Streaming is being blocked on Roku

amrogers3

I have unblocked everything that pops in Alerts and still no go.

Only option I can figure out is unblock the Roku device for all traffic but still have everything else go through pfBlockerNG. Is this the proper way to do so?

My network is 192.168.1.0/24
adding this to Services-->DNS Resolver --> Custom Options

server:
# bypass for Roku
access-control-view: 192.168.1.121/32 #Roku is statically assigned .121
access-control-view: 192.168.1.1/24 #rest of subnet 
view:
name: "bypass"
view-first: yes
view:
name: "dnsbl"
view-first: yes
server:include: /var/unbound/pfb_dnsbl.*conf

I am getting the following error:

The following input errors were detected:

The generated config file cannot be parsed by unbound. Please correct the following errors:
/var/unbound/test/unbound.conf:116: error: unknown keyword '192.168.1.1/24'
read /var/unbound/test/unbound.conf failed: 1 errors in configuration file

serbus

https://forum.netgate.com/topic/129365/bypassing-dnsbl-for-specific-ips/60?_=1596213519936

akuma1x

Have you tried putting this Roku on it's own subnet, with NO blocking from pfBlockerNG? Isolate it from the other networks, if possible, and set it to be wide open, nothing blocking, nothing in the way. Set the DNS on this subnet to either your ISP's servers, or google DNS, like @johnpoz says below.

Jeff

johnpoz

@amrogers3 said in Streaming is being blocked on Roku:

access-control-view:

You have no name on your views.. so yeah can see why it would balk at that.

access-control-view: <IP netblock> <view name>
              Set view for given access control element.

And you shouldn't have that 2nd server: in there either.

Wouldn't it be just easier to assign your roku a different dns, say 8.8.8.8 - not sure why your roku would need to resolve anything on your local network anyway.

amrogers3

@johnpoz said in Streaming is being blocked on Roku:

You have no name on your views.. so yeah can see why it would balk at that.
access-control-view: <IP netblock> <view name>
              Set view for given access control element.
And you shouldn't have that 2nd server: in there either.

Wouldn't it be just easier to assign your roku a different dns, say 8.8.8.8 - not sure why your roku would need to resolve anything on your local network anyway.

Thank you all for the responses.

EDIT: I had to go back and edit my original reply. I realized I am forcing DNS requests over CloudFlare 1.1.1.2 and 1.1.1.1. I also have two NICs and two different LANS, 192.168.1.0 and 10.1.1.1

I changed the Resolver code:

server:
    access-control-view: 192.168.1.0/24 dnsbl  #All devices on this subnet run through pfBlockerNG DNSBL 
    access-control-view: 192.168.1.121/32 bypass  #Roku IP is bypassing pfBlockerNG DNSBL
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
include: /var/unbound/pfb_dnsbl.*conf

However, I am noticing that ads are allowed for everything on 10.1.1.1 unless I add

access-control-view: 10.1.1.1/24 dnsbl

and the full code looks like this:

server:
    #All devices on this subnet run through pfBlockerNG DNSBL 
    access-control-view: 192.168.1.0/24 dnsbl  
    access-control-view: 10.1.1.1/24 dnsbl  
 
    #Roku IP is bypassing
    access-control-view: 192.168.1.121/32 bypass   pfBlockerNG DNSBL
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
include: /var/unbound/pfb_dnsbl.*conf

Apologies for the delay in responding, I never got any email notifications that I received responses to my original post. Weird.