Can pfSense do this better than a Edgerouter
-
If you're filtering using DNS in pfBlocker (or directly in Unbound) this is all much easier because you can just use domains etc directly.
To filter by IP using firewall rules you need to have pfBlocker create aliases to use. To do that you need to have a 'feed' that contains updating lists for the IPs you need and that is the difficult part.
pfBlocker can create aliases from ASNs which is usually 'good enough' to make Netflix oir Facebook unusable. Some companies maintain their own lists for exactly this like Cloudflare. Much easier in that case.Steve
-
-
@stephenw10 I am using unbound, did you mean using TLD as @johnpoz mentioned above?
-
Yes, if you're filtering by DNS you can use the TLD feature in pfBlocker/DNS-BL to catch wildcard type requests like that.
-
@stephenw10 Ok, so I now tried to block one domain (yahoo.com) under DNSBL->DNSBL Groups->Add->Action Unbound->DNSBL Custom_list->yahoo.com->Save
and that works. But now I noticed that it blocks yahoo.com on all vlans... I googled around and found that I should add some custom options under DNS Resolver. I've tried this but it didn't make any difference (also tried a version with the include as last under view dnsbl).
server: access-control-view: 10.0.1.0/24 bypass access-control-view: 10.0.10.0/24 bypass access-control-view: 10.0.20.0/24 bypass access-control-view: 10.0.30.0/24 bypass access-control-view: 10.0.40.0/24 bypass access-control-view: 10.0.100.0/24 bypass access-control-view: 10.0.101.0/24 dnsbl include: /var/unbound/pfb_dnsbl.*conf view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yesI only want dnsblocker to be active on the 101 net, before I can continue to test the setup
-
You might find it easier to not use Unbound at all on the other interfaces. You can pass external DNS servers via DHCP there or run DNSMasq on a different port for use port forwards on those interfaces. Or the opposite on the 101 VLAN.
It should be possible to do it using views in Unbound though.
Steve
-
@stephenw10 Ok, the views solution would have been easier but I'll try that, thank you!
-
You can use views. You need to move the dns-bl include to the dnsbl view so, something like:
server: access-control-view: 10.0.1.0/24 bypass access-control-view: 10.0.10.0/24 bypass access-control-view: 10.0.20.0/24 bypass access-control-view: 10.0.30.0/24 bypass access-control-view: 10.0.40.0/24 bypass access-control-view: 10.0.100.0/24 bypass access-control-view: 10.0.101.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes include: /var/unbound/pfb_dnsbl.*confThere are a few threads on setting this sort of thing up.
Steve
-
@stephenw10 Thank you for taking time to answer me again! But as I wrote earlier I already tried that, I think the problem is the include line as when I sshed into the pfsense box there are no files matching what the include line is trying to include. Has something changed (running latest version) and the information is obsolete?
I've read quite a few threads about this but most of them uses the same include...
-
@stephenw10 said in Can pfSense do this better than a Edgerouter:
/var/unbound/pfb_dnsbl.*conf
If you have pfBlocker with DNS-BL enabled that file should absolutely exist.
[21.09-DEVELOPMENT][admin@6100.stevew.lan]/root: ls -ls /var/unbound/pfb_dnsbl.*conf 3968 -rw-r--r-- 1 root wheel 4019424 Aug 16 19:24 /var/unbound/pfb_dnsbl.confpfBlocker itself adds that custom line to the Unbound config.
Steve
-
@stephenw10 Interesting, must take a closer look... I'm not sure if I checked before or after I disabled it (as it affected the whole network). But I am sure that the custom options box (under Unbound) was empty when it was running. I saw posts that said that it should have the include line (under custom options) when running...
Thanks again!
-
@stephenw10 Found the problem, I was using Unbound python mode. Now it only blocks in the 101 vlan. Time to continue experimenting with pfblocker. Thanks again!
