From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fwvL15lx7z33c5 for ; Wed, 15 Apr 2026 21:24:41 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fwvKr4FfSz2xHP for ; Wed, 15 Apr 2026 21:24:32 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4fwvKg0v27z4cf; Wed, 15 Apr 2026 21:24:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1776288264; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=+4SSKJabZ8TzOFxChO61uFam00tdX2Wnzrua467i0q8=; b=JY3JbWru3Cy3bFR2nl2zmM06lCx8LcoqQa4rZBarvBr0ZyhGiL1Ztl9fnllsv/5NYF3N9U XQoJJD+AWOqZjIyRW/hU5UB4j2auxGkQhPix/RsMzboGBgJpzwy39/ov5uuVPq0DVgquFJ oj5g8Od+ErKHaSk6h5LPvb308ujU/g3hwiWpgtMLJXWMmiPm4ytFgAkumRH++iE45WHxrd 9i05oeSLr4Eg7Bp8GWL64JPFgnzDkocyKwskGFWE45tRlk3dfoEKHbFWxFRvw7QCsXYMBo V95WKRaBg/Bo9Eax9ING6ieLDdrVVwlyJ3HYRBNEn6oVEGzcTT4O/8Y+VLYplw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1776288264; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=+4SSKJabZ8TzOFxChO61uFam00tdX2Wnzrua467i0q8=; b=ei2QUnhXzA2XW1LUvOFU9kNc1PN+MbYk4thIy3ICvZpDG+KQxVPRuOMvTG7SLt/oIt1xPd glwizjwVm8zfcpBg== Date: Wed, 15 Apr 2026 16:24:16 -0500 From: Jon Murphy To: =?utf-8?Q?IPFire=3A_Development-List?= Cc: Adolf Belka , Michael Tremer Message-ID: <529b26c9-7d9d-450c-ba14-2e26854f9909@Canary> In-Reply-To: <806B9D88-FFC4-4BD8-A976-49CB43249E66@ipfire.org> References: <9786EB04-D529-48D2-9BB6-AEF37B246714@ipfire.org> <99E8DC3B-30D7-43D5-AEBE-34B01E2953A0@ipfire.org> <12445407-95ac-457d-b0fe-0f74a3d2eb21@ipfire.org> <8A994F8C-FB85-487E-9799-98CED1881E1F@ipfire.org> <14f1205d-60c6-4e4a-b986-7ed6178c9033@ipfire.org> <3b3a3c0a-bdb7-4522-b949-4ca9fda8e75f@ipfire.org> <71ac9fa2-1ba1-4d4f-8e10-533c61e02831@ipfire.org> <806B9D88-FFC4-4BD8-A976-49CB43249E66@ipfire.org> Subject: Re: Feedback on issues with DNSFW in CU201 Testing X-Canary-Draft: 8 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="69e00200_7814bf75_14ee4" --69e00200_7814bf75_14ee4 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline One more new issue: If a domain is added to a custom block similar to =60*.apple.com (http://= apple.com)=60 then an additional =60*.=60 is added. So this: > *.news-events.apple.com > news-events.apple.com > > > *.zip > > becomes this in the custom.zone file: > =24ORIGIN =5Fcustom.rpz.local. > news-events.apple.com CNAME . > > > *.news-events.apple.com CNAME . > > > *.news-events.apple.com CNAME . > > > *.*.news-events.apple.com CNAME . > > > *.zip CNAME . > > > *.*.zip CNAME . > > So there should be a check for a beginning =60*.=60 and then not add an a= dditional asterisks. =E2=80=94 Jon > On =46riday, Apr 10, 2026 at 11:46 AM, Jon Murphy wrote: > The recent update allows more than one category and seems to work OK (s= till testing). > > =46ound a new issue; In the =46irewall DNS > Access Control area > Cust= om Source a CIDR notation of 192.168.74.0/24 works OK, but the subnet mas= k notation of 192.168.74.0/255.255.255.0 throws this error: > > Apr 10 11:25:45 ipfireAPU2 unbound: =5B1694:6=5D error: netblock too la= rge: 192.168.74.0/255.255.255.0 > Apr 10 11:25:45 ipfireAPU2 unbound: =5B1694:6=5D error: cannot parse ne= tblock: 192.168.74.0/255.255.255.0 > Apr 10 11:26:48 ipfireAPU2 dhcpd: execute=5Fstatement argv=5B0=5D =3D /= usr/sbin/unbound-dhcp-leases-client > > > > > On Apr 10, 2026, at 5:09=E2=80=AFAM, Adolf Belka wrote: > > Hi Michael, > > > > On 10/04/2026 11:33, Adolf Belka wrote: > > > Hi Michael, > > > On 09/04/2026 12:20, Michael Tremer wrote: > > > > Hello Adolf, > > > > > > > > Could you please let me know is this fixes the problem=3F > > > It has solved the problem when the browser is set up to use No Prox= y or System Proxy and the PC has no proxy set up. > > > I was able to select Advertising, Dating, Gambling, Pornography, Sh= opping and Streaming at the same time and trying to access URL's from the= lists of those zones caused the access to be blocked. Yaaah. Entries for= all these categories found in the unbound log. > > > Unfortunately when I changed the browser to use IP=46ire as the web= proxy (Conventional mode) by selecting Manual proxy configuration in the= browser and specifying the IP=46ire IP all accesses to the selected cate= gories listed above were allowed to be accessed except for the url for th= e shopping site. That was still blocked and in the unbound log there was = an entry for the shopping site but no entries for any of the other catego= ry url's I had just accessed and that were allowed. > > > So problem is fixed for when the IP=46ire web proxy is not used by = the browser but there is still an issue when working via the proxy. > > > I will check some more shopping site url's to see if the shopping s= ite issue is consistent for multiple url's or only that one. I thought it= might be that the url no longer exists but it is in the unbound logs get= ting blocked by the DNS=46W. So the question would be why that url gets b= locked by the DNS=46W via the web proxy when the other Category url's are= not shown in the unbound log at all. > > > > =46urther follow-up. After the test above with the web proxy being us= ed where the web sites were allowed to be accessed, I left the browser op= en with the opened tabs. > > > > Although the sites were not blocked by DNS=46W via the web proxy, exc= ept for the shopping url, DNS=46W did then stop some Mozilla telemetry ac= cesses via the ads zone. > > > > 11:22:13 unbound: =5B1741:0=5D info: rpz: applied =5Bshopping.rpz.ipf= ire.org (http://shopping.rpz.ipfire.org/)=5D 1000islandsphotoart.com (htt= p://1000islandsphotoart.com/). rpz-nxdomain 127.0.0.1=4042131 1000islands= photoart.com (http://1000islandsphotoart.com/). A IN > > 11:38:12 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.o= rg (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://teleme= try.mozilla.org/). rpz-nxdomain 192.168.200.10=4045618 incoming.telemetry= .mozilla.org (http://incoming.telemetry.mozilla.org/). A IN > > 11:40:12 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.o= rg (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://teleme= try.mozilla.org/). rpz-nxdomain 192.168.200.10=4047126 incoming.telemetry= .mozilla.org (http://incoming.telemetry.mozilla.org/). A IN > > 11:42:20 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.o= rg (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://teleme= try.mozilla.org/). rpz-nxdomain 192.168.200.10=4050709 incoming.telemetry= .mozilla.org (http://incoming.telemetry.mozilla.org/). A IN > > 11:46:20 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.o= rg (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://teleme= try.mozilla.org/). rpz-nxdomain 192.168.200.10=4046388 incoming.telemetry= .mozilla.org (http://incoming.telemetry.mozilla.org/). A IN > > 11:54:20 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.o= rg (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://teleme= try.mozilla.org/). rpz-nxdomain 192.168.200.10=4053250 incoming.telemetry= .mozilla.org (http://incoming.telemetry.mozilla.org/). A IN > > 11:55:25 unbound: =5B1741:0=5D info: rpz: applied =5Bshopping.rpz.ipf= ire.org (http://shopping.rpz.ipfire.org/)=5D 1000islandsphotoart.com (htt= p://1000islandsphotoart.com/). rpz-nxdomain 127.0.0.1=4042131 1000islands= photoart.com (http://1000islandsphotoart.com/). A IN > > 11:55:31 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.o= rg (http://ads.rpz.ipfire.org/)=5D ads.mozilla.org (http://ads.mozilla.or= g/). rpz-nxdomain 192.168.200.10=4043432 ads.mozilla.org (http://ads.mozi= lla.org/). A IN > > 11:55:31 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.o= rg (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://teleme= try.mozilla.org/). rpz-nxdomain 192.168.200.10=4048485 incoming.telemetry= .mozilla.org (http://incoming.telemetry.mozilla.org/). A IN > > > > The first line was the blocked shopping url after changing the browse= r to use the IP=46ire web proxy. > > The second shopping block was when I cam back and tried the shopping = url again to see if it was still blocked. > > All the other mozilla related blocks must be the =46irefox browser tr= ying to open some things on the web pages that had previously been opened= . > > > > Regards, > > > > Adolf. > > > > > > > Regards, > > > Adolf. > > > > > > > > https://git.ipfire.org/=3Fp=3Dipfire-2.x.git;a=3Dcommitdiff;h=3De= 3c11ae3436b578432df0058eee229f262791254 > > > > > > > > Best, > > > > -Michael > > > > > > > > > On 25 Mar 2026, at 13:43, Adolf Belka wrote: > > > > > > > > > > Hi Michael & Jon, > > > > > > > > > > On 25/03/2026 12:58, Adolf Belka wrote: > > > > > > Hi Michael and Jon, > > > > > > On 25/03/2026 10:30, Michael Tremer wrote: > > > > > > > Hello Jon, > > > > > > > > > > > > > > Why would it be necessary to manually change the configurat= ion=3F > > > > > > > > > > > > > > Can you explain to us what you are thinking=3F > > > > > > I think the argument is that the define-tag and access-contro= l-tag options should not be multiple entries but single entries with mult= iple tags space separated in the =22=22 section. > > > > > > > > > > At least the access-control-tag option has to be able to be use= d multiple times. If you have three categories defined, one with green se= lected another with blue and the last with orange then there has to be at= least three access-control-tags because each of the subnets has a differ= ent category assigned to it. > > > > > > > > > > I also found a similar situation outlined in the unbound docume= ntation where they have four access-control-tags defined. > > > > > > > > > > https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering/ta= gs-views.html=23tags > > > > > > > > > > Regards, > > > > > > > > > > Adolf. > > > > > > > > > > > > > > > > > > > > On 24 Mar 2026, at 21:03, Jon Murphy wrote: > > > > > > > > > > > > > > > > Try this in the dnsbl.conf file. > > > > > > > > > > > > > > > > server: > > > > > > > > define-tag: =22ads.rpz.ipfire.org dating.rpz.ipfire.org=22= > > > > > > > > > > > > > > > > server: > > > > > > > > access-control-tag: 192.168.74.0/24 =22ads.rpz.ipfire.org= dating.rpz.ipfire.org=22 > > > > > > Tried this but it made no difference. I suspect this might be= that unbound needs to reload the config file if it has been changed and = running unbound reload results in the dnsbl.conf file being updated with = what is on the WUI page, so it goes back to the version before it was man= ually edited. > > > > > > However this made me wonder what would happen if I only had t= he porn entry selected and not both the porn and gambling. > > > > > > The result, with the browser network option set to No Proxy w= as that all porn sites were now blocked. > > > > > > I then wondered what would happen if I chose two different ca= tegories where the working