Bypassing DNSBL for specific IPs
-
@Gertjan I had this working 4 months back:
server: access-control-view: 192.168.0.20/32 bypass access-control-view: 192.168.0.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes include: /var/unbound/pfb_dnsbl.*conf
but later HDD of my custom firewall crashed, and Covid-19 lockdown began.
Meanwhile, I took firewall home, replaced HDD, upgraded pfSense to 2.4.5, upgraded pfblockerng-devel to 2.2.5_33. Now my bypass doesnt work. Everytime Firewall restarts or Enable/Disable pfblockerng, it changes unbound custom option to:
server: access-control-view: 192.168.0.20/32 bypass access-control-view: 192.168.0.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes server:include: /var/unbound/pfb_dnsbl.*conf
i.e. it adds another server: clause in the last line. You mentioned that there can't be multiple server: clause.
bypass still doesnt work. Can you please help? -
Try this :
server: access-control-view: 192.168.0.20/32 bypass access-control-view: 192.168.0.0/24 dnsbl include: /var/unbound/pfb_dnsbl.*conf view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes
-
Thanks @Gertjan for responding quickly.
I tried what you suggested, but bypass still not working.
Additionally, when i tried to enable/disable pfBlockerNG(with above custom option), it moved the include: to the last line, with additional server: clause.
server: access-control-view: 192.168.0.16/30 bypass access-control-view: 192.168.0.26/32 bypass access-control-view: 192.168.0.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes server:include: /var/unbound/pfb_dnsbl.*conf
Anymore ideas worth trying?
-
@Gertjan said in Bypassing DNSBL for specific IPs:
Most easy solution : stop login the hits on the default block rules. (see Log > Settings )
Sorry Gertjan, I am not following your suggestion here. Do you mean "the Settings tab under Status > System Logs"
-
@SmokinMoJoe said in Bypassing DNSBL for specific IPs:
Do you mean "the Settings tab under Status > System Logs"
Yep, this one:
@HiteshJain said in Bypassing DNSBL for specific IPs:
when i tried to enable/disable pfBlockerNG
pfBlockerNG is a program.
It's adds "server:include: /var/unbound/pfb_dnsbl.*conf" without taken in account if you have anything else already in there.
Normally, this isn't a big issue, because, normally, you do not need to enable and disable pfBlockerNG all the time.
And if you do, you have to visit the Resolver config page afterwards to "correct" the custom config options somewhat - if you have other, your own config settings entered.
The syntax has to be correct for unbound, who parses the config file.Btw : My proposition about how to format is : how I should do it.
There is another forum thread that details how to do so already, use that one to compare it with yours. -
@HiteshJain I have evolved the config I posted last month. It still allows pfblockerng to regenerate the configuration correctly, without corrupting it, and adds in a few addtional files which were needed.
# Allow these hosts to bypass pfblockerng server:access-control-view: 192.168.0.2/32 bypass # A view to bypass pfblockerng view: name: bypass view-first: no # This is needed to prevent falling back to the # global 'local-data' settings local-data: "dummy.entry 60 IN A 10.10.10.1" # Static host entries include: /var/unbound/host_entries.conf # dhcp lease entries include: /var/unbound/dhcpleases_entries.conf # Domain overrides include: /var/unbound/domainoverrides.conf server:include: /var/unbound/pfb_dnsbl.*conf
-
-
@HiteshJain said in Bypassing DNSBL for specific IPs:
2 server: clause which as per @Gertjan cant be multiple.
I actually said this :
@Gertjan said in Bypassing DNSBL for specific IPs:
"server:" clause can't (there is only one server)
I guess I dive back into the manual ....
But before that : I've seen thousands of these type of files : you've seen one, you've seen them all.
See :
server clause - not server clauses.
Maybe several server: "Attribute keywords" can exist .... you tell me ;)
In real world examples I see only one ...
-
@Gertjan I didnt mean to offend you by quoting you. I apologize :). Probably, I misunderstood your statement because I dont have any idea on how Unbound works or even configured.
I got to read about Unbound only because google results directed me to pages where people more experienced than me mentioned about using custom options of Unbound to bypass few IPs , and I wanted exactly same in my pfSense.@Gertjan The way you explained in one of the earlier replies of yours, gave an impression that you know a lot about Unbound(& related stuff) and that impression is still maintained. I'd like to Thank you that you take time out to respond to newbie like me.
I tried to look at Unbound manual, but I gave up just after scrolling the page down to bottom of earth.
BTW, I am still searching for the right configuration thread from which I could compare my config. Current thread is most appropriate thread i could find so far.
