From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fsjQ66NQ0z32SW for ; Fri, 10 Apr 2026 16:47:10 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fsjPz4XsRz2y97 for ; Fri, 10 Apr 2026 16:47:03 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4fsjPx4MBPz41G; Fri, 10 Apr 2026 16:47:01 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1775839622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IxpDv1qsbhBruNzdS9Y08CaiEpS1Y6U6gsTVr2eNx10=; b=mucClVRw1NUz3SwAsn/IGagL6RON5ip/Xjc+UBnoNKKTwzzFgGBt5veMiV2glhQ4tdUeRs HWU8Hx6+1tsl5aCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1775839622; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=IxpDv1qsbhBruNzdS9Y08CaiEpS1Y6U6gsTVr2eNx10=; b=szZbJ50o6cJ0BR4U5lcGESTozPD2iBpEUqmW7kOeZsBaIgQ23WQRSsOa9XdS7G4fXBmZEz uUW3rp5mlKkJ1QYSN4StiLA2Rulc1x3ttFWewOFRRQGYl6boUp0TRkaS+6miEZ9jk4qQjO 0T1vHUiuRiMufjzzhv7cN/W6k0Rm04A7/7LSUYcg7MWhYaTXxcHNnUgcIfnYPQqDW812EZ pCnajwokmEMXozaAkschu0XzzGQ2fVyhjTVClwpV1IAu7ohvy4EgPccT/eowqKtWCTn8To GhQriOKh7+45viQmAU1jNKxi/dAm+ZjgKGBnqyMId+zd7Equ6bDBd6UL1Dv97g== Date: Fri, 10 Apr 2026 11:46:54 -0500 From: Jon Murphy To: =?utf-8?Q?IPFire=3A_Development-List?= Cc: Michael Tremer , Adolf Belka Message-ID: <806B9D88-FFC4-4BD8-A976-49CB43249E66@ipfire.org> In-Reply-To: References: <9786EB04-D529-48D2-9BB6-AEF37B246714@ipfire.org> <99E8DC3B-30D7-43D5-AEBE-34B01E2953A0@ipfire.org> <12445407-95ac-457d-b0fe-0f74a3d2eb21@ipfire.org> <8A994F8C-FB85-487E-9799-98CED1881E1F@ipfire.org> <14f1205d-60c6-4e4a-b986-7ed6178c9033@ipfire.org> <3b3a3c0a-bdb7-4522-b949-4ca9fda8e75f@ipfire.org> <71ac9fa2-1ba1-4d4f-8e10-533c61e02831@ipfire.org> Subject: Feedback on issues with DNSFW in CU201 Testing X-Canary-Draft: 4 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="69d9297e_1a32234b_18253" --69d9297e_1a32234b_18253 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline The recent update allows more than one category and seems to work OK (sti= ll testing). =46ound a new issue; In the =46irewall DNS > Access Control area > Custom= Source a CIDR notation of 192.168.74.0/24 works OK, but the subnet mask = notation of 192.168.74.0/255.255.255.0 throws this error: Apr 10 11:25:45 ipfireAPU2 unbound: =5B1694:6=5D error: netblock too larg= e: 192.168.74.0/255.255.255.0 Apr 10 11:25:45 ipfireAPU2 unbound: =5B1694:6=5D error: cannot parse netb= lock: 192.168.74.0/255.255.255.0 Apr 10 11:26:48 ipfireAPU2 dhcpd: execute=5Fstatement argv=5B0=5D =3D /us= r/sbin/unbound-dhcp-leases-client > On Apr 10, 2026, at 5:09=E2=80=AFAM, Adolf Belka wrote: > Hi Michael, > > On 10/04/2026 11:33, Adolf Belka wrote: > > Hi Michael, > > On 09/04/2026 12:20, Michael Tremer wrote: > > > Hello Adolf, > > > > > > Could you please let me know is this fixes the problem=3F > > It has solved the problem when the browser is set up to use No Proxy = or System Proxy and the PC has no proxy set up. > > I was able to select Advertising, Dating, Gambling, Pornography, Shop= ping and Streaming at the same time and trying to access URL's from the l= ists of those zones caused the access to be blocked. Yaaah. Entries for a= ll these categories found in the unbound log. > > Unfortunately when I changed the browser to use IP=46ire as the web p= roxy (Conventional mode) by selecting Manual proxy configuration in the b= rowser and specifying the IP=46ire IP all accesses to the selected catego= ries listed above were allowed to be accessed except for the url for the = shopping site. That was still blocked and in the unbound log there was an= entry for the shopping site but no entries for any of the other category= url's I had just accessed and that were allowed. > > So problem is fixed for when the IP=46ire web proxy is not used by th= e browser but there is still an issue when working via the proxy. > > I will check some more shopping site url's to see if the shopping sit= e issue is consistent for multiple url's or only that one. I thought it m= ight be that the url no longer exists but it is in the unbound logs getti= ng blocked by the DNS=46W. So the question would be why that url gets blo= cked by the DNS=46W via the web proxy when the other Category url's are n= ot shown in the unbound log at all. > > =46urther follow-up. After the test above with the web proxy being used= where the web sites were allowed to be accessed, I left the browser open= with the opened tabs. > > Although the sites were not blocked by DNS=46W via the web proxy, excep= t for the shopping url, DNS=46W did then stop some Mozilla telemetry acce= sses via the ads zone. > > 11:22:13 unbound: =5B1741:0=5D info: rpz: applied =5Bshopping.rpz.ipfir= e.org (http://shopping.rpz.ipfire.org/)=5D 1000islandsphotoart.com (http:= //1000islandsphotoart.com/). rpz-nxdomain 127.0.0.1=4042131 1000islandsph= otoart.com (http://1000islandsphotoart.com/). A IN > 11:38:12 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.org= (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://telemetr= y.mozilla.org/). rpz-nxdomain 192.168.200.10=4045618 incoming.telemetry.m= ozilla.org (http://incoming.telemetry.mozilla.org/). A IN > 11:40:12 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.org= (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://telemetr= y.mozilla.org/). rpz-nxdomain 192.168.200.10=4047126 incoming.telemetry.m= ozilla.org (http://incoming.telemetry.mozilla.org/). A IN > 11:42:20 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.org= (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://telemetr= y.mozilla.org/). rpz-nxdomain 192.168.200.10=4050709 incoming.telemetry.m= ozilla.org (http://incoming.telemetry.mozilla.org/). A IN > 11:46:20 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.org= (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://telemetr= y.mozilla.org/). rpz-nxdomain 192.168.200.10=4046388 incoming.telemetry.m= ozilla.org (http://incoming.telemetry.mozilla.org/). A IN > 11:54:20 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.org= (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://telemetr= y.mozilla.org/). rpz-nxdomain 192.168.200.10=4053250 incoming.telemetry.m= ozilla.org (http://incoming.telemetry.mozilla.org/). A IN > 11:55:25 unbound: =5B1741:0=5D info: rpz: applied =5Bshopping.rpz.ipfir= e.org (http://shopping.rpz.ipfire.org/)=5D 1000islandsphotoart.com (http:= //1000islandsphotoart.com/). rpz-nxdomain 127.0.0.1=4042131 1000islandsph= otoart.com (http://1000islandsphotoart.com/). A IN > 11:55:31 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.org= (http://ads.rpz.ipfire.org/)=5D ads.mozilla.org (http://ads.mozilla.org/= ). rpz-nxdomain 192.168.200.10=4043432 ads.mozilla.org (http://ads.mozill= a.org/). A IN > 11:55:31 unbound: =5B1741:0=5D info: rpz: applied =5Bads.rpz.ipfire.org= (http://ads.rpz.ipfire.org/)=5D *.telemetry.mozilla.org (http://telemetr= y.mozilla.org/). rpz-nxdomain 192.168.200.10=4048485 incoming.telemetry.m= ozilla.org (http://incoming.telemetry.mozilla.org/). A IN > > The first line was the blocked shopping url after changing the browser = to use the IP=46ire web proxy. > The second shopping block was when I cam back and tried the shopping ur= l again to see if it was still blocked. > All the other mozilla related blocks must be the =46irefox browser tryi= ng to open some things on the web pages that had previously been opened. > > Regards, > > Adolf. > > > > Regards, > > Adolf. > > > > > > https://git.ipfire.org/=3Fp=3Dipfire-2.x.git;a=3Dcommitdiff;h=3De3c= 11ae3436b578432df0058eee229f262791254 > > > > > > Best, > > > -Michael > > > > > > > On 25 Mar 2026, at 13:43, Adolf Belka = wrote: > > > > > > > > Hi Michael & Jon, > > > > > > > > On 25/03/2026 12:58, Adolf Belka wrote: > > > > > Hi Michael and Jon, > > > > > On 25/03/2026 10:30, Michael Tremer wrote: > > > > > > Hello Jon, > > > > > > > > > > > > Why would it be necessary to manually change the configuratio= n=3F > > > > > > > > > > > > Can you explain to us what you are thinking=3F > > > > > I think the argument is that the define-tag and access-control-= tag options should not be multiple entries but single entries with multip= le tags space separated in the =22=22 section. > > > > > > > > At least the access-control-tag option has to be able to be used = multiple times. If you have three categories defined, one with green sele= cted another with blue and the last with orange then there has to be at l= east three access-control-tags because each of the subnets has a differen= t category assigned to it. > > > > > > > > I also found a similar situation outlined in the unbound document= ation where they have four access-control-tags defined. > > > > > > > > https://unbound.docs.nlnetlabs.nl/en/latest/topics/filtering/tags= -views.html=23tags > > > > > > > > Regards, > > > > > > > > Adolf. > > > > > > > > > > > > > > > > > On 24 Mar 2026, at 21:03, Jon Murphy wrote: > > > > > > > > > > > > > > Try this in the dnsbl.conf file. > > > > > > > > > > > > > > server: > > > > > > > define-tag: =22ads.rpz.ipfire.org dating.rpz.ipfire.org=22 > > > > > > > > > > > > > > server: > > > > > > > access-control-tag: 192.168.74.0/24 =22ads.rpz.ipfire.org d= ating.rpz.ipfire.org=22 > > > > > Tried this but it made no difference. I suspect this might be t= hat unbound needs to reload the config file if it has been changed and ru= nning unbound reload results in the dnsbl.conf file being updated with wh= at is on the WUI page, so it goes back to the version before it was manua= lly edited. > > > > > However this made me wonder what would happen if I only had the= porn entry selected and not both the porn and gambling. > > > > > The result, with the browser network option set to No Proxy was= that all porn sites were now blocked. > > > > > I then wondered what would happen if I chose two different cate= gories where the working gambling one was after another category. So I te= sted out Dating and Gambling. > > > > > =46irst tested out Dating on its own. > > > > > It blocked for academysingles.com and loopylove.com > > > > > Then I enabled both Dating and Gambling. In this case the two d= ating urls were still blocked but now all