While I was away, someone asked me about pfSense DNSBL whitelisting, so I wanted to share a tutorial for it.
pfSense DNSBL Whitelisting – Introduction
First, the you might want to perform whitelisting if DNSBL is blocking a domain that you want access to.
Instead of removing a feed that you have subscribed you, you can whitelist a specific domain.
Note that pfBlockerNG’s DNSBL does not support wildcard domains. This means that you need to whitelist subdomains individually.
First, we need to find a blocked page. For my example, I’m going to use http://id.google.com/.
To verify that pfBlockerNG blocked the domain, we can visit the site in a browser.
If it is an SSL connection, then your browser will display a certificate error. This is due to the pfSense SSL certificate being self-signed.
Over plain HTTP connections, the your browser will replace the page with a 1×1 pixel image.
If the page is loading an external script, then you can also notice the errors in your developer console. Note that this screenshot isn’t for id.google.com, but a different page.
Finally, you can also view what pages that DNSBL has blocked in the logs. You can find these under Firewall -> pfBlockerNG -> Logs -> dnsb.log
DNSBL Reject HTTPS,Mar 13 21:35:50,id.google.com
Performing the Whitelisting
First, to add a domain to the whitelist, go to pfBlockerNG -> DNSBL -> DNSBL -> Custom Domain Whitelist.
At the bottom of the list, add the domain you’d like to unblock and click Save. In this case, I just added id.google.com.
Next, you need to reload the filters. To do this go to Update -> Reload and select Reload and DSNBL.
After a little time (depending on how many feeds you have), the reload will be complete.
Verifying the Whitelist
To verify that the whitelisting was successful, attempt to reload the page. This is best done in an incognito window, to make sure that your browser hasn’t cached anything.
pfSense DNSBL Whitelisting – Conclusion
While I was unable to unblock the specific request (Politico comments), hopefully this explains how to perform DNSBL whitelisting.
Some sites you will have to unblock many different domains, just because of external scripts.
Let me know if you have any questions or comments about this technique.