Do you mind sharing the link of thread you mentioned earlier? -
@HiteshJain said in Bypassing DNSBL for specific IPs:
I didnt mean
Don't worry, non taken.
But I probably fckd up anyway. Have a look at the first messages in this thread :
The "include: /var/unbound/pfb_dnsbl.*conf" line should be part of the view: part that handles the "dnsbl". -
@Gertjan Unfortunately, bypass is still not working.
I have also tried to reinstall pfBlockerNG twice, once with 'Keep Settings' checked, another without it.
My pfSense doesnt seems to like bypassing IP.
-
I finally figured out the reason why the bypass and block wasn't working properly. It was silly mistake(s) on my part
The reason why bypass wasnt working:
In TCP/IP->DNS setting I entered the IP address of my server which is also domain controller for windows logins.
Since the DNS request was going to the DC controller first which in turn responds with 10.10.10.1 (blocked) because DC server was itself in the blocked list in Unbound settings.
I have now changed theTCP/IP settings to 'Obtain settings automatically', which is causing the DNS request being sent to Pfsense directly for resolution, and give me bypassed ip address.The reason why block wasnt working properly:
While trying different options to make things work, I enabled Youtube safe search option in DNSBL, which started to unblock youtube for blocked IP addresses. I have now turned it off(disabled) and things are working as expected.Now, bypass and block are working the way I wanted.
-
@horse2370 said in Bypassing DNSBL for specific IPs:
server:
access-control-view: 192.168.1.16/32 bypass
access-control-view: 192.168.1.0/24 dnsblview:
name: "bypass"
view-first: yes
view:
name: "dnsbl"
view-first: yes
include: /var/unbound/pfb_dnsbl.*confI've done this buy I'm still blocked on certain websites, but not all. Wierd!
Update: i had to manually add each URL in the DNSBL Whitelist
-
Couple of things to check
Make sure you do not have an extra server: statement at the very end of the DNS Resolver custom config section. This gets added by pfblockerNG automatically when it upgrades, enables etc. Sure you have, but have to ask as it still catches me out every now and then!
The other thing to check, is machine that is not being bypassed using IPv6. You will need to add a bypass for that IP address as well.
My example is for bypassing Roku's that are IPv4 only. If I was to bypass anything else on my network, I would need to add an additional bypass statement for the IPv6 /128 as most OS's now prefer IPv6 if it available.
Let me know....
-
I found a better solution for myself, and stopped using pfblockerng. I wanted to have better policy based dns blocking per network. I have my kids home doing school full time now thanks to covid. So I have them on their own vlan, and I block all kinds of stuff for their network. But on my own private network I just want ad-blocking only, and I can do this easily with NxFilter.
You can install NxFilter on pfSense:
GitHub - DeepWoods/nxfilter-pfsense: NxFilter install on pfSense
https://github.com/DeepWoods/nxfilter-pfsenseThen I found this vid on Youtube for a quick tutorial on setting it up:
Raspberry Pi Home Server - NxFilter Tutorial - YouTube
https://www.youtube.com/watch?v=l4mOFRQZoOU&t=2sSo I have disabled the pfSense resolver (unbound) and pfBlocker and am only using nxfilter for dns. My pfsense memory usage has come way down, and it feels snappier while browsing. For some reason, dns resolution would hang randomly from time to time when I was using pfblocker, got sick of debugging it.
Before this, I was using pfblocker for pretty much everything on my all my networks, and set up a pihole server in a VM on my freenas box. So dumb to just run a separate adblocking dns server, but that's what I did. So I have scrapped that VM now and my pfsense box is back to doing all the dns.
Just thought I would share, as someone might require similar functionality.
-
@horse2370 thanks I had a server:include: /var/unbound/pfb_dnsbl.*conf on the end!
-
Thank you to all who commented here. I didn't know views were possible in unbound until reviewing this post. I was working through implementing this in my use case which is different than others here. I wanted to comment and share in case anyone else has a similar issue.
tldr: listing only networks for bypassing dnsbl, with defaulting to use of dnsbl for clients
I have many networks (vpns, vlans, etc.), and wanted to configure the use of dnsbl as a default from any network except for specific clients or networks listed. In the examples above, each network has to be listed as either dnsbl or bypass. I didn't want to have to list all networks, and only list bypass IPs/networks since most will use dnsbl.
The key I found to get this working was to set
view-first: no
This wasn't entirely clear to me from the unbound documentation, but seems to work as ignoring the default settings.
