Simple adblock using unbound and nginx

[azurata]

1. Create a virtual IP in the LAN interface:

2. ssh to the pfsense and install nginx and nano:
pkg install nginx nano

3. create update_adblock_file.sh:
/usr/local/bin/nano -w /usr/local/sbin/update_adblock_file.sh

#!/bin/sh

adblock_file='/etc/adblock_file'
nginx_ip='1.2.3.4'

my_block_list=" \
	254a.com \
	yp.xn--i1b2e6b6ah.com \
"
mylist=`for host in $my_block_list; do echo "127.0.0.1 $host"; done`

yoyo=`/usr/bin/fetch -qo- 'http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext'`
if [ $? -eq 0 ]; then
	rm -f $adblock_file
	echo "$mylist\n$yoyo" | uniq -di | grep 127.0.0.1 | awk '{print "Duplicate:",$2}' >&2
	echo "$mylist\n$yoyo" | sort -uf | grep 127.0.0.1 | awk '{print $2}' | \
	while read line; do
		echo "local-zone: \"$line.\" redirect" >> $adblock_file
		echo "local-data: \"$line. 3600 IN A $nginx_ip\"" >> $adblock_file
	done
else
	echo "FAIL TO DOWNLOAD"
fi

4. mark file executable:
chmod +x /usr/local/sbin/update_adblock_file.sh

5. execute:
/usr/local/sbin/update_adblock_file.sh

6. generate certificate:
openssl req -x509 -nodes -days 3650 -subj "/C=PT/CN=1.2.3.4" -sha512 -newkey rsa:4096 -keyout /usr/local/etc/nginx/nginx.key -out /usr/local/etc/nginx/nginx.pem

7. edit nginx.conf:
/usr/local/bin/nano -w /usr/local/etc/nginx/nginx.conf

user  nobody;
worker_processes  1;

pid        /var/run/nginx.pid;

events {
    worker_connections  1024;
}

http {
        server {
                listen 1.2.3.4:80;
                listen 1.2.3.4:443 ssl;
                server_name adblocker;

                ssl_certificate /usr/local/etc/nginx/nginx.pem;
                ssl_certificate_key /usr/local/etc/nginx/nginx.key;
                ssl_protocols TLSv1.1 TLSv1.2;
                ssl_ciphers 'AES128+EECDH:AES128+EDH';

                expires max;
                rewrite ^(.*)$ / last;
                location / {
                        return 204;
                }
        }
}

7. run nginx:
/usr/local/sbin/nginx

8. add block rules to unbound:

When you reboot pfsense don't forget to start nginx, and update the adblock list from time to time.(automate this using cron)

regards azurata

[KOM]

I'm not sure how this is easier than just using squidGuard.  What is the point of nginx in this?  pfSense already has a working web server.

[azurata]

@KOM:

I'm not sure how this is easier than just using squidGuard.

I don't use squid.

@KOM:

What is the point of nginx in this?

nginx will speed browsers page load(by not waiting for servers that will not respond)

@KOM:

pfSense already has a working web server.

For my need config, nginx is better than lighttpd.

[neo_]

Sorry for the basic question, how how do we actually enable this? Transparent proxy…?

[wilixje]

I performed all the steps like described in your great guide, but Unbound isn't starting anymore when the General DNS Resolver Options for the advanced field be changed to:

server:
include: /etc/adblock_file

The content of the /etc/adblock_file looks like this format:

local-zone: "101com.com." redirect
local-data: "101com.com. 3600 IN A 172.16.0.1"
local-zone: "101order.com." redirect
local-data: "101order.com. 3600 IN A 172.16.0.1"
local-zone: "123found.com." redirect
local-data: "123found.com. 3600 IN A 172.16.0.1"

Do you have any tips to help me solve the issue so Unbound will start?

Update:
If I copy the content of /etc/adblock_file within the advanced field, started with    server:    on the first row, unbound is starting fine. But this is more a workaround, because the this field isn't updated automatically.

[zuperjotmeil]

To solve the proble you have to put the adblock_file in /var/unbound/adblock_file.conf

So modify the script with this:

#!/bin/sh

adblock_file='/var/unbound/adblock_file.conf'
nginx_ip='1.2.3.4'

my_block_list="
254a.com
yp.xn–i1b2e6b6ah.com
"
mylist=for host in $my_block_list; do echo "127.0.0.1 $host"; done

yoyo=/usr/bin/fetch -qo- 'http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext'
if [ $? -eq 0 ]; then
rm -f $adblock_file
echo "$mylist\n$yoyo" | uniq -di | grep 127.0.0.1 | awk '{print "Duplicate:",$2}' >&2
echo "$mylist\n$yoyo" | sort -uf | grep 127.0.0.1 | awk '{print $2}' |
while read line; do
echo "local-zone: "$line." redirect" >> $adblock_file
echo "local-data: "$line. 3600 IN A $nginx_ip"" >> $adblock_file
done
else
echo "FAIL TO DOWNLOAD"
fi

That solve the problem

[BBcan177]

https://forum.pfsense.org/index.php?topic=102470.0