Hagezi Blocklist Not Available?

[Aveamantium]

I was re-setting up my blocklist tonight and noticed that Hagezi isn't pulling anything? I'll check again in the morning to see if it is a github issue.

2026-08-13T00:10:15-06:00
Error
unbound
unable to download blocklist from https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/tif.txt and no cache available
2026-08-13T00:10:15-06:00
Error
unbound
blocklist download : error reading file from https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/tif.txt (error : blocklist download : unable to download file from https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/tif.txt (status_code: 404))

[Monviech (Cedrik)]

Its a german post but this explains it:

https://forum.opnsense.org/index.php?topic=52678.msg272624#msg272624

[Aveamantium]

Good to know, thanks! 

[Monviech (Cedrik)]

https://github.com/opnsense/core/pull/10709

[OPNenthu]

https://github.com/opnsense/core/pull/10709

Thank you!  Is this going out soon or should we apply it as a patch for now?

[tangofan]

https://github.com/opnsense/core/pull/10709

Thank you!  Is this going out soon or should we apply it as a patch for now?

As another option, you could switch to advanced mode in the blocklist entry, clear all blocklist types and enter the new URLs from the patch directly.

[gpfountz]

I applied the patch (sudo opnsense-patch 4287082) and hit apply on the Blocklist page.  Working good now.

[OPNenthu]

If using the patch method, make sure to reapply it after updating to 26.7.2_2 (or any subsequent version) until the change is released.  The patch doesn't survive updates.

[Patrick M. Hausen]

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

[tangofan]

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

Indeed, it won't be. Hagezi himself recommends a different mirror for his repo and the new patch points to that one, IIRC. But until that patch ships in a release and folks have updated to it, at least their old blocklist entry will work again (at least until the next github suspension).

On a side note, I am very surprised that github doesn't have a mechanism to prevent certain repos that are frequently subject to reporting spam from being blocked without human review. But perhaps I'm expecting too much...

[OPNenthu]

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

All, pay attention to Patrick's note here ^ about "dnsbunker.org" being blocked by DOH lists.  It is also blocked by this one, if not others:

https://dbl.ipfire.org/lists/doh/domains.txt

So you might need to add an override.  I don't know if the firewall itself is affected by DNSBL policy (maybe depending on your setup), so may or may not be an issue for you.

This is a kind of ironic situation.  Hopefully hagezi can settle on a host that is NOT also a DNS provider.

--

EDIT: this regex seems OK for Unbound DNSBL policies in OPNsense.  Added to "Allowlist Domains"

Code Select Expand

^hagezi-mirror\.dnsbunker\.org$

Code Select Expand

$ nslookup dnsbunker.org
Server: 127.0.0.53
Address: 127.0.0.53#53

** server can't find dnsbunker.org: NXDOMAIN

$ nslookup test.dnsbunker.org
Server: 127.0.0.53
Address: 127.0.0.53#53

** server can't find test.dnsbunker.org: NXDOMAIN

$ nslookup hagezi-mirror.dnsbunker.org
Server: 127.0.0.53
Address: 127.0.0.53#53

Non-authoritative answer:
Name: hagezi-mirror.dnsbunker.org
Address: 46.38.249.63
Name: hagezi-mirror.dnsbunker.org
Address: 2a03:4000:6d:1cad::24:6016


[Patrick M. Hausen]

So you might need to add an override.  I don't know if the firewall itself is affected by DNSBL policy (maybe depending on your setup), so may or may not be an issue for you.

This would (I have not changed anything on my installations just yet) entirely depend on your precise DNS setup.

In my case the answer is yes.

- AGH is listening on all interfaces, port 53
- AGH is using Unbound at 127.0.0.1:53530 as an upstream resolver
- Unbound gets all static DHCP reservations from Kea, additionally there are some static overrides
- OPNsense uses 127.0.0.1:53 as its DNS server - that's AGH

But as of just an hour ago or so the HaGeZi github repo is back online. AGH lists are updated, too. An I can resolve hagezi-mirror.dnsbunker.org just fine.

I suggest everyone interested just watch this issue:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

Kind regards,
Patrick

[OPNenthu]

Unbound is configured as my system resolver but I wasn't sure if the default DNSBL policy (with no source net defined) would apply to 'localhost.'

It does.

You cannot view this attachment.

[tangofan]

The repo on github is back online. IMHO that won't be the solution:

https://github.com/AdguardTeam/AdGuardHome/issues/8561

All, pay attention to Patrick's note here ^ about "dnsbunker.org" being blocked by DOH lists.  It is also blocked by this one, if not others:

https://dbl.ipfire.org/lists/doh/domains.txt

So you might need to add an override.  I don't know if the firewall itself is affected by DNSBL policy (maybe depending on your setup), so may or may not be an issue for you.

This is a kind of ironic situation.  Hopefully hagezi can settle on a host that is NOT also a DNS provider.

One way one might also circumvent this problem is to set the option "Do not use the local DNS service as a nameserver for this system" under System->Settings->General. Then OPNsense should go upstream for all its DNS requests, instead of using the local Unbound DNS and its blocklists.

[Patrick M. Hausen]

I do not use nor recommend depending on an external upstream. A local recursive name server like Unbound is my preferred way of providing name resolution to end systems.