              Then the views without the leading spaces?

                              From the configuration provided, it looks very similar to mine, only real difference is I have forwarding enabled as I used SSL/TLS to my Internet DNS servers, but I had views working long before that and even before that config had to also be in custom options.

                              @denx I'm no expert, but based on my networking background, I don't why that would make any difference.
                              Best practice is general is always to have more specific matches first, but in your case they are both /24's

                              D 1 Reply Last reply Reply Quote 0
                              • D
                                denx @horse2370
                                last edited by

                                @horse2370 Thanks! After messing around a bit, I discovered that the order in which you put the networks/hosts makes no difference. The culprit for my problems was, indeed, the "server" prefix in the last line. Deleting it solved the issue.

                                1 Reply Last reply Reply Quote 0
                                • H
                                  horse2370
                                  last edited by

                                  @denx Great - as for the server: unless you want to make the modification posted by Gertjan, keep checking if make any changes to pfBlocker as it will come back.
                                  I have a note on in my "Change Log Documents" to verify so it doesn't bite me.

                                  To help out pfdm007, do you have leading spaces in your Custom Options?

                                  TIA

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    pftdm007
                                    last edited by pftdm007

                                    Finally got to do some testing....

                                    @horse2370 : Yes if I remove evething in Unbound's custom options box, it saves. I also managed to find a workaround:

                                    • Shutdown DNSBL/pfblockerNG, it will remove its line in Unbound's options
                                    • Keep everything else in Unbound's options
                                    • Remove the leading spaces
                                    • Save (no problems!)
                                    • Start DNSBL, it puts back its line in Unbound's options
                                    • Remove the "server:"
                                    • Save the options

                                    Now I need to check if the bypassing works, but at least I got past the saving issues....

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      pftdm007
                                      last edited by

                                      After all, it seems it is working now. In retrospect, I think there are still some bugs and things to iron out, and DNSBL's devs should definitely support unbound views, but at least it all works at this moment. Big thanks to you guys!

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mdngi
                                        last edited by

                                        I'm sure this is obvious and likely just not the way you want to go, but another solution is to create a separate interface (vlan) for certain hosts and exclude this interface from using unbound (and pfBlockerNG/DNSBL) altogether. Then just allow hosts on this interface/vlan to access "respectable" external DNS servers. I did this for a gaming PC so that I didn't have to compromise my tight pfBlockerNG/DNSBL config for the sake of a single computer that wanted to talk to the world.

                                        P 1 Reply Last reply Reply Quote 0
                                        • K
                                          kezzla
                                          last edited by

                                          While this solution may work for some, I would prefer to still have some blocking on the additional vlan. I just really wanted the ability to have policy based blocking like the Sensei plugin offers for Opnsense. I'm currently trying it out with the $9.99 home plan, and so far it has been working as expected. It was so easy to set up as well, it just sucks having to pay 10/month :P lol Really would prefer to go back to pfsense. My goal was to find basic ad blocking on some (adult) pc's, and much stricter blocking for my kids pc's and guest devices.

                                          I could have used other options, like pi-hole or opendns for the kids, but I want it to all go through my router and not depend on other services. Thanks for all the input so far!

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            pftdm007 @mdngi
                                            last edited by

                                            @mdngi said in Bypassing DNSBL for specific IPs:

                                            I'm sure this is obvious and likely just not the way you want to go, but another solution is to create a separate interface (vlan) for certain hosts and exclude this interface from using unbound (and pfBlockerNG/DNSBL) altogether

                                            That's exactly what I wanted to do since day 1. Read my original post on this thread:

                                            Basically I want all traffic on a specific VLAN (named DMZ with 192.168.2.0/24) totally bypass pfblocker & DNSBL in both directions (incoming and outgoing)...

                                            Does it mean that there is a simpler/more permanent way of doing this? You need to detail how because AFAIK, all interfaces have their traffic go through the same DNS resolver (Unbound) and the distinction between filtered or not is done at the resolver level via the line :

                                            include: /var/unbound/pfb_dnsbl.*conf
                                            
                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.