domain not being blocked
-
I am following this tutorial: https://nguvu.org/pfsense/pfSense-pfblockerng-configuration-guide/.
In my PRI1 IPv4 Custom List, I add msn.com to test that it is working. When I save, then update, the page still loads. I did enable Enable Domain/AS.
I am running Netgate pfSense Plus 23.05.1 and pfBlockerNG-devel 3.2.0_5. -
@droidus Bare in mind that the IP could change...it would be better to add the domain to DNSBL instead.
-
@droidus said in domain not being blocked:
I add msn.com to test that it is working. When I save, then update, the page still loads.
keep in mind also states, and dns being cached.. These are 2 things that have to take into account.
If client looks up domain.tld and gets say IP address 1.2.3.4.. Just because you tell unbound via pfblocker to not resolve that IP or send a bogus IP, the client would still have the IP cached in its local dns and also its browser dns cache, etc.
You also need to take into account even if you created a rule to block the 1.2.3.4 address, unless you cleared the state on the firewall, even with a new block rule - the traffic would still be allowed via the existing state.
You need to either kill off that state, or wait for it to timeout and be cleared on its own.. Then when client tries to create a new state to this IP, the firewall would block it.
-
@johnpoz said in domain not being blocked:
You also need to take into account even if you created a rule to block the 1.2.3.4 address, unless you cleared the state on the firewall, even with a new block rule - the traffic would still be allowed via the existing state.
You need to either kill off that state, or wait for it to timeout and be cleared on its own.. Then when client tries to create a new state to this IP, the firewall would block it.
How do I do this without clearing all states as posted here: https://docs.netgate.com/pfsense/en/latest/monitoring/status/firewall-states-reset.html?
How can I test if pfblockerng is working without accessing malicious IPs? Would I just add an IP, like 8.8.8.8 to IPv4 Custom_List, UPDATE, and see if I can still ping it? -
@droidus you can kill off specific states in the state table
