Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can pfSense do this better than a Edgerouter

    Scheduled Pinned Locked Moved General pfSense Questions
    24 Posts 6 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator @nickehallgren
      last edited by

      @nickehallgren said in Can pfSense do this better than a Edgerouter:

      In a few seconds the clients get another ip than the one the alias is pointing to.

      How is that? They should be using pfsense for dns, which would mean they would get what pfsense has for that fqdn in its cache.. Which should in theory match up with what is in the alias. Now sure if alias is only updated every 5 minutes, and ttl of said record is less than 5 minutes you could run into an out of sync condition.

      But yes if your going to point clients to something other than pfsense for dns, those differences could be exaggerated

      Your * star entries are wildcards - you can do that with pfblocker.. use of TLD feature where you can block or allow subdomains.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      N 1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        If you're filtering using DNS in pfBlocker (or directly in Unbound) this is all much easier because you can just use domains etc directly.
        To filter by IP using firewall rules you need to have pfBlocker create aliases to use. To do that you need to have a 'feed' that contains updating lists for the IPs you need and that is the difficult part.
        pfBlocker can create aliases from ASNs which is usually 'good enough' to make Netflix oir Facebook unusable. Some companies maintain their own lists for exactly this like Cloudflare. Much easier in that case.

        Steve

        N 1 Reply Last reply Reply Quote 0
        • N
          nickehallgren @johnpoz
          last edited by

          @johnpoz I'm forcing all clients to use unbound with port forwarding the DNS port as in this guide. I must investigate this a bit more when I am in the office on Monday. I'll take a look at the TLD feature too, thanks!

          1 Reply Last reply Reply Quote 0
          • N
            nickehallgren @stephenw10
            last edited by

            @stephenw10 I am using unbound, did you mean using TLD as @johnpoz mentioned above?

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Yes, if you're filtering by DNS you can use the TLD feature in pfBlocker/DNS-BL to catch wildcard type requests like that.

              N 1 Reply Last reply Reply Quote 0
              • N
                nickehallgren @stephenw10
                last edited by

                @stephenw10 Ok, so I now tried to block one domain (yahoo.com) under DNSBL->DNSBL Groups->Add->Action Unbound->DNSBL Custom_list->yahoo.com->Save

                and that works. But now I noticed that it blocks yahoo.com on all vlans... I googled around and found that I should add some custom options under DNS Resolver. I've tried this but it didn't make any difference (also tried a version with the include as last under view dnsbl).

                server:
                    access-control-view: 10.0.1.0/24 bypass
                    access-control-view: 10.0.10.0/24 bypass
                    access-control-view: 10.0.20.0/24 bypass
                    access-control-view: 10.0.30.0/24 bypass
                    access-control-view: 10.0.40.0/24 bypass
                    access-control-view: 10.0.100.0/24 bypass
                    access-control-view: 10.0.101.0/24 dnsbl
                    include: /var/unbound/pfb_dnsbl.*conf
                view:
                    name: "bypass"
                    view-first: yes
                view:
                    name: "dnsbl"
                    view-first: yes
                

                I only want dnsblocker to be active on the 101 net, before I can continue to test the setup

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  You might find it easier to not use Unbound at all on the other interfaces. You can pass external DNS servers via DHCP there or run DNSMasq on a different port for use port forwards on those interfaces. Or the opposite on the 101 VLAN.

                  It should be possible to do it using views in Unbound though.

                  Steve

                  N 1 Reply Last reply Reply Quote 0
                  • N
                    nickehallgren @stephenw10
                    last edited by

                    @stephenw10 Ok, the views solution would have been easier but I'll try that, thank you!

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      You can use views. You need to move the dns-bl include to the dnsbl view so, something like:

                      server:
                          access-control-view: 10.0.1.0/24 bypass
                          access-control-view: 10.0.10.0/24 bypass
                          access-control-view: 10.0.20.0/24 bypass
                          access-control-view: 10.0.30.0/24 bypass
                          access-control-view: 10.0.40.0/24 bypass
                          access-control-view: 10.0.100.0/24 bypass
                          access-control-view: 10.0.101.0/24 dnsbl
                      
                      view:
                          name: "bypass"
                          view-first: yes
                      view:
                          name: "dnsbl"
                          view-first: yes
                          include: /var/unbound/pfb_dnsbl.*conf
                      

                      There are a few threads on setting this sort of thing up.

                      Steve

                      N 1 Reply Last reply Reply Quote 0
                      • N
                        nickehallgren @stephenw10
                        last edited by

                        @stephenw10 Thank you for taking time to answer me again! But as I wrote earlier I already tried that, I think the problem is the include line as when I sshed into the pfsense box there are no files matching what the include line is trying to include. Has something changed (running latest version) and the information is obsolete?

                        I've read quite a few threads about this but most of them uses the same include...

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          @stephenw10 said in Can pfSense do this better than a Edgerouter:

                          /var/unbound/pfb_dnsbl.*conf

                          If you have pfBlocker with DNS-BL enabled that file should absolutely exist.

                          [21.09-DEVELOPMENT][admin@6100.stevew.lan]/root: ls -ls /var/unbound/pfb_dnsbl.*conf
                          3968 -rw-r--r--  1 root  wheel  4019424 Aug 16 19:24 /var/unbound/pfb_dnsbl.conf
                          

                          pfBlocker itself adds that custom line to the Unbound config.

                          Steve

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            nickehallgren @stephenw10
                            last edited by

                            @stephenw10 Interesting, must take a closer look... I'm not sure if I checked before or after I disabled it (as it affected the whole network). But I am sure that the custom options box (under Unbound) was empty when it was running. I saw posts that said that it should have the include line (under custom options) when running...

                            Thanks again!

                            N 1 Reply Last reply Reply Quote 0
                            • N
                              nickehallgren @nickehallgren
                              last edited by

                              @stephenw10 Found the problem, I was using Unbound python mode. Now it only blocks in the 101 vlan. Time to continue experimenting with pfblocker. Thanks again!

                              1 Reply Last reply Reply Quote 1
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.