gambling one was after another category. So I = tested out Dating and Gambling. > > > > > > =46irst tested out Dating on its own. > > > > > > It blocked for academysingles.com and loopylove.com > > > > > > Then I enabled both Dating and Gambling. In this case the two= dating urls were still blocked but now all the urls that I had previousl= y used, when testing out Gambling and Porn categories together, were no l= onger blocked. > > > > > > If I disabled the Dating category then the Gambling sites wer= e blocked again. > > > > > > This was also found in the DNS: Unbound logs. > > > > > > So it looks like if there are multiple categories selected th= en only the urls from the first category get blocked. > > > > > > Regards, > > > > > > Adolf. > > > > > > > > > > > > > > > > > > > > > > > > Separate =22access-control-tag=22 don=E2=80=99t seem to w= ork. > > > > > > > > > > > > > > What is this supposed to mean=3F > > > > > > > > > > > > > > -Michael > > > > > > > > > > > > > > > > > > > > > > > The above changes allows RPZ to work as expected. > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > ------ Original Message ------ > > > > > > > > =46rom =22Michael Tremer=22 = > > > > > > > > To =22Adolf Belka=22 > > > > > > > > Cc development=40lists.ipfire.org; dbl=40lists.ipfire.org= > > > > > > > > Date 3/23/2026 9:41:07=E2=80=AFAM > > > > > > > > Subject Re: =46eedback on issues with DNS=46W in CU201 Te= sting > > > > > > > > > > > > > > > > > Hello, > > > > > > > > > > > > > > > > > > So this looks good. The list has been properly loaded i= nto Unbound. > > > > > > > > > > > > > > > > > > I don=E2=80=99t quite know what could be going wrong no= w. > > > > > > > > > > > > > > > > > > -Michael > > > > > > > > > > > > > > > > > > > On 23 Mar 2026, at 12:22, Adolf Belka wrote: > > > > > > > > > > > > > > > > > > > > Hi Michael, > > > > > > > > > > > > > > > > > > > > On 23/03/2026 12:10, Michael Tremer wrote: > > > > > > > > > > > Hello Adolf, > > > > > > > > > > > What is the output of unbound-control list=5Fauth=5F= zones=3F > > > > > > > > > > > > > > > > > > > > porn.rpz.ipfire.org. serial 1773964805 since 17742674= 87 2026-03-23T13:04:47 > > > > > > > > > > gambling.rpz.ipfire.org serial 1773997205 since 17742= 67487 2026-03-23T13:04:47 > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > > > > > > > > > Adolf. > > > > > > > > > > > > > > > > > > > > > -Michael > > > > > > > > > > > > On 20 Mar 2026, at 16:59, Adolf Belka wrote: > > > > > > > > > > > > > > > > > > > > > > > > Hi Michael, > > > > > > > > > > > > > > > > > > > > > > > > On 20/03/2026 16:56, Michael Tremer wrote: > > > > > > > > > > > > > Hello Adolf, > > > > > > > > > > > > > I am copying the DBL list, too. > > > > > > > > > > > > > > > > > > > > > > > > Good idea. I was just thinking of it being relate= d to Testing issue. > > > > > > > > > > > > > So this is obviously not normal, but we can deb= ug this step by step: > > > > > > > > > > > > > =46irst of all, we should check if Unbound was = able to successfully fetch the DNS zones. Gambling has clearly been downl= oaded, but it seems that the Porn list might not. You can check in /var/c= ache/unbound if there is the zone file. If yes, then you can try to resol= ve a couple of things on the console and check if they are being blocked:= > > > > > > > > > > > > > > > > > > > > > > > > I should have already mentioned this but forgot. = It was one of the first things I checked and I have just re-confirmed now= . The porn zone file is present. It was updated at 11:40 CET and the Gamb= ling zone was updated at 12:53 CET. > > > > > > > > > > > > > > > > > > > > > > > > I also checked that the zone file contained the u= rl's being used and it did and does. > > > > > > > > > > > > > > > > > > > > > > > > > =23 dig =40localhost some.porn.website.com > > > > > > > > > > > > > You should see NXDOMAIN if the domain exists an= d has been blocked and you should see the log entries just like gambling.= > > > > > > > > > > > > > > > > > > > > > > > > Got > > > > > > > > > > > > > > > > > > > > > > > > ;; Got answer: > > > > > > > > > > > > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, = id: 54293 > > > > > > > > > > > > ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHO= RITY: 1, ADDITIONAL: 1 > > > > > > > > > > > > > > > > > > > > > > > > So NXDOMAIN is in the answer but there was nothin= g additional in the unbound log. The last entry in it was from 12:58:50 w= hen I did the tests with the gambling sites and if there was an entry it = should have a timestamp for around 17:45 > > > > > > > > > > > > > > > > > > > > > > > > > This rules out anything that is going wrong bet= ween the browser and Unbound. > > > > > > > > > > > > > In case of the URL filter, it simply seems that= squidguard is not seeing the requests. You might as well try something l= ike: > > > > > > > > > > > > > > > > > > > > > > > > With the URL =46ilter enabled and DNS=46W disable= d then the URL =46ilter blocks and logs both the Gambling and Porn site a= ccesses. Sorry if that came across as differently in my mail. The URL =46= ilter works fine for me with both CU200 and CU201 Testing. > > > > > > > > > > > > > > > > > > > > > > > > > =23 http=5Fproxy=3Dhttp://1.2.3.4:800 https=5Fproxy=3Dhttp://1.2.3.4:800 wge= t -d http://some.porn.website.com > > > > > > > > > > > > > The squidguard.log