I also tried entering a view network such below, to cover all possible private IPs. But these didn't work:
access-control-view: 172.16.0.0/12 bypass_dnsbl access-control-view: 192.168.0.0/16 bypass_dnsbl
My working config is here:
server: include: /var/unbound/pfb_dnsbl.*conf access-control-view: 172.20.0.0/24 bypass_dnsbl #guest vlan view: name: "bypass_dnsbl" view-first: no include: /var/unbound/host_entries.conf #Host overrides AND DHCP reservations include: /var/unbound/dhcpleases_entries.conf #DHCP leases
I think this would also have the added benefit of pfblocker not re-adding the "include:" config, but not entirely sure since I have only added recently. If anyone notices an issue with this, please let me know!
-
Hello everyone, is there a possibility to allow a particular host or network to access a certain category of dnsbl? Example: IP 192.168.0.1 access the social networks category and continue with the rest blocked?
Thanks.
-
@fabioccoelho said in Bypassing DNSBL for specific IPs:
Hello everyone, is there a possibility to allow a particular host or network to access a certain category of dnsbl? Example: IP 192.168.0.1 access the social networks category and continue with the rest blocked?
Thanks.
Looks like its being worked on, good timing.
https://www.reddit.com/r/pfBlockerNG/comments/kdg5wq/preliminary_dnsbl_group_policy/Without these upcoming features, what you want to do would be pretty complicated. I have previously set up different pfsense/pfblocker instances to to accomplish this.
-
@risfold Thanks a lot :-)
-
This thread started in 2018 and has comments up to the end of 2020.
Do we have an option in the gui to allow one or more ip addresses or hosts to do unblocked DNS?
What I am looking for is something in the GUI that is stable and will stay when doing upgrades. Command line tricks and extra config files are not what I am asking for.
Thanks,
Joe -
-
@gertjan I'm not getting that on the page. Using v3.0.0_16 on pfsense 2.5.1
-
@godatum Check the reddit link posted above, there is a tip that says to switch to python mode for the option to become available:
Preliminary DNSBL Group Policy : pfBlockerNG
https://www.reddit.com/r/pfBlockerNG/comments/kdg5wq/preliminary_dnsbl_group_policy/ -
Yep, this box should be checked :
-
Here from Reddit, then Mayfield IT...
I've got a setup where I'd like to bypass pfBlockerNG for one single entire interface but keep it enabled for my other 2 interfaces. Interfaces "LAN1" (10.0.0.0 /24) and "Crapwork" (192.168.0.0 /24) should still get the full pfBlockerNG treatment (DNSBL+IPBL) while the unlucky guests on interface "BARN" (172.16.0.0 /24) won't and will have to see ads and get random IPs from bad places poking around!Would I need to enter the below into the "custom options" box in DNS resolver settings and then also make sure interface "BARN" is not selected (while LAN1 and Crapwork are) in the "Outbound Firewall Rules" section of IP tab under pfBlockerNG?
server: access-control-view: 172.16.0.0/24 bypass access-control-view: 10.0.0.0/24 dnsbl access-control-view: 192.168.0.0/24 dnsbl view: name: "bypass" view-first: yes view: name: "dnsbl" view-first: yes include: /var/unbound/pfb_dnsbl.*conf
Or should I update pfSense (on 2.4.5 yikes) and then update pfBlockerNG (on 2.2.5_30) and use the Bypass IPs field where I'd put (presumably) 172.16.0.0/24 and then same as above for IPBL settings?
-
@turbotater19 said in Bypassing DNSBL for specific IPs:
Or should I update pfSense (on 2.4.5 yikes)
Back then, as for as I can remember, you had to enter the custom unbound parameters (like you showed - can't tell if they are correct, though).
The latest pfSense, and the latest pfBlockerNG makes it possible to exclude IP (or even networks ?) using the pfBlockerNG GUI.
Select the (DNSBL) 'Python Group Policy' option and fill in the IP's. -
@gertjan said in Bypassing DNSBL for specific IPs:
Back then, as for as I can remember, you had to enter the custom unbound parameters (like you showed - can't tell if they are correct, though).
The latest pfSense, and the latest pfBlockerNG makes it possible to exclude IP (or even networks ?) using the pfBlockerNG GUI.
Select the (DNSBL) 'Python Group Policy' option and fill in the IP's.Thanks for the reply. I guess then what I'm asking for is if anyone thinks my code is correct for keeping DNSBL active on 2 of my 3 interfaces while the one interface gets bypassed. All the examples I've seen appear to show a single IP bypassed while the rest are blocked or 2 VLANs.
Also, to implement this (provided I don't just update pfSense and then update pfBlockerNG), do I disable pfBlockerNG, add lines into custom options, save, then start pfBlockerNG? Or do I add this into custom options while pfBlockerNG is enabled?
