| Summary: | Add extension point for DNS Firewall to allow custom blocklists | ||
|---|---|---|---|
| Product: | DBL | Reporter: | praful - <ipfire> |
| Component: | Main | Assignee: | Michael Tremer <michael.tremer> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | Minor Usability | ||
| Priority: | Will only affect a few users | ||
| Version: | unspecified | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
Hello, (In reply to praful - from comment #0) > The url to download the OISD list is https:/big.oisd.nl/rpz but I can't find > a way of making that work by setting "primary". zone-sync help doesn't help. The way that our DNS Firewall is designed is to pull the zones using DNS zone transfer. It does not support HTTP download as that is unsuitable. > This request is to add a way to extend the built-in blocklists and add your > own blocklists such that they can be downloaded nightly (or other interval) > and work like the blocklists provided. We don't have any plans to add this functionality. We consider our approach much better and invite everyone to contribute to improve them further. (In reply to Michael Tremer from comment #1) > > > This request is to add a way to extend the built-in blocklists and add your > > own blocklists such that they can be downloaded nightly (or other interval) > > and work like the blocklists provided. > > We don't have any plans to add this functionality. We consider our approach > much better and invite everyone to contribute to improve them further. I understand the preference for encouraging contributions to the IPFire DBL rather than promoting third-party lists, and I'm not suggesting replacing or competing with it. While experimenting I found that the existing architecture is already very close to supporting user-defined RPZs. dnsbl.json defines the available zones, dnsbl stores the enabled state, and the web UI automatically exposes any additional entries in dnsbl.json. My request is about providing an extension mechanism for advanced users. Some organisations have internal RPZs, commercial threat feeds, or other specialised sources that aren't appropriate for inclusion in the IPFire DBL. Supporting a locally managed RPZ would allow those users to integrate with the existing DNS Firewall UI without affecting the curated IPFire lists or increasing the maintenance burden for the project. The alternative is to use something like Pi-hole, which recognises that some organisations require their own blocklists. But I'm sure you'd agree that blocklists belong in the firewall. |
I couldn't find a documented way to add my custom blocklist to IPFire. Currently, I'm editing /var/ipfire/dns/dnsbl.json and have added: { "name" : "OISD", "zone" : "oisd.rpz", "primary" : "localhost", "description" : "OISD blocklist", "license" : "CC BY-SA 4.0" } The url to download the OISD list is https:/big.oisd.nl/rpz but I can't find a way of making that work by setting "primary". zone-sync help doesn't help. This request is to add a way to extend the built-in blocklists and add your own blocklists such that they can be downloaded nightly (or other interval) and work like the blocklists provided. The issue is documents here: https://community.ipfire.org/t/customise-dns-firewall/15992