should also contain some int= eresting information if something didn=E2=80=99t go as planned. > > > > > > > > > > > > > -Michael > > > > > > > > > > > > > > On 20 Mar 2026, at 12:30, Adolf Belka wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > > > Hi All, > > > > > > > > > > > > > > > > > > > > > > > > > > > > I am having issues with getting DNS=46W to wo= rk properly, it fails in many conditions to block things from the list. > > > > > > > > > > > > > > > > > > > > > > > > > > > > The dbl list works fine for me in the URL =46= ilter for both CU200 and CU201 Testing. > > > > > > > > > > > > > > > > > > > > > > > > > > > > =46or my testing I created a new install of C= U201 Testing and just went straight to DNS=46W and enabled the Gambling a= nd Pornography categories and Saved. > > > > > > > > > > > > > > > > > > > > > > > > > > > > Then selected the Green network for both cate= gories using the pencil edit option. > > > > > > > > > > > > > > > > > > > > > > > > > > > > In this setup I had no Web Proxy enabled. > > > > > > > > > > > > > > > > > > > > > > > > > > > > I then cleared the browser cache and set the = Browser to No Proxy. > > > > > > > > > > > > > > > > > > > > > > > > > > > > I then tested out nl.onecasino.com and www.xn= xx.com in =46irefox and in Netsurf > > > > > > > > > > > > > > > > > > > > > > > > > > > > The gambling site was blocked and gave the me= ssage > > > > > > > > > > > > > > > > > > > > > > > > > > > > Unable to connect > > > > > > > > > > > > > > =46irefox can=E2=80=99t establish a connectio= n to the server at nl.onecasino.com. > > > > > > > > > > > > > > > > > > > > > > > > > > > > =46or the porn site it was not blocked but op= ened up. > > > > > > > > > > > > > > I tried with two other gambling and porn site= s. All three gambling sites were blocked. All three porn sites were allow= ed through. > > > > > > > > > > > > > > > > > > > > > > > > > > > > In the DND: Unbound System Logs I found > > > > > > > > > > > > > > > > > > > > > > > > > > > > 12:52:26 unbound: =5B1820:0=5D info: rpz: app= lied =5Bgambling.rpz.ipfire.org=5D *.postcodeloterij.nl. rpz-nxdomain 192= .168.200.11=4044247 www.postcodeloterij.nl. A IN > > > > > > > > > > > > > > 12:52:26 unbound: =5B1820:0=5D info: rpz: app= lied =5Bgambling.rpz.ipfire.org=5D *.postcodeloterij.nl. rpz-nxdomain 192= .168.200.11=4044356 www.postcodeloterij.nl. HTTPS IN > > > > > > > > > > > > > > 12:51:32 unbound: =5B1820:0=5D info: rpz: app= lied =5Bgambling.rpz.ipfire.org=5D *.onecasino.com. rpz-nxdomain 192.168.= 200.11=4055955 nl.onecasino.com. A IN > > > > > > > > > > > > > > 12:51:32 unbound: =5B1820:0=5D info: rpz: app= lied =5Bgambling.rpz.ipfire.org=5D *.onecasino.com. rpz-nxdomain 192.168.= 200.11=4049136 nl.onecasino.com. HTTPS IN > > > > > > > > > > > > > > 12:50:41 unbound: =5B1820:0=5D info: rpz: app= lied =5Bgambling.rpz.ipfire.org=5D *.hollandcasino.nl. rpz-nxdomain 192.1= 68.200.11=4047229 welkom.hollandcasino.nl. A IN > > > > > > > > > > > > > > 12:50:41 unbound: =5B1820:0=5D info: rpz: app= lied =5Bgambling.rpz.ipfire.org=5D *.hollandcasino.nl. rpz-nxdomain 192.1= 68.200.11=4043346 welkom.hollandcasino.nl. HTTPS IN > > > > > > > > > > > > > > > > > > > > > > > > > > > > So the blocked gambling sites were in the log= s but not any of the pornography sites had tested. > > > > > > > > > > > > > > > > > > > > > > > > > > > > Then tried the browser with the Network Setti= ngs set to Use system proxy settings and the same result occurred. > > > > > > > > > > > > > > > > > > > > > > > > > > > > I then turned on the Web Proxy with conventio= nal connection on port 800. Saved and restarted and then Cleared the web = proxy cache. > > > > > > > > > > > > > > Then I cleared the browser cache and set the = Network Settings to Manual proxy configuration with the IP of my IP=46ire= system being tested. > > > > > > > > > > > > > > > > > > > > > > > > > > > > I then tested the same three gambling URL's a= nd Porn URL's. > > > > > > > > > > > > > > All of the sites were opened up. > > > > > > > > > > > > > > In the DNS: Unbound system log there were no = new entries. > > > > > > > > > > > > > > In the Proxy Logs there were entries for the = gambling and porn sites. > > > > > > > > > > > > > > > > > > > > > > > > > > > > I have also tested the browser out using the = web proxy with the Automatic proxy configuration URL accessing the wpad f= ile via dhcp and that also had the same results as using the Manual proxy= configuration option. > > > > > > > > > > > > > > > > > > > > > > > > > > > > I have repeated a lot of my tests multiple ti= mes, also with repeated new installs and for me, as long as I ensured I h= ad cleared the web proxy and browser caches, always came up with the same= results as I have described above. > > > > > > > > > > > > > > > > > > > > > > > > > > > > It would be good to know if any of you also e= xperience the same effect or if it works without problems for yourselves.= > > > > > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > > > > > > > > > > > > > > > > > Adolf. > Jon > > > -- > Jon Murphy > murphy.jon=40me.com > 847-774-3550 (cell) > -- > > > > > --69e00200_7814bf75_14ee4 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline <= meta name=3D=22viewport=22 content=3D=22width=3Ddevice-width, initial-sca= le=3D1.0, user-scalable=3Dno=22> 3D=22=22
One more new issue:

If a domai= n is added to a custom block similar to =60*.apple.com=60 then an additional =60*.=60 is added. =C2=A0So this= :

*.news-events.apple.com
news-events.apple.com
*.zip

becomes this in the custom.zone file:

=24ORIGI= N =5Fcustom.rpz.local.
n= ews-events.apple.com CNAME .
=
*.news-events.apple.com CNAME .
*.news-events.apple.com CNAME .
*.*.news-events.apple.com CNAME .
*.zip CNAME .
*.*.zip CNAME .

So there should be a check for a be= ginning =60*.=60 and then not add an additional=C2=A0asterisks.


=E2=80=94
Jon

<= div>
On =46riday, Apr 10, 2026 a= t 11:46 AM, Jon Murphy <jon.murphy=40ipfire.org> wrote:
3D=22=22
The recent update=C2=A0allows more than one category and seems to work OK (still test= ing).

=46ound a new= issue; =C2=A0In the =46irewall DNS > Access Control area > = Custom Source a CIDR notation of 192.168.74.0/24 works OK, but the= =C2=A0subnet mask notation of 192.168.74.0/255.255.255.0 throws this erro= r:

Apr 10 11:25:45 ipfireAPU2 unbound: =5B1694:6=5D e= rror: netblock too large: 192.168.74.0/255.255.255.0
<= div>Apr 10 11:25:45 ipfireAPU2 unbound: =5B1694:6=5D error: cannot = parse netblock: 192.168.74.0/255.255.255.0
= Apr 10 11:26:48 ipfireAPU2 dhcpd: execute=5Fstatement argv=5B0=5D =3D /us= r/sbin/unbound-dhcp-leases-client



On Apr 10, 2026, at 5:09=E2=80=AFAM, Adol= f Belka <adolf.belka=40ipfire.org> wrote:

Hi Michael,

On 10/04/2026 11:33, Adol= f Belka wrote:
Hi Micha= el,
On 09/04/2026 12:20, Michael Tremer wrote:
Hello Adolf,

