Can pfSense do this better than a Edgerouter

ahking19

@nickehallgren take a look at aliases under Firewall menu.
You can reference aliases in firewall rules.
https://docs.netgate.com/pfsense/en/latest/firewall/aliases.html

stephenw10

You can block it allow whatever you can create aliases for you just need the rules in the correct order.

nickehallgren

@stephenw10 ok, I must be missing something as I just don't understand.

I know how aliases work, I use them a lot in my fw rules. I'll try to rephrase.

I have a vlan (testing):

I now have one rule that is blocking everything (and if I understand correctly that is the default behavior so I would not need it).
Now I want to allow destionations to 193.166.31.0/24 (just an example) and I place it before the block rule.

This is where the problems start, I have for example fonts.googleapis.com that I can add to an alias but I know it won't work for long. In a few seconds the clients get another ip than the one the alias is pointing to. How do I make this work every time for the clients?

Next, I'll need to allow access to Adobe servers (only listing a few): (hmm, can post the urls as code as it tells me the post is spam but there are stars before .license, after -web-prod- before .elbs.amazonaws and before and after s3 in the last line)

.licenses.adobe.com
gocart-web-prod-.elb.amazonaws.com
s3.amazonaws.com

these can't be done with aliases, so how can I fix this?

Yes, people say that I should use pfBlockerNG but can some one explain how that is achived. I have now setup pfBlockerNG as in this guide all the way to "Enable some IP feeds" (skipped MaxMind GeoIP as I don't need it). As I only want to allow a few addresses this seems totally useless, or?

Can someone explain in more steps how this is done, as I do not seem to understand from the guides/links I found.

Thanks in advance!

johnpoz

@nickehallgren said in Can pfSense do this better than a Edgerouter:

In a few seconds the clients get another ip than the one the alias is pointing to.

How is that? They should be using pfsense for dns, which would mean they would get what pfsense has for that fqdn in its cache.. Which should in theory match up with what is in the alias. Now sure if alias is only updated every 5 minutes, and ttl of said record is less than 5 minutes you could run into an out of sync condition.

But yes if your going to point clients to something other than pfsense for dns, those differences could be exaggerated

Your * star entries are wildcards - you can do that with pfblocker.. use of TLD feature where you can block or allow subdomains.

stephenw10

If you're filtering using DNS in pfBlocker (or directly in Unbound) this is all much easier because you can just use domains etc directly.
To filter by IP using firewall rules you need to have pfBlocker create aliases to use. To do that you need to have a 'feed' that contains updating lists for the IPs you need and that is the difficult part.
pfBlocker can create aliases from ASNs which is usually 'good enough' to make Netflix oir Facebook unusable. Some companies maintain their own lists for exactly this like Cloudflare. Much easier in that case.

Steve

nickehallgren

@johnpoz I'm forcing all clients to use unbound with port forwarding the DNS port as in this guide. I must investigate this a bit more when I am in the office on Monday. I'll take a look at the TLD feature too, thanks!

nickehallgren

@stephenw10 I am using unbound, did you mean using TLD as @johnpoz mentioned above?

stephenw10

Yes, if you're filtering by DNS you can use the TLD feature in pfBlocker/DNS-BL to catch wildcard type requests like that.

nickehallgren

@stephenw10 Ok, so I now tried to block one domain (yahoo.com) under DNSBL->DNSBL Groups->Add->Action Unbound->DNSBL Custom_list->yahoo.com->Save

and that works. But now I noticed that it blocks yahoo.com on all vlans... I googled around and found that I should add some custom options under DNS Resolver. I've tried this but it didn't make any difference (also tried a version with the include as last under view dnsbl).

server:
    access-control-view: 10.0.1.0/24 bypass
    access-control-view: 10.0.10.0/24 bypass
    access-control-view: 10.0.20.0/24 bypass
    access-control-view: 10.0.30.0/24 bypass
    access-control-view: 10.0.40.0/24 bypass
    access-control-view: 10.0.100.0/24 bypass
    access-control-view: 10.0.101.0/24 dnsbl
    include: /var/unbound/pfb_dnsbl.*conf
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes

I only want dnsblocker to be active on the 101 net, before I can continue to test the setup

stephenw10

You might find it easier to not use Unbound at all on the other interfaces. You can pass external DNS servers via DHCP there or run DNSMasq on a different port for use port forwards on those interfaces. Or the opposite on the 101 VLAN.

It should be possible to do it using views in Unbound though.

Steve

nickehallgren

@stephenw10 Ok, the views solution would have been easier but I'll try that, thank you!

stephenw10

You can use views. You need to move the dns-bl include to the dnsbl view so, something like:

server:
    access-control-view: 10.0.1.0/24 bypass
    access-control-view: 10.0.10.0/24 bypass
    access-control-view: 10.0.20.0/24 bypass
    access-control-view: 10.0.30.0/24 bypass
    access-control-view: 10.0.40.0/24 bypass
    access-control-view: 10.0.100.0/24 bypass
    access-control-view: 10.0.101.0/24 dnsbl

view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
    include: /var/unbound/pfb_dnsbl.*conf

There are a few threads on setting this sort of thing up.

Steve

nickehallgren

@stephenw10 Thank you for taking time to answer me again! But as I wrote earlier I already tried that, I think the problem is the include line as when I sshed into the pfsense box there are no files matching what the include line is trying to include. Has something changed (running latest version) and the information is obsolete?

I've read quite a few threads about this but most of them uses the same include...

stephenw10

@stephenw10 said in Can pfSense do this better than a Edgerouter:

/var/unbound/pfb_dnsbl.*conf

If you have pfBlocker with DNS-BL enabled that file should absolutely exist.

[21.09-DEVELOPMENT][admin@6100.stevew.lan]/root: ls -ls /var/unbound/pfb_dnsbl.*conf
3968 -rw-r--r--  1 root  wheel  4019424 Aug 16 19:24 /var/unbound/pfb_dnsbl.conf

pfBlocker itself adds that custom line to the Unbound config.

Steve

nickehallgren

@stephenw10 Interesting, must take a closer look... I'm not sure if I checked before or after I disabled it (as it affected the whole network). But I am sure that the custom options box (under Unbound) was empty when it was running. I saw posts that said that it should have the include line (under custom options) when running...

Thanks again!

nickehallgren

@stephenw10 Found the problem, I was using Unbound python mode. Now it only blocks in the 101 vlan. Time to continue experimenting with pfblocker. Thanks again!