the urls that I had previously = used, when testing out Gambling and Porn categories together, were no lon= ger blocked. > > > > > If I disabled the Dating category then the Gambling sites were = blocked again. > > > > > This was also found in the DNS: Unbound logs. > > > > > So it looks like if there are multiple categories selected then= only the urls from the first category get blocked. > > > > > Regards, > > > > > Adolf. > > > > > > > > > > > > > > > > > > > > > Separate =22access-control-tag=22 don=E2=80=99t seem to wor= k. > > > > > > > > > > > > What is this supposed to mean=3F > > > > > > > > > > > > -Michael > > > > > > > > > > > > > > > > > > > > The above changes allows RPZ to work as expected. > > > > > > > > > > > > > > > > > > > > > > > > > > > > ------ Original Message ------ > > > > > > > =46rom =22Michael Tremer=22 > > > > > > > To =22Adolf Belka=22 > > > > > > > Cc development=40lists.ipfire.org; dbl=40lists.ipfire.org > > > > > > > Date 3/23/2026 9:41:07=E2=80=AFAM > > > > > > > Subject Re: =46eedback on issues with DNS=46W in CU201 Test= ing > > > > > > > > > > > > > > > Hello, > > > > > > > > > > > > > > > > So this looks good. The list has been properly loaded int= o Unbound. > > > > > > > > > > > > > > > > I don=E2=80=99t quite know what could be going wrong now.= > > > > > > > > > > > > > > > > -Michael > > > > > > > > > > > > > > > > > On 23 Mar 2026, at 12:22, Adolf Belka wrote: > > > > > > > > > > > > > > > > > > Hi Michael, > > > > > > > > > > > > > > > > > > On 23/03/2026 12:10, Michael Tremer wrote: > > > > > > > > > > Hello Adolf, > > > > > > > > > > What is the output of unbound-control list=5Fauth=5Fz= ones=3F > > > > > > > > > > > > > > > > > > porn.rpz.ipfire.org. serial 1773964805 since 1774267487= 2026-03-23T13:04:47 > > > > > > > > > gambling.rpz.ipfire.org serial 1773997205 since 1774267= 487 2026-03-23T13:04:47 > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > > > > > > > Adolf. > > > > > > > > > > > > > > > > > > > -Michael > > > > > > > > > > > On 20 Mar 2026, at 16:59, Adolf Belka wrote: > > > > > > > > > > > > > > > > > > > > > > Hi Michael, > > > > > > > > > > > > > > > > > > > > > > On 20/03/2026 16:56, Michael Tremer wrote: > > > > > > > > > > > > Hello Adolf, > > > > > > > > > > > > I am copying the DBL list, too. > > > > > > > > > > > > > > > > > > > > > > Good idea. I was just thinking of it being related = to Testing issue. > > > > > > > > > > > > So this is obviously not normal, but we can debug= this step by step: > > > > > > > > > > > > =46irst of all, we should check if Unbound was ab= le to successfully fetch the DNS zones. Gambling has clearly been downloa= ded, but it seems that the Porn list might not. You can check in /var/cac= he/unbound if there is the zone file. If yes, then you can try to resolve= a couple of things on the console and check if they are being blocked: > > > > > > > > > > > > > > > > > > > > > > I should have already mentioned this but forgot. It= was one of the first things I checked and I have just re-confirmed now. = The porn zone file is present. It was updated at 11:40 CET and the Gambli= ng zone was updated at 12:53 CET. > > > > > > > > > > > > > > > > > > > > > > I also checked that the zone file contained the url= 's being used and it did and does. > > > > > > > > > > > > > > > > > > > > > > > =23 dig =40localhost some.porn.website.com > > > > > > > > > > > > You should see NXDOMAIN if the domain exists and = has been blocked and you should see the log entries just like gambling. > > > > > > > > > > > > > > > > > > > > > > Got > > > > > > > > > > > > > > > > > > > > > > ;; Got answer: > > > > > > > > > > > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id= : 54293 > > > > > > > > > > > ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORI= TY: 1, ADDITIONAL: 1 > > > > > > > > > > > > > > > > > > > > > > So NXDOMAIN is in the answer but there was nothing = additional in the unbound log. The last entry in it was from 12:58:50 whe= n I did the tests with the gambling sites and if there was an entry it sh= ould have a timestamp for around 17:45 > > > > > > > > > > > > > > > > > > > > > > > This rules out anything that is going wrong betwe= en the browser and Unbound. > > > > > > > > > > > > In case of the URL filter, it simply seems that s= quidguard is not seeing the requests. You might as well try something lik= e: > > > > > > > > > > > > > > > > > > > > > > With the URL =46ilter enabled and DNS=46W disabled = then the URL =46ilter blocks and logs both the Gambling and Porn site acc= esses. Sorry if that came across as differently in my mail. The URL =46il= ter works fine for me with both CU200 and CU201 Testing. > > > > > > > > > > > > > > > > > > > > > > > =23 http=5Fproxy=3Dhttp://1.2.3.4:800 https=5Fproxy=3Dhttp://1.2.3.4:800 wget = -d http://some.porn.website.com > > > > > > > > > > > > The squidguard.log should also contain some inter= esting information if something didn=E2=80=99t go as planned. > > > > > > > > > > > > -Michael > > > > > > > > > > > > > On 20 Mar 