Recent posts

#1

General Discussion / Re: [SOLVED] Periodic NIC issu...

Last post by OPNenthu - Today at 12:26:14 AM

Although I can't prove it with data, the update did something.  This is the first time in a long while (maybe since I still had my Asus router) that I am not seeing delays when loading pages.

I still have the sporadic packet loss in dpinger as I posted earlier but I'm now chalking that up to an ISP or cable infrastructure issue.

#2

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by OPNenthu - Today at 12:13:00 AM

Then OPNsense should go upstream for all its DNS requests, instead of using the local Unbound DNS and its blocklists.

You can also not use any DoH lists in the default Unbound policy and instead configure that only on source-net specific policies.  Multiple ways to skin this cat.

I do also prefer my firewall go through Unbound, but I use DoT upstreams because ISPs in my country are not legally obligated to not sell customer data, and because Quad9 has up-to-date malware and threat intelligence that I can't otherwise get for free.

#3

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by Patrick M. Hausen - Today at 12:02:01 AM

I do not use nor recommend depending on an external upstream. A local recursive name server like Unbound is my preferred way of providing name resolution to end systems.

#4

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by tangofan - August 13, 2026, 11:52:37 PM

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

All, pay attention to Patrick's note here ^ about "dnsbunker.org" being blocked by DOH lists.  It is also blocked by this one, if not others:

https://dbl.ipfire.org/lists/doh/domains.txt

So you might need to add an override.  I don't know if the firewall itself is affected by DNSBL policy (maybe depending on your setup), so may or may not be an issue for you.

This is a kind of ironic situation.  Hopefully hagezi can settle on a host that is NOT also a DNS provider.

One way one might also circumvent this problem is to set the option "Do not use the local DNS service as a nameserver for this system" under System->Settings->General. Then OPNsense should go upstream for all its DNS requests, instead of using the local Unbound DNS and its blocklists.

#5

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by OPNenthu - August 13, 2026, 11:47:27 PM

Unbound is configured as my system resolver but I wasn't sure if the default DNSBL policy (with no source net defined) would apply to 'localhost.'

It does.

You cannot view this attachment.

#6

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by Patrick M. Hausen - August 13, 2026, 11:28:44 PM

So you might need to add an override.  I don't know if the firewall itself is affected by DNSBL policy (maybe depending on your setup), so may or may not be an issue for you.

This would (I have not changed anything on my installations just yet) entirely depend on your precise DNS setup.

In my case the answer is yes.

- AGH is listening on all interfaces, port 53
- AGH is using Unbound at 127.0.0.1:53530 as an upstream resolver
- Unbound gets all static DHCP reservations from Kea, additionally there are some static overrides
- OPNsense uses 127.0.0.1:53 as its DNS server - that's AGH

But as of just an hour ago or so the HaGeZi github repo is back online. AGH lists are updated, too. An I can resolve hagezi-mirror.dnsbunker.org just fine.

I suggest everyone interested just watch this issue:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

Kind regards,
Patrick

#7

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by OPNenthu - August 13, 2026, 11:00:31 PM

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

All, pay attention to Patrick's note here ^ about "dnsbunker.org" being blocked by DOH lists.  It is also blocked by this one, if not others:

https://dbl.ipfire.org/lists/doh/domains.txt

So you might need to add an override.  I don't know if the firewall itself is affected by DNSBL policy (maybe depending on your setup), so may or may not be an issue for you.

This is a kind of ironic situation.  Hopefully hagezi can settle on a host that is NOT also a DNS provider.

--

EDIT: this regex seems OK for Unbound DNSBL policies in OPNsense.  Added to "Allowlist Domains"

Code Select Expand

^hagezi-mirror\.dnsbunker\.org$

Code Select Expand

$ nslookup dnsbunker.org
Server: 127.0.0.53
Address: 127.0.0.53#53

** server can't find dnsbunker.org: NXDOMAIN

$ nslookup test.dnsbunker.org
Server: 127.0.0.53
Address: 127.0.0.53#53

** server can't find test.dnsbunker.org: NXDOMAIN

$ nslookup hagezi-mirror.dnsbunker.org
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: hagezi-mirror.dnsbunker.org
Address: 46.38.249.63
Name: hagezi-mirror.dnsbunker.org
Address: 2a03:4000:6d:1cad::24:6016


#8

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by tangofan - August 13, 2026, 10:53:40 PM

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

Indeed, it won't be. Hagezi himself recommends a different mirror for his repo and the new patch points to that one, IIRC. But until that patch ships in a release and folks have updated to it, at least their old blocklist entry will work again (at least until the next github suspension).

On a side note, I am very surprised that github doesn't have a mechanism to prevent certain repos that are frequently subject to reporting spam from being blocked without human review. But perhaps I'm expecting too much...

#9

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by Patrick M. Hausen - August 13, 2026, 10:34:26 PM

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

#10

26.7 Series / Re: Hagezi Blocklist Not Avail...

Last post by OPNenthu - August 13, 2026, 10:09:16 PM

If using the patch method, make sure to reapply it after updating to 26.7.2_2 (or any subsequent version) until the change is released.  The patch doesn't survive updates.