Could you please let me know is this fixes th= e problem=3F
It has solved the problem when the browser i= s set up to use No Proxy or System Proxy and the PC has no proxy set up.<= br>I was able to select Advertising, Dating, Gambling, Pornography, Shopp= ing and Streaming at the same time and trying to access URL's from the li= sts of those zones caused the access to be blocked. Yaaah. Entries for al= l these categories found in the unbound log.
Unfortunately when I chan= ged the browser to use IP=46ire as the web proxy (Conventional mode) by s= electing Manual proxy configuration in the browser and specifying the IP=46= ire IP all accesses to the selected categories listed above were allowed = to be accessed except for the url for the shopping site. That was still b= locked and in the unbound log there was an entry for the shopping site bu= t no entries for any of the other category url's I had just accessed and = that were allowed.
So problem is fixed for when the IP=46ire web proxy= is not used by the browser but there is still an issue when working via = the proxy.
I will check some more shopping site url's to see if the sh= opping site issue is consistent for multiple url's or only that one. I th= ought it might be that the url no longer exists but it is in the unbound = logs getting blocked by the DNS=46W. So the question would be why that ur= l gets blocked by the DNS=46W via the web proxy when the other Category u= rl's are not shown in the unbound log at all.

=46urther follow-up. After the test above with the web proxy be= ing used where the web sites were allowed to be accessed, I left the brow= ser open with the opened tabs.

Although the sites were not = blocked by DNS=46W via the web proxy, except for the shopping url, DNS=46= W did then stop some Mozilla telemetry accesses via the ads zone.<= br style=3D=22caret-color: rgb(0, 0, 0); font-family: Menlo-Regular; font= -size: 13px; font-style: normal; font-variant-caps: normal; font-weight: = 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: = 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: = 0px; -webkit-text-stroke-width: 0px; text-decoration-line: none; text-dec= oration-thickness: auto; text-decoration-style: solid;=22>
11:22:13 unbound: =5B1741:0=5D =C2=A0info: rpz: applied =5B= shopping.rpz.ip= fire.org=5D=C2=A01000islandsphotoart.com. rpz-nxdomain 127.0.0.1=4042131=C2=A01000islandsphotoart.com. A IN
11:38:12 unbound: =5B1741:0=5D= =C2=A0info: rpz: applied =5Bads.rpz.ipfire.org=5D *.tel= emetry.mozilla.org. rpz-nxdomain = 192.168.200.10=4045618=C2=A0incoming.telemetry.mozilla.org. = A IN
11:40:12 unbound: =5B1741:0=5D =C2=A0inf= o: rpz: applied =5Bads.rpz.ipfire.org=5D *.telemetry.moz= illa.org. rpz-nxdomain 192.168.20= 0.10=4047126=C2=A0incomin= g.telemetry.mozilla.org. A IN
11:42:20 unbound: =5B1741:0=5D =C2=A0info: rpz: = applied =5Bad= s.rpz.ipfire.org=5D *.telemetry.mozilla.org= . rpz-nxdomain 192.168.200.10=405= 0709=C2=A0incoming.teleme= try.mozilla.org. A IN
11:46:20 unbound: =5B1741:0=5D =C2=A0info: rpz: applied = =5Bads.rpz.ip= fire.org=5D *.telemetry.mozilla.org. rpz-nxdomain 192.168.200.10=4046388=C2=A0incoming.telemetry.mozil= la.org. A IN
11:54:20 unbound: =5B1741:0=5D =C2=A0info: rpz: applied =5B= ads.rpz.ipfire.org=5D *.telemetry.mozilla.org. rpz-nxdomain 192.168.200.10=4053250=C2=A0incoming.telemetry.mozilla.org. A IN
1= 1:55:25 unbound: =5B1741:0=5D =C2=A0info: rpz: applied =5Bshopping.rpz.ipfire.org=5D=C2=A01000islandsphotoart.com. rpz-nxdomain 127.0.0.1=4042131=C2=A01000islandsphotoart.com. A IN
= 11:55:31 unbound: =5B1741:0=5D =C2=A0= info: rpz: applied =5Bads.rpz.ipfire.org=5D=C2=A0ads.mozilla.org. rpz-nxdomain 192.168.200.10=4043432=C2=A0ads.mozilla.org. A IN
= 11:55:31 unbound: =5B1741:0=5D =C2=A0= info: rpz: applied =5Bads.rpz.ipfire.org=5D *.= telemetry.= mozilla.org. rpz-nxdomain 192.168= .200.10=4048485=C2=A0inco= ming.telemetry.mozilla.org. A IN<= /span>

The first line was the blocked shopping url after changing = the browser to use the IP=46ire web proxy.
Th= e second shopping block was when I cam back and tried the shopping url ag= ain to see if it was still blocked.
All the o= ther mozilla related blocks must be the =46irefox browser trying to open = some things on the web pages that had previously been opened.

Regards,

Adolf.