2026, at 12:30, Adolf Belka wrote: > > > > > > > > > > > > > > > > > > > > > > > > > > Hi All, > > > > > > > > > > > > > > > > > > > > > > > > > > I am having issues with getting DNS=46W to work= properly, it fails in many conditions to block things from the list. > > > > > > > > > > > > > > > > > > > > > > > > > > The dbl list works fine for me in the URL =46il= ter for both CU200 and CU201 Testing. > > > > > > > > > > > > > > > > > > > > > > > > > > =46or my testing I created a new install of CU2= 01 Testing and just went straight to DNS=46W and enabled the Gambling and= Pornography categories and Saved. > > > > > > > > > > > > > > > > > > > > > > > > > > Then selected the Green network for both catego= ries using the pencil edit option. > > > > > > > > > > > > > > > > > > > > > > > > > > In this setup I had no Web Proxy enabled. > > > > > > > > > > > > > > > > > > > > > > > > > > I then cleared the browser cache and set the Br= owser to No Proxy. > > > > > > > > > > > > > > > > > > > > > > > > > > I then tested out nl.onecasino.com and www.xnxx= .com in =46irefox and in Netsurf > > > > > > > > > > > > > > > > > > > > > > > > > > The gambling site was blocked and gave the mess= age > > > > > > > > > > > > > > > > > > > > > > > > > > Unable to connect > > > > > > > > > > > > > =46irefox can=E2=80=99t establish a connection = to the server at nl.onecasino.com. > > > > > > > > > > > > > > > > > > > > > > > > > > =46or the porn site it was not blocked but open= ed up. > > > > > > > > > > > > > I tried with two other gambling and porn sites.= All three gambling sites were blocked. All three porn sites were allowed= through. > > > > > > > > > > > > > > > > > > > > > > > > > > In the DND: Unbound System Logs I found > > > > > > > > > > > > > > > > > > > > > > > > > > 12:52:26 unbound: =5B1820:0=5D info: rpz: appli= ed =5Bgambling.rpz.ipfire.org=5D *.postcodeloterij.nl. rpz-nxdomain 192.1= 68.200.11=4044247 www.postcodeloterij.nl. A IN > > > > > > > > > > > > > 12:52:26 unbound: =5B1820:0=5D info: rpz: appli= ed =5Bgambling.rpz.ipfire.org=5D *.postcodeloterij.nl. rpz-nxdomain 192.1= 68.200.11=4044356 www.postcodeloterij.nl. HTTPS IN > > > > > > > > > > > > > 12:51:32 unbound: =5B1820:0=5D info: rpz: appli= ed =5Bgambling.rpz.ipfire.org=5D *.onecasino.com. rpz-nxdomain 192.168.20= 0.11=4055955 nl.onecasino.com. A IN > > > > > > > > > > > > > 12:51:32 unbound: =5B1820:0=5D info: rpz: appli= ed =5Bgambling.rpz.ipfire.org=5D *.onecasino.com. rpz-nxdomain 192.168.20= 0.11=4049136 nl.onecasino.com. HTTPS IN > > > > > > > > > > > > > 12:50:41 unbound: =5B1820:0=5D info: rpz: appli= ed =5Bgambling.rpz.ipfire.org=5D *.hollandcasino.nl. rpz-nxdomain 192.168= .200.11=4047229 welkom.hollandcasino.nl. A IN > > > > > > > > > > > > > 12:50:41 unbound: =5B1820:0=5D info: rpz: appli= ed =5Bgambling.rpz.ipfire.org=5D *.hollandcasino.nl. rpz-nxdomain 192.168= .200.11=4043346 welkom.hollandcasino.nl. HTTPS IN > > > > > > > > > > > > > > > > > > > > > > > > > > So the blocked gambling sites were in the logs = but not any of the pornography sites had tested. > > > > > > > > > > > > > > > > > > > > > > > > > > Then tried the browser with the Network Setting= s set to Use system proxy settings and the same result occurred. > > > > > > > > > > > > > > > > > > > > > > > > > > I then turned on the Web Proxy with conventiona= l connection on port 800. Saved and restarted and then Cleared the web pr= oxy cache. > > > > > > > > > > > > > Then I cleared the browser cache and set the Ne= twork Settings to Manual proxy configuration with the IP of my IP=46ire s= ystem being tested. > > > > > > > > > > > > > > > > > > > > > > > > > > I then tested the same three gambling URL's and= Porn URL's. > > > > > > > > > > > > > All of the sites were opened up. > > > > > > > > > > > > > In the DNS: Unbound system log there were no ne= w entries. > > > > > > > > > > > > > In the Proxy Logs there were entries for the ga= mbling and porn sites. > > > > > > > > > > > > > > > > > > > > > > > > > > I have also tested the browser out using the we= b proxy with the Automatic proxy configuration URL accessing the wpad fil= e via dhcp and that also had the same results as using the Manual proxy c= onfiguration option. > > > > > > > > > > > > > > > > > > > > > > > > > > I have repeated a lot of my tests multiple time= s, also with repeated new installs and for me, as long as I ensured I had= cleared the web proxy and browser caches, always came up with the same r= esults as I have described above. > > > > > > > > > > > > > > > > > > > > > > > > > > It would be good to know if any of you also exp= erience the same effect or if it works without problems for yourselves. > > > > > > > > > > > > > > > > > > > > > > > > > > Regards, > > > > > > > > > > > > > > > > > > > > > > > > > > Adolf. Jon -- Jon Murphy murphy.jon=40me.com 847-774-3550 (cell) -- --69d9297e_1a32234b_18253 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline 3D=22=22
T= he recent update=C2=A0allows = more than one category and seems to work OK (still testing).

