# Blocking URLs using wild carrds **URL:** \ **Category:** Network\ **Created:** [24 September 2024 12:48 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189 "2024-09-24T12:48:30Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![storminjack](https://community.ipfire.org/user_avatar/community.ipfire.org/storminjack/32/15469_2.png) [@storminjack](https://community.ipfire.org/u/storminjack)\ **Post date:** [24 September 2024 12:48 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/1 "2024-09-24T12:48:30Z")
Is there a way to block urls using wildcards. I am trying to block all .xxx sites Would be a nice feature! ---
**Author:** ![vincero](https://community.ipfire.org/user_avatar/community.ipfire.org/vincero/32/11579_2.png) [@vincero](https://community.ipfire.org/u/vincero)\ **Post date:** [24 September 2024 14:14 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/2 "2024-09-24T14:14:37Z")
You may not need to use wildcards as far as I know, if the domain name hierarchy is respected in the list… E.g. say you wanted to block only ‘[community.ipfire.org](http://community.ipfire.org)’ then you would add that to the list. That would still allow [www.ipfire.org](http://www.ipfire.org) and any other sub-domain/sub-sites to work. If you wanted to block everything from that domain then just put in: ‘[ipfire.org](http://ipfire.org)’ - that would block anything from that domain. If you want to block an entire region/zone/group such as .org, .biz, or .xxx in this case, maybe you could just try adding xxx to the list and seeing if it works at blocking domain names based on the tree hierarchy. Otherwise you may need to use the custom expression - I believe that allows wildcards to be used but not entirely familiar with the notation used. Not tested it myself as not using proxy (any more). ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [24 September 2024 14:41 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/3 "2024-09-24T14:41:33Z")
this is alternative option, which can be achieved by simple XDP DNS wildcard blocklist, for example put [example.com](http://example.com) in blocklist, [xxx.example.com](http://xxx.example.com) will be blocked. [https://www.youtube.com/watch?v=luFBhVU8FPM&t=2s](https://www.youtube.com/watch?v=luFBhVU8FPM&t=2s). I am also working with lunatik maintainer [GitHub - luainkernel/lunatik: Lunatik is a framework for scripting the Linux kernel with Lua.](https://github.com/luainkernel/lunatik) to block site by TLS/SSL server name extension, only one issue left which is can’t block chrome browser because chrome has large clienthello payload \> MTU 1500 bytes, this does not work well with XDP in consumer/home network environment, but can be worked around by fall back to netfilter. ---
**Author:** ![storminjack](https://community.ipfire.org/user_avatar/community.ipfire.org/storminjack/32/15469_2.png) [@storminjack](https://community.ipfire.org/u/storminjack)\ **Post date:** [24 September 2024 15:01 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/4 "2024-09-24T15:01:12Z")
This is way above my pay grade. I was just looking for a simple way to block xxx sites within IPFire ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [24 September 2024 15:13 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/5 "2024-09-24T15:13:38Z")
it is free and open source solution 🙂 my goal is to bring enterprise data center technology to consumer/home network with open source technology [GitHub - vincentmli/BPFire: BPFire development tree](https://github.com/vincentmli/BPFire) ---
**Author:** ![hvacguy](https://community.ipfire.org/user_avatar/community.ipfire.org/hvacguy/32/8576_2.png) [@hvacguy](https://community.ipfire.org/u/hvacguy)\ **Post date:** [24 September 2024 22:55 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/6 "2024-09-24T22:55:29Z")
If there was a easy way to add block list to the IPS system that would be great. Not sure how that would be done.. > [@Zip domains a bad idea](https://community.ipfire.org/t/zip-domains-a-bad-idea/9777): > > This is a little scary: see the two GitHub examples about ½ way down. Time to block all \*.zip and \*.mov domains? ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [25 September 2024 00:19 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/7 "2024-09-25T00:19:12Z")
this can be easily done in DNS eBPF XDP longest prefix match trie map that is implemented in BPFire. just simple as add `.mov` and `.zip` in the eBPF map, easy and efficient, and a cheap mini PC could do it since XDP runs from the driver, not much resource required. [![](https://community.ipfire.org/uploads/default/original/2X/1/11c074dc03f5bede03d2832080ca9c7b67d89de0.jpeg "BPFire eBPF XDP DNS Blocklist") ](https://www.youtube.com/watch?v=luFBhVU8FPM) for folks who is concerned about XDP security, the code I developed is actually based on DNS unbound author [Journeying into XDP: Part 0](https://blog.nlnetlabs.nl/journeying-into-xdp-part-0/) ---
**Author:** ![tratru](https://community.ipfire.org/user_avatar/community.ipfire.org/tratru/32/8787_2.png) [@tratru](https://community.ipfire.org/u/tratru)\ **Post date:** [25 September 2024 06:34 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/8 "2024-09-25T06:34:18Z")
hello it would be great if instead of installing a fork of ipfire there is a pakfire of ipfire ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [25 September 2024 16:24 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/9 "2024-09-25T16:24:11Z")
it is not matter of simply install pakfire package, it is the kernel requires eBPF to be enabled which is not possible for ipfire at this time. ---