Regards,
Adolf.
=

=C2=A0=C2=A0=C2=A0https://git.ipfire.org/=3Fp=3Dipfire-2.x.git;= a=3Dcommitdiff;h=3De3c11ae3436b578432df0058eee229f262791254

Best,<= br>-Michael

On 25 Mar 2026, at 13:43= , Adolf Belka <adolf.belka=40ipfire.org> wrote:

Hi Michael &= amp; Jon,

On 25/03/2026 12:58, Adolf Belka wrote:
Hi Michael and Jon,
On 25/03/2026 10:30, Michael Trem= er wrote:
Hello Jon,

Why would it= be necessary to manually change the configuration=3F

Can you expl= ain to us what you are thinking=3F
I think the argument i= s that the define-tag and access-control-tag options should not be multip= le entries but single entries with multiple tags space separated in the =22= =22 section.

At least the access-control-tag option h= as to be able to be used multiple times. If you have three categories def= ined, one with green selected another with blue and the last with orange = then there has to be at least three access-control-tags because each of t= he subnets has a different category assigned to it.

I also found a= similar situation outlined in the unbound documentation where they have = four access-control-tags defined.

https://unbound.docs.nlnetlabs.n= l/en/latest/topics/filtering/tags-views.html=23tags

Regards,
Adolf.


On 24 Mar 2026, at 21:03, Jon Murphy &= lt;jon.murphy=40ipfire.org> wrote:

Try this in the dnsbl.conf f= ile.

server:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0define-tag: =22ads.rpz.ipfire.org dating.rpz= .ipfire.org=22

server:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0access-control-tag: 192.168.74.0/24= =22ads.rpz.ipfire.org dating.rpz.ipfire.org=22
Tried this but it made no difference. I suspect this might be that un= bound needs to reload the config file if it has been changed and running = unbound reload results in the dnsbl.conf file being updated with what is = on the WUI page, so it goes back to the version before it was manually ed= ited.
However this made me wonder what would happen if I only had the = porn entry selected and not both the porn and gambling.
The result, wi= th the browser network option set to No Proxy was that all porn sites wer= e now blocked.
I then wondered what would happen if I chose two differ= ent categories where the working gambling one was after another category.= So I tested out Dating and Gambling.
=46irst tested out Dating on its= own.
It blocked for academysingles.com and loopylove.com
Then I en= abled both Dating and Gambling. In this case the two dating urls were sti= ll blocked but now all the urls that I had previously used, when testing = out Gambling and Porn categories together, were no longer blocked.
If = I disabled the Dating category then the Gambling sites were blocked again= .
This was also found in the DNS: Unbound logs.
So it looks like if= there are multiple categories selected then only the urls from the first= category get blocked.
Regards,
Adolf.


Separate =22access-control-tag= =22 don=E2=80=99t seem to work.

What is this supposed= to mean=3F

-Michael


The = above changes allows RPZ to work as expected.



------ Origi= nal Message ------
=C2=A0=C2= =A0=46rom =22Michael Tremer=22 <michael.tremer=40ipfire.org>=
To =22Adolf Belka=22 <adolf.belka=40ipfire.org>
Cc developme= nt=40lists.ipfire.org; dbl=40lists.ipfire.org
Date 3/23/2026 9:41:07=E2= =80=AFAM
Subject Re: =46eedback on issues with DNS=46W in CU201 Testin= g

Hello,

So this looks good. = The list has been properly loaded into Unbound.

I don=E2=80=99t qu= ite know what could be going wrong now.

-Michael

On 23 Mar 2026, at 12:22, Adolf Belka <adolf.belka= =40ipfire.org> wrote:

Hi Michael,

On 23/03/2026 12:10, M= ichael Tremer wrote:
Hello Adolf,
Wha= t is the output of unbound-control list=5Fauth=5Fzones=3F

porn.rpz.ipfire.org.=C2=A0=C2=A0=C2=A0 serial 1773964805=C2=A0=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 since 1774267487 2026-03-23T13:04:47
ga= mbling.rpz.ipfire.org=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 serial 17739972= 05=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 since 1774267487 2026-03-23T= 13:04:47

Regards,

Adolf.

-Michael
On 20 Mar 2026, at 16:59, Adol= f Belka <adolf.belka=40ipfire.org> wrote:

Hi Michael,
On 20/03/2026 16:56, Michael Tremer wrote:
Hello Adolf,
I am copying the DBL list, too.

G= ood idea. I was just thinking of it being related to Testing issue.
So this is obviously not normal, but we can d= ebug this step by step:
=46irst of all, we should check if Unbound was= able to successfully fetch the DNS zones. Gambling has clearly been down= loaded, but it seems that the Porn list might not. You can check in /var/= cache/unbound if there is the zone file. If yes, then you can try to reso= lve a couple of things on the console and check if they are being blocked= :

I should have already mentioned this but forgot. It= was one of the first things I checked and I have just re-confirmed now. = The porn zone file is present. It was updated at 11:40 CET and the Gambli= ng zone was updated at 12:53 CET.

I also checked that the zone fil= e contained the url's being used and it did and does.

=23 dig =40localhost some.porn.website.com <http://s= ome.porn.website.com/>
You should see NXDOMAIN if the domain exists= and has been blocked and you should see the log entries just like gambli= ng.