=46ound a new= issue; =C2=A0In the =46irewall DNS > Access Control area > = Custom Source a CIDR notation of 192.168.74.0/24 works OK, but the= =C2=A0subnet mask notation of 192.168.74.0/255.255.255.0 throws this erro= r:

Apr 10 11:25:45 ipfireAPU2 unbound: =5B16= 94:6=5D error: netblock too large: 192.168.74.0/255.255.255.0
Apr 10 11:25:45 ipfireAPU2 unbound: =5B1694:6=5D error= : cannot parse netblock: 192.168.74.0/255.255.255.0
Apr 10 11:26:48 ipfireAPU2 dhcpd: execute=5Fstatement argv=5B0=5D= =3D /usr/sbin/unbound-dhcp-leases-client



On Apr 10, 2026, at 5:09=E2=80=AF= AM, Adolf Belka <adolf.belka=40ipfire.org> wrote:

Hi Michael,

On 10/04/2026 11:= 33, Adolf Belka wrote:
= Hi Michael,
On 09/04/2026 12:20, Michael Tremer wrote:
Hello Adolf,

Could you please let me know is thi= s fixes the problem=3F
It has solved the problem when the= browser is set up to use No Proxy or System Proxy and the PC has no prox= y set up.
I was able to select Advertising, Dating, Gambling, Pornogra= phy, Shopping and Streaming at the same time and trying to access URL's f= rom the lists of those zones caused the access to be blocked. Yaaah. Entr= ies for all these categories found in the unbound log.
Unfortunately w= hen I changed the browser to use IP=46ire as the web proxy (Conventional = mode) by selecting Manual proxy configuration in the browser and specifyi= ng the IP=46ire IP all accesses to the selected categories listed above w= ere allowed to be accessed except for the url for the shopping site. That= was still blocked and in the unbound log there was an entry for the shop= ping site but no entries for any of the other category url's I had just a= ccessed and that were allowed.
So problem is fixed for when the IP=46i= re web proxy is not used by the browser but there is still an issue when = working via the proxy.
I will check some more shopping site url's to s= ee if the shopping site issue is consistent for multiple url's or only th= at one. I thought it might be that the url no longer exists but it is in = the unbound logs getting blocked by the DNS=46W. So the question would be= why that url gets blocked by the DNS=46W via the web proxy when the othe= r Category url's are not shown in the unbound log at all.