**Author:** ![tratru](https://community.ipfire.org/user_avatar/community.ipfire.org/tratru/32/8787_2.png) [@tratru](https://community.ipfire.org/u/tratru)\ **Post date:** [26 September 2024 12:41 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/10 "2024-09-26T12:41:48Z")
it’s a real shame not to be able to integrate these functions into the main distribution maybe if it were possible I would somehow install them on the official distribution maybe in the future ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [26 September 2024 13:42 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/11 "2024-09-26T13:42:36Z")
A discussion about this topic was started on devel mailing list. Don’t know the actual state, but maybe @vincentmli knows. ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [26 September 2024 14:34 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/12 "2024-09-26T14:34:21Z")
there are quite a few requirements to have kernel with eBPF feature enabled, like add pahole addon to generate BTF during kernel build, enable kernel eBPF config and a few debug kernel config, increase build temporary space, strip kernel module debug symbols…etc. it is not small change to kernel, ipfire devs has not shown interest to explore eBPF, from what I understand, mostly due to lack of understanding about eBPF. ---
**Author:** ![hjkl](https://community.ipfire.org/user_avatar/community.ipfire.org/hjkl/32/8574_2.png) [@hjkl](https://community.ipfire.org/u/hjkl)\ **Post date:** [30 September 2024 18:02 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/13 "2024-09-30T18:02:59Z")
> [@storminjack](#): > > Is there a way to block urls using wildcards. I am trying to block all .xxx sites > Would be a nice feature! I am using the URL filter - [www.ipfire.org - URL filter](https://www.ipfire.org/docs/configuration/network/proxy/url-filter) and I did blocked entire ccTLD (like .cn, .by), entire domains (like [adnx.com](http://adnx.com)), subdomain ([analytics.yahoo.com](http://analytics.yahoo.com)) or just a specific URL. Basically I used almost all blocking features listed there except the “Custom expression list” (that looks like RegEx to me)… To have all above working each client must use the proxy from ipfire and that is achieved via DHCP & DNS (WPAD is sent by DHCP and also resolved by DNS) ---
**Author:** ![peppetech](https://community.ipfire.org/user_avatar/community.ipfire.org/peppetech/32/12711_2.png) [@peppetech](https://community.ipfire.org/u/peppetech)\ **Post date:** [30 September 2024 20:26 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/14 "2024-09-30T20:26:56Z")
Would it take less RAM or CPU resources if Norm would use Unbound / RPZ blocklist? ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [1 October 2024 02:29 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/15 "2024-10-01T02:29:23Z")
it would be even less with XDP since it runs in the kernel. but I know it is a fork, too bad 🙂 ---
**Author:** ![peppetech](https://community.ipfire.org/user_avatar/community.ipfire.org/peppetech/32/12711_2.png) [@peppetech](https://community.ipfire.org/u/peppetech)\ **Post date:** [1 October 2024 17:22 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/16 "2024-10-01T17:22:38Z")
You might be right, XDP could blow the Pi out of Pihole 🥧 ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [2 October 2024 01:05 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/17 "2024-10-02T01:05:48Z")
on the DNS topic, I just added new XDP DNS blocklist feature to log the query name and source ip in system log, happens someone asked this for unbound before in ipfire 🙂 [Unbound (and other programs ) logging - #32 by bonnietwin](https://community.ipfire.org/t/unbound-and-other-programs-logging/654/32) ---
**Author:** ![storminjack](https://community.ipfire.org/user_avatar/community.ipfire.org/storminjack/32/15469_2.png) [@storminjack](https://community.ipfire.org/u/storminjack)\ **Post date:** [2 October 2024 03:44 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/18 "2024-10-02T03:44:51Z")
Vincent Stop sending me these emails. i have no idea what they meean!!! ---
**Author:** ![vincentmli](https://community.ipfire.org/user_avatar/community.ipfire.org/vincentmli/32/16564_2.png) [@vincentmli](https://community.ipfire.org/u/vincentmli)\ **Post date:** [2 October 2024 13:07 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/19 "2024-10-02T13:07:13Z")
I am just posting here, not sending email to you specifically, blocking post from me if you don’t like it ---
**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\ **Post date:** [3 October 2024 00:09 UTC](https://community.ipfire.org/t/blocking-urls-using-wild-carrds/12189/20 "2024-10-03T00:09:21Z")
RPZ will do a DNS block and uses wildcards. The user would enter `*.xxx` to block everything in that Top Level Domain (TLD). Right now I block these (as an example): ![Screenshot 2024-10-02 at 7.00.48 PM](https://community.ipfire.org/uploads/default/original/2X/9/9c89cf911ce63315a665ee5974f9d56c1fc0f254.png) If you are interested I can help get you started. Add your questions or a request for assistance here in this thread: > [@I created a test version of a RPZ add-on and I am looking for feedback](https://community.ipfire.org/t/i-created-a-test-version-of-a-rpz-add-on-and-i-am-looking-for-feedback/11934): > > I created a test version of a RPZ add-on. I am looking for feedback so if you are interested please let me know. It needs a little work like the addition of copyright and some documentation (in progress). EDIT: Here is a draft of the RPZ add-on Wiki: [https://www.ipfire.org/docs/addons/rpz](https://www.ipfire.org/docs/addons/rpz) Comments are welcome! EDIT2: changed PDF to a Wiki page > [@storminjack](#): > > Stop sending me these emails. i have no idea what they meean!!! The email happens because someone is adding a response to your original post. You can block the user or block this entire thread. Let me know which you’d prefer and I will assist.