pfSense DNSBL Whitelisting to Unblock Specific Sites

While I was away, someone asked me about pfSense DNSBL whitelisting, so I wanted to share a tutorial for it.

pfSense DNSBL Whitelisting - Introduction

First, the you might want to perform whitelisting if DNSBL is blocking a domain that you want access to.

Instead of removing a feed that you have subscribed you, you can whitelist a specific domain.

Note that pfBlockerNG's DNSBL does not support wildcard domains. This means that you need to whitelist subdomains individually.

Blocked Page

First, we need to find a blocked page. For my example, I'm going to use


To verify that pfBlockerNG blocked the domain, we can visit the site in a browser.

If it is an SSL connection, then your browser will display a certificate error. This is due to the pfSense SSL certificate being self-signed.

pfSense DNSBL Whitelisting - HTTPS Blocked

Over plain HTTP connections, the your browser will replace the page with a 1x1 pixel image.

pfSense DNSBL Whitelisting - HTTP Blocked

If the page is loading an external script, then you can also notice the errors in your developer console. Note that this screenshot isn't for, but a different page.

pfSense DNSBL Whitelisting - Dev Console Errors

Finally, you can also view what pages that DNSBL has blocked in the logs. You can find these under Firewall -> pfBlockerNG -> Logs -> dnsb.log

DNSBL Reject HTTPS,Mar 13 21:35:50,

Performing the Whitelisting

First, to add a domain to the whitelist, go to pfBlockerNG -> DNSBL -> DNSBL -> Custom Domain Whitelist.

At the bottom of the list, add the domain you'd like to unblock and click Save. In this case, I just added

Next, you need to reload the filters. To do this go to Update -> Reload and select Reload and DSNBL.

After a little time (depending on how many feeds you have), the reload will be complete.

pfSense DNSBL Whitelisting - Unblocked

Verifying the Whitelist

To verify that the whitelisting was successful, attempt to reload the page. This is best done in an incognito window, to make sure that your browser hasn't cached anything.

pfSense DNSBL Whitelisting - Reload Complete

pfSense DNSBL Whitelisting - Conclusion

While I was unable to unblock the specific request (Politico comments), hopefully this explains how to perform DNSBL whitelisting.

Some sites you will have to unblock many different domains, just because of external scripts.

Let me know if you have any questions or comments about this technique.

doyler on Githubdoyler on Twitter
Ray Doyle is an avid pentester/security enthusiast/beer connoisseur who has worked in IT for almost 16 years now. From building machines and the software on them, to breaking into them and tearing it all down; he's done it all. To show for it, he has obtained an OSCE, OSCP, eCPPT, GXPN, eWPT, eWPTX, SLAE, eMAPT, Security+, ICAgile CP, ITIL v3 Foundation, and even a sabermetrics certification!

He currently serves as a Senior Staff Adversarial Engineer for Avalara, and his previous position was a Principal Penetration Testing Consultant for Secureworks.

When he's not figuring out what cert to get next or side project to work on, he enjoys playing video games, traveling, and watching sports.

As an Amazon Associate I earn from qualifying purchases.

Common passed on this blog, I made it to a jam.


Filed under Security Not Included

2 Responses to pfSense DNSBL Whitelisting to Unblock Specific Sites

  1. Lorne

    Thanks for taking the time. There is bad info out there. Someone said Wildcarding was permitting and I couldn’t figure out why it didn’t work. When I read your explanation and I removed the wildcard it started working, so thank you!

Leave a Reply

Your email address will not be published. Required fields are marked *


This site uses Akismet to reduce spam. Learn how your comment data is processed.