=46urther follow-up. After the test above with the = web proxy being used where the web sites were allowed to be accessed, I l= eft the browser open with the opened tabs.

Although the sit= es were not blocked by DNS=46W via the web proxy, except for the shopping= url, DNS=46W did then stop some Mozilla telemetry accesses via the ads z= one.
11:22:13 unbound: =5B1741:0=5D =C2=A0info: rpz: applie= d =5Bsho= pping.rpz.ipfire.org=5D=C2=A01000islandsphotoart.com. rpz-nxdomain 127.0.0.1=4042131=C2=A01000islandsphotoart.com. A IN
11:38:12 unbound= : =5B1741:0=5D =C2=A0info: rpz: applied =5Bads.rpz.ipfire.org=5D *.telemetry.mozilla.org. = rpz-nxdomain 192.168.200.10=4045618=C2=A0incoming.telemetry.mozilla.org. A IN
11:40:12 unbound: =5B1741= :0=5D =C2=A0info: rpz: applied =5Bads.rpz.ipfire.org=5D *.telemetry.mozilla.org. rpz-nxdom= ain 192.168.200.10=4047126=C2=A0= incoming.telemetry.mozilla.org. A IN
= 11:42:20 unbound: =5B1741:0=5D =C2=A0= info: rpz: applied =5Bads.rpz.ipfire.org=5D *.= telemetry.= mozilla.org. rpz-nxdomain 192.168= .200.10=4050709=C2=A0inco= ming.telemetry.mozilla.org. A IN<= /span>
11:46:20 unbound: =5B1741:0=5D =C2=A0info: rp= z: applied =5Ba= ds.rpz.ipfire.org=5D *.telemetry.mozilla.or= g. rpz-nxdomain 192.168.200.10=40= 46388=C2=A0incoming.telem= etry.mozilla.org. A IN
11:54:20 unbound: =5B1741:0=5D =C2=A0info: rpz: applied= =5Bads.rpz.i= pfire.org=5D *.telemetry.mozilla.org. rpz-nxdomain 192.168.200.10=4053250=C2=A0incoming.telemetry.mozil= la.org. A IN
11:55:25 unbound: =5B1741:0=5D =C2=A0info: rpz: applied =5B= shopping.rpz.ip= fire.org=5D=C2=A01000islandsphotoart.com. rpz-nxdomain 127.0.0.1=4042131=C2=A01000islandsphotoart.com. A IN
11:55:31 unbound: =5B1741:0=5D= =C2=A0info: rpz: applied =5Bads.rpz.ipfire.org=5D=C2=A0ads.mozilla.org. rpz-nxdomain 192.168.200.10=4043432=C2=A0ads.mozilla.org. A IN
11:55:31 unbound: =5B1741:0=5D= =C2=A0info: rpz: applied =5Bads.rpz.ipfire.org=5D *.tel= emetry.mozilla.org. rpz-nxdomain = 192.168.200.10=4048485=C2=A0incoming.telemetry.mozilla.org. = A IN
The first line was the blocked shopping url after chan= ging the browser to use the IP=46ire web proxy.
The second shopping block was when I cam back and tried the shopping url= again to see if it was still blocked.
All th= e other mozilla related blocks must be the =46irefox browser trying to op= en some things on the web pages that had previously been opened.
Regards,

Adolf.


=
Regards,
Ado= lf.

=C2=A0=C2=A0=C2=A0https://git.ipfire.org/=3Fp=3Dipfire-2= .x.git;a=3Dcommitdiff;h=3De3c11ae3436b578432df0058eee229f262791254
Best,
-Michael

On 25 Mar 2026, a= t 13:43, Adolf Belka <adolf.belka=40ipfire.org> wrote:

Hi Mi= chael & Jon,

On 25/03/2026 12:58, Adolf Belka wrote:
Hi Michael and Jon,
On 25/03/2026 10:30, Micha= el Tremer wrote:
Hello Jon,

Why w= ould it be necessary to manually change the configuration=3F

Can y= ou explain to us what you are thinking=3F
I think the arg= ument is that the define-tag and access-control-tag options should not be= multiple entries but single entries with multiple tags space separated i= n the =22=22 section.

At least the access-control-tag= option has to be able to be used multiple times. If you have three categ= ories defined, one with green selected another with blue and the last wit= h orange then there has to be at least three access-control-tags because = each of the subnets has a different category assigned to it.

