block custom domains in pfblocker


  • Netgate Administrator

    I do it like this:

    Selection_607.png

    You need to have 'Enable TLD' set in the main DNSBL tab to block all sub domains of domains listed there.

    Steve



  • thanks
    for your help



  • @stephenw10 I had to provide a dummy file name that fails to load because it validates source and header fields (can’t be blank), but it still seems to load the custom domain list.

    Thanks!


  • Netgate Administrator

    Hmm, interesting. I still have that setup exactly like that and it seems OK, no errors reported. Are you running the dev version of pfBlocker?

    Steve



  • @stephenw10 what are the differences between pfBlocker and pfBlocker-dev?


  • Netgate Administrator

    All the new features are in pfBlocker-dev at this point.

    Better to check/ask here: https://forum.netgate.com/category/62/pfblockerng

    Steve


  • LAYER 8 Global Moderator

    Just so you know, you can block domains in unbound directly as well.

    In your custom box of unbound

    server:
    local-zone: "logs.roku.com" redirect
    local-data: "logs.roku.com A 127.0.0.1"
    

    This would return loopback for anything.logs.roku.com, so client not going anywhere.. You could point that to any ip you want..

    If you just want to block say host.logs.roku.com you could do that with a simple host override in unbound as well..

    This is easy if you only have a handful you want to block, etc. But could get a bit overwhelming if you say had hundreds you wanted to block.



  • @stephenw10 .....I'm running pfBlockerNG-dev 2.2.5_27 and I do not see this page to create "Custom Block List." Am I missing something? Really need to create a domain block list and have tried most of the suggestions here.



  • @stephenw10 Sorry....dashboard says I'm running 2.4.4 latest version



  • Hi Tom, just jumping in because I recently learned where the "Custom options" box is located in pfSense 2.4.4 p3. Look here: Services/DNS Resolver/General Settings/Display Custom Options.

    You will find this near the bottom of the page when you scroll down. Be careful how you use this. Do some reading and ask more questions, or do it on a "sandbox router" like I have set up for learning.

    Good luck!

    Greg



  • @GregBinSD
    Thanks Greg....I feel like I'm losing my mind....

    In my Display Custom Options box is this: "server:include: /var/unbound/pfb_dnsbl.*conf"

    If I try to add a domain (facebook.com) to the option box (as illustrated in other posts), pfSense generates an error trying to save config.

    pfb_dnsbl.conf appears to contain all of my blocks though they are each divided into two lines "local-zone" and "local-data".

    I don't believe I could simply edit the file (too easy) as it appears to be generated.

    Still stumped


  • LAYER 8 Global Moderator

    Dude post up what your putting in the box... This is not rocket science... I showed you EXACTLY how to block something..

    edit:
    Here I just blocked anything.facebook.com

    blocked.jpg

    For any client on your network using pfsense for their dns.


  • Netgate Administrator

    If you want to do this through pfBlocker (non-dev version) as I showed above go to:
    Firewall > pfBlockerNG > DNSBL > DNSBL-Feeds

    Add a new feed configured as in my screenshot above. The Custom Blocklist field is there.

    Steve



  • Folks I don't need the attitude here. I have spent hours reading/researching how to do this. With no firm consensus on the solution, I keep trying them all and then I come here.

    So how does your response relate to my question of the contents of my Custom Options - "server:include: /var/unbound/pfb_dnsbl.*conf"?

    Help or more attitude?

    Do I add your lines to a "xyz.conf" file or just enter them in the custom box below whats there?


  • LAYER 8 Global Moderator

    There are multiple ways to skin this cat... You can do it in pfblocker directly, you could do it in the custom option box for unbound. Or sure you could hand edit a conf file - but if you hand edit some conf unless your loading that extra conf you created into unbound via the option box and directly editing the normal unbound.conf then it would get overwritten.

    edit: removed my remarks after reading them - they had too much attitude in them... And just don't feel like dealing with this sort of nonsense so early in the year.

    Good luck!



  • @johnpoz
    Thanks, John. I've been around this game for a LONG time and everytime I have to learn a new firewall, there always seems to be some head-banging that I have to go through.

    I agree that editing a conf file will not work as they will get overwritten. So I'm looking at using the custom option box. So first, the only custom option I find is under "DNS Resolver/General Settings" will lines suggested:
    Capture2.JPG

    But that then produces this:
    Capture.JPG

    So perhaps I don't know where the "control box of unbound" is as was suggested earlier. Am I even in the right neighborhood?

    Thanks for your patience.



  • Tom, try this:

    server:
    local-zone: "facebook.com" redirect
    local-data: "facebook.com A 127.0.0.1"
    include: /var/unbound/pfb_dnsbl.*conf



  • @GregBinSD
    Same error.....



  • Sorry, Tom. Try one more thing.

    Looking above a little, johnpoz pasted just these lines into the Customs options box, leaving out the pfblocker line:

    server:
    local-zone: "facebook.com" redirect
    local-data: "facebook.com A 127.0.0.1"

    So, clear out the Customs options box and paste in the 3 lines above, like johnpoz did.

    BTW, at Windows cmd prompt, clear the DNS cache by typing:
    ipconfig /flushdns

    ...and clear your browser's cache of history and files, as well, before testing your results.

    Greg



  • @GregBinSD

    But isn't the pfblocker line responsible for loading the blocklist feeds?



  • Tom, johnpoz knows for sure, but from what I have gathered, the DNS used by pfSense is called "unbound", and it can be seen running in the background if you go to Status/Services. Unbound can read those 3 lines without the help of pfBlockerNG. In fact, I am experimenting with a TLS encrypted DNS service, without using pfBlockerNG. The developer had me put 8 lines into the Custom options box, along with setting some parameters giving me an account on his web interface. None of those lines reference pfb.


  • Netgate Administrator

    I would add them through pfBlocker as I outlined above. But pfBlocker just adds it's own additional config there so you can add it manually to Unbound if you want.

    If the pfb_dnsbl include file already has a zone defined for facebook.com you might be conflicting. Try adding something completely different there.

    Steve



  • @TopperTom Hey Tom, I made an account just to answer your question here, as you're very very close to having this correct.

    You can put the include for your conf file at the bottom of the box and any server includes you need at the top. I run this exact thing on my box while I'm experimenting with blocking Youtube ads. Here's what my custom options look like:

    server:
    local-zone: "manifest.googlevideo.com" redirect
    local-data: "manifest.googlevideo.com A 10.10.10.1"
    include: /var/unbound/pfb_dnsbl.*conf
    

    I hope this helps relieve the frustrations you've had with this so far.


  • Netgate Administrator

    Yes, that should work as long as manifest.googlevideo.com is not defined as a local-zone in pfb_dnsbl.conf already. I think that was the problem previously. Once we removed the two server entries.

    Steve



  • @stephenw10 said in block custom domains in pfblocker:

    Yes, that should work as long as manifest.googlevideo.com is not defined as a local-zone in pfb_dnsbl.conf already. I thing that was the problem previously. Once we removed the two server entries.

    Steve

    Ah, that makes sense. After reading back through the thread again, I see that GregBinSD made the same recommendation that I did and Tom still had problems with that. In this use case, I'd have to echo what others have already said about just making a custom feed and putting any entries needed in there.


Log in to reply