Looking for testers Q-Feeds plugin

Started by Q-Feeds, October 01, 2025, 08:43:40 PM

Previous topic - Next topic
Quote from: netwarden on December 15, 2025, 07:37:38 PMI don't see your block list here - do you know if this is expected?

However, under the feed section of your plugin, I see both feeds for Ip and Domain.


Hi Netwarden,

That is expected. If the blocklist feature is both enabled in Unbound and our Plugin the list is active. You can verify by checking the Unbound report where you can see the increase in the blocklist size.

Kind regards,

David

Your Threat Intelligence Partner  qfeeds.com

There no longer is a global "enable blocklists" setting in Unbound since the business implementation was merged into the community version in 25.7.8.

If you want to use the Q-Feeds blocklist exclusively, does this mean you only have to enable "register domain feeds" in the Q-Feeds settings and don't have to configure anything in Unbound?
OPNsense virtual machine images
OPNsense aarch64 firmware repository

Commercial support & engineering available. PM for details (en / de).

Quote from: Maurice on December 15, 2025, 10:40:14 PMThere no longer is a global "enable blocklists" setting in Unbound since the business implementation was merged into the community version in 25.7.8.

If you want to use the Q-Feeds blocklist exclusively, does this mean you only have to enable "register domain feeds" in the Q-Feeds settings and don't have to configure anything in Unbound?

Oh my mistake, yes on the latest version you only need to enable it in our plugin indeed.

Your Threat Intelligence Partner  qfeeds.com

Today at 09:36:34 AM #363 Last Edit: Today at 01:07:40 PM by Q-Feeds
QuoteOh my mistake, yes on the latest version you only need to enable it in our plugin indeed.

Please update the documentation to reflect this. Also, it doesn't seem to be working - I don't see any malicious domains getting blocked in the Unbound logs.

Quote from: netwarden on Today at 09:36:34 AM
QuoteOh my mistake, yes on the latest version you only need to enable it in our plugin indeed.

Please update the documentation to reflect this. Also, it doesn't seem to be working - I don't see any malicious domains getting blocked in the Unbound logs.

We've updated our documentation. The official documentation within the OPNsense docs is in review. Thank you for pointing it out.

That you don't see any domains blocked might be a good sign. It's not a list of Ads and Trackers which gets hits constantly. You can use the test functionality within Unbound (/ui/unbound/dnsbl/index#blocklist_tester) to see if it's working. Try these domains:

plant-with-crypto.org
platform8414.com

You should see output like this:

{
  "status": "OK",
  "action": "Block",
  "policy": {
    "source_nets": [],
    "address": "0.0.0.0",
    "rcode": 0,
    "description": "compat",
    "id": "09f398e4-3704-4957-b857-baaf590691c9",
    "prio": 3.402823669209385e+38,
    "hidx": 1,
    "bl": "qf_malware_domains"
  }
}

Your Threat Intelligence Partner  qfeeds.com

Quote from: Q-Feeds on Today at 01:11:28 PM
Quote from: netwarden on Today at 09:36:34 AM
QuoteOh my mistake, yes on the latest version you only need to enable it in our plugin indeed.

Please update the documentation to reflect this. Also, it doesn't seem to be working - I don't see any malicious domains getting blocked in the Unbound logs.

We've updated our documentation. The official documentation within the OPNsense docs is in review. Thank you for pointing it out.

That you don't see any domains blocked might be a good sign. It's not a list of Ads and Trackers which gets hits constantly. You can use the test functionality within Unbound (/ui/unbound/dnsbl/index#blocklist_tester) to see if it's working. Try these domains:

plant-with-crypto.org
platform8414.com

You should see output like this:

{
  "status": "OK",
  "action": "Block",
  "policy": {
    "source_nets": [],
    "address": "0.0.0.0",
    "rcode": 0,
    "description": "compat",
    "id": "09f398e4-3704-4957-b857-baaf590691c9",
    "prio": 3.402823669209385e+38,
    "hidx": 1,
    "bl": "qf_malware_domains"
  }
}

Yes, I see them. I believe I am all set for now. Thanks for helping me out.

{
  "status": "OK",
  "action": "Block",
  "policy": {
    "source_nets": [],
    "address": "0.0.0.0",
    "rcode": 0,
    "description": "compat",
    "id": "78805629-a0dd-4cb4-ac04-0510a653078e",
    "prio": 3.402823669209385e+38,
    "hidx": 1,
    "bl": "qf_malware_domains"
  }
}