Got

;; Got answer:
;; ->>HEADER&l= t;<- opcode: QUERY, status: NXDOMAIN, id: 54293
;; flags: qr rd ra = ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

So NXDOMAIN i= s in the answer but there was nothing additional in the unbound log. The = last entry in it was from 12:58:50 when I did the tests with the gambling= sites and if there was an entry it should have a timestamp for around 17= :45

This rules out anything that is = going wrong between the browser and Unbound.
In case of the URL filter= , it simply seems that squidguard is not seeing the requests. You might a= s well try something like:

With the URL =46ilter enab= led and DNS=46W disabled then the URL =46ilter blocks and logs both the G= ambling and Porn site accesses. Sorry if that came across as differently = in my mail. The URL =46ilter works fine for me with both CU200 and CU201 = Testing.

=23 http=5Fproxy=3Dhttp://1= .2.3.4:800 <http://1.2.3.4:800/> https=5Fproxy=3Dhttp://1.2.3.4:800= <http://1.2.3.4:800/> wget -d http://some.porn.website.com <htt= p://some.porn.website.com/>
The squidguard.log should also contain = some interesting information if something didn=E2=80=99t go as planned.-Michael
On 20 Mar 2026, at 12:30, Ado= lf Belka <adolf.belka=40ipfire.org> wrote:

Hi All,

I = am having issues with getting DNS=46W to work properly, it fails in many = conditions to block things from the list.

The dbl list works fine = for me in the URL =46ilter for both CU200 and CU201 Testing.

=46or= my testing I created a new install of CU201 Testing and just went straig= ht to DNS=46W and enabled the Gambling and Pornography categories and Sav= ed.

Then selected the Green network for both categories using the = pencil edit option.

In this setup I had no Web Proxy enabled.
<= br>I then cleared the browser cache and set the Browser to No Proxy.
<= br>I then tested out nl.onecasino.com and www.xnxx.com in =46irefox and i= n Netsurf

The gambling site was blocked and gave the message
Unable to connect
=46irefox can=E2=80=99t establish a connection to = the server at nl.onecasino.com.

=46or the porn site it was not blo= cked but opened up.
I tried with two other gambling and porn sites. Al= l three gambling sites were blocked. All three porn sites were allowed th= rough.

In the DND: Unbound System Logs I found

12:52:26 unb= ound: =5B1820:0=5D=C2=A0 info: rpz: applied =5Bgambling.rpz.ipfire.org=5D= *.postcodeloterij.nl. rpz-nxdomain 192.168.200.11=4044247 www.postcodelo= terij.nl. A IN
12:52:26 unbound: =5B1820:0=5D=C2=A0 info: rpz: applied= =5Bgambling.rpz.ipfire.org=5D *.postcodeloterij.nl. rpz-nxdomain 192.168= .200.11=4044356 www.postcodeloterij.nl. HTTPS IN
12:51:32 unbound: =5B= 1820:0=5D=C2=A0 info: rpz: applied =5Bgambling.rpz.ipfire.org=5D *.onecas= ino.com. rpz-nxdomain 192.168.200.11=4055955 nl.onecasino.com. A IN
12= :51:32 unbound: =5B1820:0=5D=C2=A0 info: rpz: applied =5Bgambling.rpz.ipf= ire.org=5D *.onecasino.com. rpz-nxdomain 192.168.200.11=4049136 nl.onecas= ino.com. HTTPS IN
12:50:41 unbound: =5B1820:0=5D=C2=A0 info: rpz: appl= ied =5Bgambling.rpz.ipfire.org=5D *.hollandcasino.nl. rpz-nxdomain 192.16= 8.200.11=4047229 welkom.hollandcasino.nl. A IN
12:50:41 unbound: =5B18= 20:0=5D=C2=A0 info: rpz: applied =5Bgambling.rpz.ipfire.org=5D *.hollandc= asino.nl. rpz-nxdomain 192.168.200.11=4043346 welkom.hollandcasino.nl. HT= TPS IN

So the blocked gambling sites were in the logs but not any = of the pornography sites=C2=A0 had tested.

Then tried the browser = with the Network Settings set to Use system proxy settings and the same r= esult occurred.

I then turned on the Web Proxy with conventional c= onnection on port 800. Saved and restarted and then Cleared the web proxy= cache.
Then I cleared the browser cache and set the Network Settings = to Manual proxy configuration with the IP of my IP=46ire system being tes= ted.

I then tested the same three gambling URL's and Porn URL's.All of the sites were opened up.
In the DNS: Unbound system log ther= e were no new entries.
In the Proxy Logs there were entries for the ga= mbling and porn sites.

I have also tested the browser out using th= e web proxy with the Automatic proxy configuration URL accessing the wpad= file via dhcp and that also had the same results as using the Manual pro= xy configuration option.

I have repeated a lot of my tests multipl= e times, also with repeated new installs and for me, as long as I ensured= I had cleared the web proxy and browser caches, always came up with the = same results as I have described above.

It would be good to know i= f any of you also experience the same effect or if it works without probl= ems for yourselves.

Regards,

Adolf.

Jon


--=C2=A0
Jon Murphy
murphy.jon=40me.com
84= 7-774-3550 (cell)
--=C2=A0





= --69e00200_7814bf75_14ee4--