OPNsense Forum
English Forums => General Discussion => Topic started by: lifepillar on May 12, 2022, 12:52:11 pm
-
I am using Unbound on OPNsense 22.1.6. I have enabled blocklists and added Steven Black list. On my local machine, I try if it works:
$ dig 44chan.me
; <<>> DiG 9.10.6 <<>> 44chan.me
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16001
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;44chan.me. IN A
;; ANSWER SECTION:
44chan.me. 3600 IN A 0.0.0.0
So far, so good. However, Unbound still resolves subdomains of blocked domains:
$ dig cz.44chan.me
; <<>> DiG 9.10.6 <<>> cz.44chan.me
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36141
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;cz.44chan.me. IN A
;; ANSWER SECTION:
cz.44chan.me. 14400 IN A 72.52.178.23
Looking at the blocklists, I see thar there are entries of the type: local-data "<domain> 0.0.0.0". I have tried to change them to local-zone: "<domain>" always_nxdomain and then it blocks also subdomains. Is the current behaviour intentional? Could it be changed as I suggest?
-
I would prefer the usage of
local-zone: "donaldtrump.com" redirect
local-data: "donaldtrump.com A 0.0.0.0"
in order to block duck.donaldtrump.com and f... and s... etc…
As it will have the same behavior of returning 0.0.0.0 instead of NXDOMAIN ...
-
Thanks for the tip!
I'm afraid, however, that my changes are overridden as soon as the blocklist is updated. Is there a way to tweak OPNsense to block subdomains by default?
-
I have implemented this in our ansible role for unbound + dnsbl (https://github.com/Rosa-Luxemburgstiftung-Berlin/ansible-role-unbound)
If I find the time, I can open a PR, or if you like, you can do this too .. the main lines are https://github.com/Rosa-Luxemburgstiftung-Berlin/ansible-role-unbound/blob/main/templates/unbound-dnsbl-updater.py.j2#L82:L96 ... it is open source ...
-
Cool, thanks! I'll try it later today!
-
I've monkey-patched my installation, and it works. Thanks!
As for the PR, I think that this would address my issue: https://github.com/opnsense/core/pull/5152. Unfortunately, it's still open, but hopefully it will be merged soon.