I als= o found a similar situation outlined in the unbound documentation where t= hey have four access-control-tags defined.

https://unbound.docs.nl= netlabs.nl/en/latest/topics/filtering/tags-views.html=23tags

Regar= ds,

Adolf.


On 24 Mar 2026, at 21:03, Jo= n Murphy <jon.murphy=40ipfire.org> wrote:

Try this in the dn= sbl.conf file.

server:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0define-tag: =22ads.rpz.ipfire.org d= ating.rpz.ipfire.org=22

server:
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0access-control-tag: 192.1= 68.74.0/24 =22ads.rpz.ipfire.org dating.rpz.ipfire.org=22
Tried this but it made no difference. I suspect this might = be that unbound needs to reload the config file if it has been changed an= d running unbound reload results in the dnsbl.conf file being updated wit= h what is on the WUI page, so it goes back to the version before it was m= anually edited.
However this made me wonder what would happen if I onl= y had the porn entry selected and not both the porn and gambling.
The = result, with the browser network option set to No Proxy was that all porn= sites were now blocked.
I then wondered what would happen if I chose = two different categories where the working gambling one was after another= category. So I tested out Dating and Gambling.
=46irst tested out Dat= ing on its own.
It blocked for academysingles.com and loopylove.comThen I enabled both Dating and Gambling. In this case the two dating url= s were still blocked but now all the urls that I had previously used, whe= n testing out Gambling and Porn categories together, were no longer block= ed.
If I disabled the Dating category then the Gambling sites were blo= cked again.
This was also found in the DNS: Unbound logs.
So it loo= ks like if there are multiple categories selected then only the urls from= the first category get blocked.
Regards,
Adolf.


Separate =22access-c= ontrol-tag=22 don=E2=80=99t seem to work.

What is thi= s supposed to mean=3F

-Michael


The above changes allows RPZ to work as expected.



---= --- Original Message ------
=C2=A0=C2=A0=46rom =22Michael Tremer=22 <michael.tremer=40ipfir= e.org>
To =22Adolf Belka=22 <adolf.belka=40ipfire.org>
Cc = development=40lists.ipfire.org; dbl=40lists.ipfire.org
Date 3/23/2026 = 9:41:07=E2=80=AFAM
Subject Re: =46eedback on issues with DNS=46W in CU= 201 Testing

Hello,

So this lo= oks good. The list has been properly loaded into Unbound.

I don=E2= =80=99t quite know what could be going wrong now.

-Michael

=
On 23 Mar 2026, at 12:22, Adolf Belka <a= dolf.belka=40ipfire.org> wrote:

Hi Michael,

On 23/03/202= 6 12:10, Michael Tremer wrote:
Hello Ado= lf,
What is the output of unbound-control list=5Fauth=5Fzones=3F

porn.rpz.ipfire.org.=C2=A0=C2=A0=C2=A0 serial 1773964805=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 since 1774267487 2026-03-23T13:04= :47
gambling.rpz.ipfire.org=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 serial= 1773997205=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 since 1774267487 20= 26-03-23T13:04:47

Regards,

Adolf.

-Michael
On 20 Mar 2026, at 1= 6:59, Adolf Belka <adolf.belka=40ipfire.org> wrote:

Hi Micha= el,

On 20/03/2026 16:56, Michael Tremer wrote:
Hello Adolf,
I am copying the DBL list, too.

Good idea. I was just thinking of it being related to Testing is= sue.
So this is obviously not normal, bu= t we can debug this step by step:
=46irst of all, we should check if U= nbound was able to successfully fetch the DNS zones. Gambling has clearly= been downloaded, but it seems that the Porn list might not. You can chec= k in /var/cache/unbound if there is the zone file. If yes, then you can t= ry to resolve a couple of things on the console and check if they are bei= ng blocked:

I should have already mentioned this but = forgot. It was one of the first things I checked and I have just re-confi= rmed now. The porn zone file is present. It was updated at 11:40 CET and = the Gambling zone was updated at 12:53 CET.

I also checked that th= e zone file contained the url's being used and it did and does.

=23 dig =40localhost some.porn.website.com &l= t;http://some.porn.website.com/>
You should see NXDOMAIN if the dom= ain exists and has been blocked and you should see the log entries just l= ike gambling.

Got

;; Got answer:
;; ->&g= t;HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 54293
;; flags:= qr rd ra ad; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

So = NXDOMAIN is in the answer but there was nothing additional in the unbound= log. The last entry in it was from 12:58:50 when I did the tests with th= e gambling sites and if there was an entry it should have a timestamp for= around 17:45

This rules out anythin= g that is going wrong between the browser and Unbound.
In case of the = URL filter, it simply seems that squidguard is not seeing the requests. Y= ou might as well try something like:

With the URL =46= ilter enabled and DNS=46W disabled then the URL =46ilter blocks and logs = both the Gambling and Porn site accesses. Sorry if that came across as di= fferently in my mail. The URL =46ilter works fine for me with both CU200 = and CU201 Testing.

