Can pfSense do this better than a Edgerouter

nickehallgren

@stephenw10 I am using unbound, did you mean using TLD as @johnpoz mentioned above?

stephenw10

Yes, if you're filtering by DNS you can use the TLD feature in pfBlocker/DNS-BL to catch wildcard type requests like that.

nickehallgren

@stephenw10 Ok, so I now tried to block one domain (yahoo.com) under DNSBL->DNSBL Groups->Add->Action Unbound->DNSBL Custom_list->yahoo.com->Save

and that works. But now I noticed that it blocks yahoo.com on all vlans... I googled around and found that I should add some custom options under DNS Resolver. I've tried this but it didn't make any difference (also tried a version with the include as last under view dnsbl).

server:
    access-control-view: 10.0.1.0/24 bypass
    access-control-view: 10.0.10.0/24 bypass
    access-control-view: 10.0.20.0/24 bypass
    access-control-view: 10.0.30.0/24 bypass
    access-control-view: 10.0.40.0/24 bypass
    access-control-view: 10.0.100.0/24 bypass
    access-control-view: 10.0.101.0/24 dnsbl
    include: /var/unbound/pfb_dnsbl.*conf
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes

I only want dnsblocker to be active on the 101 net, before I can continue to test the setup

stephenw10

You might find it easier to not use Unbound at all on the other interfaces. You can pass external DNS servers via DHCP there or run DNSMasq on a different port for use port forwards on those interfaces. Or the opposite on the 101 VLAN.

It should be possible to do it using views in Unbound though.

Steve

nickehallgren

@stephenw10 Ok, the views solution would have been easier but I'll try that, thank you!

stephenw10

You can use views. You need to move the dns-bl include to the dnsbl view so, something like:

server:
    access-control-view: 10.0.1.0/24 bypass
    access-control-view: 10.0.10.0/24 bypass
    access-control-view: 10.0.20.0/24 bypass
    access-control-view: 10.0.30.0/24 bypass
    access-control-view: 10.0.40.0/24 bypass
    access-control-view: 10.0.100.0/24 bypass
    access-control-view: 10.0.101.0/24 dnsbl

view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
    include: /var/unbound/pfb_dnsbl.*conf

There are a few threads on setting this sort of thing up.

Steve

nickehallgren

@stephenw10 Thank you for taking time to answer me again! But as I wrote earlier I already tried that, I think the problem is the include line as when I sshed into the pfsense box there are no files matching what the include line is trying to include. Has something changed (running latest version) and the information is obsolete?

I've read quite a few threads about this but most of them uses the same include...

stephenw10

@stephenw10 said in Can pfSense do this better than a Edgerouter:

/var/unbound/pfb_dnsbl.*conf

If you have pfBlocker with DNS-BL enabled that file should absolutely exist.

[21.09-DEVELOPMENT][admin@6100.stevew.lan]/root: ls -ls /var/unbound/pfb_dnsbl.*conf
3968 -rw-r--r--  1 root  wheel  4019424 Aug 16 19:24 /var/unbound/pfb_dnsbl.conf

pfBlocker itself adds that custom line to the Unbound config.

Steve

nickehallgren

@stephenw10 Interesting, must take a closer look... I'm not sure if I checked before or after I disabled it (as it affected the whole network). But I am sure that the custom options box (under Unbound) was empty when it was running. I saw posts that said that it should have the include line (under custom options) when running...

Thanks again!

nickehallgren

@stephenw10 Found the problem, I was using Unbound python mode. Now it only blocks in the 101 vlan. Time to continue experimenting with pfblocker. Thanks again!