-
I pasted my code in and initially it didn't work. Took out the leading spaces on each line and that fixed it, working as I'd hoped!
-
@gertjan
I can't find it? Is it removed?I'm trying to find a solution to unblock an IP, which is one of my blocklist as false positive.
-
@overlord said in Bypassing DNSBL for specific IPs:
I can't find it?
Find what ?
The initial - see above - is "how to bypass a specific IP".
Reading the post shows that @Ns8h wanted to exclude a LAN device from being DNSBL'ed by pfBlocker - this was in 2018.Or do you man : You want to whitelist an IP ( or DNSBL ?) from a list/feed you use ?
In that case, go to Firewall > pfBlockerNG > Alerts and look up the line where the IP was blocked. Example :if I want to unblock "8.8.8.8" blocked by the firewall rule pfB_DoH_IP_v4 (uses an alais that contains all the IPs from the TheGreatWall_DoH... DNDBL feed, I have to move the mouse to the red padlock, click and follow the instructions.
This measure is temporary - as stated.Clicking on the black + sign is permanent :
Just follow the instructions.
-
@gertjan said in Bypassing DNSBL for specific IPs:
Yep, this box should be checked :
This did not work for me at all, and neither using custom unbound views. Not sure where else to look.
-
Just checking "Python Group Policy" does nothing.
It's stated that "Enable the Python Group Policy functionality to allow certain Local LAN IPs to bypass DNSBL"So certain local IPs have to be entered.
Like :
edit :
I didn't have any DNSBIl activated, so I activated one.
This one :Take a look at the feed text, and you find the last entry :
avsvmcloud.comOn my PC with the IP 192.168.1.2 (on the policy list - see my image above) I could obtain an IP :
Or, on another PC using IP 192.168.1.9, I obtained "0.0.0.0" == DNSBL blocked ( I'm not using the build in pfBlockerNG web server, if I was, I would have received 10.10.10.1 ).
My conclusion : Group policy works.
I did not test IPv6 here. For IPv4 it worked.
-
@gertjan I added my local IP4 addresses under the group policy as host IP's with no subnet mask range e.g. /32 /24 etc.. I restarted pfsense, unbound, ran , update force, reload and still no dice. I love the way it works but I need to whitelist IP's to get around pfblocker/dnsbl/geoip restrictions I've set already. thanks!
-
@gertjan
As I can see there are no rules under "Deny". I have read there, that this issue could be from the installed version (2.1.4_26). Is this 2x version still in development? Is there a release date for the 3.x devel version? (Devel becomes non devel) -
@smokinmojoe I was literally saying this out loud to myself. This package has been available for quite some time and the fact that this request which is very reasonable and very obvious that is needed is not implemented really hurts my soul.
Yes, DNS sinkholing is great. You would think along the way someone would've thought to themselves "Gee, what if there's a user that shouldn't be restricted". Pretty much the follow-up to that thought was "ehh that would never happen. what an unlikely thing to think".
-
Not implemented ?
I just spend looking some time why my DNSBL didn't seem to work. Then I found out out wasn't working for the PC is was using, but it was working, for the PC right next to me.
I recalled : I've added the IPv4 and IPv6 of the PC I'm using on the "Python Group Policy" list.Btw : Python Group Policy was added to the "pfBlockerNG-devel 3.1.0_1"", not the ancient 'pfBlockerNG 2.1.4_26'.
-
Unless there's something wrong in my config, I think I found a bug with bypassing DNSBL with the python feature...
For example, that if I add a client to the exclusion list (Python group policy) to bypass DNSBL, almost immediately after, DNSBL starts behaving very weirdly by allowing traffic from the unblocked client as it should, but randomly also from other clients. Sometimes it returns the 1x1 gif thingy, sometimes the webpage with "This website BLABLABLA has been blocked by the Network Administrator!"
(Edited this post after more troubleshooting)
-
Your are using the correct IP addresses ? Like :
When you change DNSBL settings :
Do a force realod all for pfBlocker.
Reset for every LAN device the local DNS cache.
Windows will need aipconfig /flushdns
@pftdm007 said in Bypassing DNSBL for specific IPs:
Sometimes it returns the 1x1 gif thingy, sometimes the webpage with "This website BLABLABLA has been blocked by the Network Administrator!"
That what's left over from the DNSBL web server that wants to tell you a page has been blocked.
To make a long story short : don't use the DNSBL web server, because (repeat after me) "it is impossible to redirect a https request".Select :
-
@pftdm007 python mode is very iffy. I have found that using unbound custom dns options works way better to exclude hosts or networks from DNSBL where as python mode only allows /32 exclusions which isn’t very scalable at all. I would highly recommend that over python mode.