=23 http=5Fproxy=3D= http://1.2.3.4:800 <http://1.2.3.4:800/> https=5Fproxy=3Dhttp://1.2= .3.4:800 <http://1.2.3.4:800/> wget -d http://some.porn.website.com= <http://some.porn.website.com/>
The squidguard.log should also = contain some interesting information if something didn=E2=80=99t go as pl= anned.
-Michael
On 20 Mar 2026, at 12= :30, Adolf Belka <adolf.belka=40ipfire.org> wrote:

Hi All,
I am having issues with getting DNS=46W to work properly, it fails = in many conditions to block things from the list.

The dbl list wor= ks fine for me in the URL =46ilter for both CU200 and CU201 Testing.
<= br>=46or my testing I created a new install of CU201 Testing and just wen= t straight to DNS=46W and enabled the Gambling and Pornography categories= and Saved.

Then selected the Green network for both categories us= ing the pencil edit option.

In this setup I had no Web Proxy enabl= ed.

I then cleared the browser cache and set the Browser to No Pro= xy.

I then tested out nl.onecasino.com and www.xnxx.com in =46iref= ox and in Netsurf

The gambling site was blocked and gave the messa= ge

Unable to connect
=46irefox can=E2=80=99t establish a connec= tion to the server at nl.onecasino.com.

=46or the porn site it was= not blocked but opened up.
I tried with two other gambling and porn s= ites. All three gambling sites were blocked. All three porn sites were al= lowed through.

In the DND: Unbound System Logs I found

12:5= 2:26 unbound: =5B1820:0=5D=C2=A0 info: rpz: applied =5Bgambling.rpz.ipfir= e.org=5D *.postcodeloterij.nl. rpz-nxdomain 192.168.200.11=4044247 www.po= stcodeloterij.nl. A IN
12:52:26 unbound: =5B1820:0=5D=C2=A0 info: rpz:= applied =5Bgambling.rpz.ipfire.org=5D *.postcodeloterij.nl. rpz-nxdomain= 192.168.200.11=4044356 www.postcodeloterij.nl. HTTPS IN
12:51:32 unbo= und: =5B1820:0=5D=C2=A0 info: rpz: applied =5Bgambling.rpz.ipfire.org=5D = *.onecasino.com. rpz-nxdomain 192.168.200.11=4055955 nl.onecasino.com. A = IN
12:51:32 unbound: =5B1820:0=5D=C2=A0 info: rpz: applied =5Bgambling= .rpz.ipfire.org=5D *.onecasino.com. rpz-nxdomain 192.168.200.11=4049136 n= l.onecasino.com. HTTPS IN
12:50:41 unbound: =5B1820:0=5D=C2=A0 info: r= pz: applied =5Bgambling.rpz.ipfire.org=5D *.hollandcasino.nl. rpz-nxdomai= n 192.168.200.11=4047229 welkom.hollandcasino.nl. A IN
12:50:41 unboun= d: =5B1820:0=5D=C2=A0 info: rpz: applied =5Bgambling.rpz.ipfire.org=5D *.= hollandcasino.nl. rpz-nxdomain 192.168.200.11=4043346 welkom.hollandcasin= o.nl. HTTPS IN

So the blocked gambling sites were in the logs but = not any of the pornography sites=C2=A0 had tested.

Then tried the = browser with the Network Settings set to Use system proxy settings and th= e same result occurred.

I then turned on the Web Proxy with conven= tional connection on port 800. Saved and restarted and then Cleared the w= eb proxy cache.
Then I cleared the browser cache and set the Network S= ettings to Manual proxy configuration with the IP of my IP=46ire system b= eing tested.

I then tested the same three gambling URL's and Porn = URL's.
All of the sites were opened up.
In the DNS: Unbound system = log there were no new entries.
In the Proxy Logs there were entries fo= r the gambling and porn sites.

I have also tested the browser out = using the web proxy with the Automatic proxy configuration URL accessing = the wpad file via dhcp and that also had the same results as using the Ma= nual proxy configuration option.

I have repeated a lot of my tests= multiple times, also with repeated new installs and for me, as long as I= ensured I had cleared the web proxy and browser caches, always came up w= ith the same results as I have described above.

It would be good t= o know if any of you also experience the same effect or if it works witho= ut problems for yourselves.

Regards,

Adolf.
=

Jon


--=C2=A0
Jon Murphy
murphy.jon=40me.c= om
847-774-3550 (cell)
--=C2=A0



<= br class=3D=22Apple-interchange-newline=22>

--69d9297e_1a32234b_18253--