Netgate SG-1000 microFirewall

Author Topic: Is it possible to set up CNAME lookups with Unbound pkg for google safe search?  (Read 1976 times)

0 Members and 1 Guest are viewing this topic.

Offline David G.

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
I'm trying to figure out how to do this on my pfSense box (2.1.5) in a home / family environment that's been running pretty well for about 3 years. I just added the Unbound pkg, but have not activated it yet.
Based on Google's instructions, I'm trying to do this:
"Add a new CNAME record on your local DNS server for your local Google domain(s) pointing to forcesafesearch.google.com. For this example, we will be using www.google.com. Create a CNAME record for www.google.com that points to forcesafesearch.google.com"
Appreciate any help!

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21747
  • Karma: +1503/-26
    • View Profile
That type of CNAME requires a full-fledged authoritative name server like BIND. It won't work with a caching resolver like Unbound (or even dnsmasq) -- they require such a query to be answered locally/directly.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!

Offline tlinder

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Hi David
You can do is lookup the ip for forcesafesearch.google.com which is

216.239.38.120

and then activate the dns forwarder and create an entry

Host: www
Domain: google.com
IP: 216.239.38.120

Then you point the DNS-entry of your client machines or your dhcp server to the IP of your pfsense.

If you also want to block all other 195 domains that google has active you can import the forwarder file I created (see below) by going to :

Diagnostics -> Backup/restore -> Restore configuration -> Restore Area: DNS Forwarder

Hope this helps. Keep in mind that the IP-Address can change in the future.