# DoHblock - Blocking DNS over HTTPS via RPZ

**URL:** <https://community.ipfire.org/t/dohblock-blocking-dns-over-https-via-rpz/10295>\
**Category:** DNS\
**Created:** [5 September 2023 03:24 UTC](https://community.ipfire.org/t/dohblock-blocking-dns-over-https-via-rpz/10295 "2023-09-05T03:24:03Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![jon](https://community.ipfire.org/user_avatar/community.ipfire.org/jon/32/15363_2.png) [@jon](https://community.ipfire.org/u/jon)\
**Post date:** [5 November 2023 01:44 UTC](https://community.ipfire.org/t/dohblock-blocking-dns-over-https-via-rpz/10295/15 "2023-11-05T01:44:48Z")

</div>

> [@gw-ipfire](#):
>
> the best is possible a add web ui in ipfire for control rpz list

Agree. But I don’t know how to do this. Any volunteers?!?

> [@gw-ipfire](#):
>
> allowlist

Add these lines to the config file. This is an example of the config for my allow zone for the DoH block (1st post):

```auto
rpz:
	name: allow.doh.rpz.zone
	zonefile: /etc/unbound/zonefiles/allow.doh.rpz.zone
	rpz-action-override: passthru
	rpz-log: no
	rpz-log-name: dohAllow

```

**NOTE** : This MUST go near the top of the config. Like this:

 ![Screen Shot 2023-11-04 at 9.36.08 PM](https://community.ipfire.org/uploads/default/original/2X/a/ab0f185ad3bd5b91f02a91b60ed111f0c0b182b8.png)

The"allows" go above the “blocks”, otherwise it won’t work.

Notice the `rpz-action-override: passthru` replaces the `rpz-action-override: nxdomain`.

* * *

Below is the DoH allow zone I use. It is placed in the `/etc/unbound/zonefiles` directory.

File: `/etc/unbound/zonefiles/allow.doh.rpz.zone`

```auto
$TTL 30 ;time (in seconds) that DNS responses are cached
@ SOA LOCALHOST. ipfire.org. (	
	1 ; serial number
	1d ; refresh period
	30m ; retry period
	30d ; expire time
	30 ; minimum TTL
)
 NS localhost.
;
;	domains and actions list
;
doh.dns.apple.com CNAME	rpz-passthru.
doh.dns.apple.com.v.aaplimg.com	CNAME	rpz-passthru.
mask-api.icloud.com CNAME	rpz-passthru.
mask-api.fe.apple-dns.net CNAME	rpz-passthru.
mask.icloud.com CNAME	rpz-passthru.
mask-h2.icloud.com CNAME	rpz-passthru.
mask.apple-dns.net CNAME	rpz-passthru.

```

The above is my example, Remove my items first and then place the items you want to allow in the list.

Notice the `CNAME	rpz-passthru.` replaces the `CNAME	.`

**Make sure you increment the serial number** otherwise the new zone file will not be captured into RPZ.

* * *

**EDIT** : Since we changed the config file make sure you do these commands:

#### Quick test

To check for issues in the config file, run the command on IPFire:

```auto
unbound-checkconf 

```

#### Activate

Restart unbound to load config file:

```auto
/etc/init.d/unbound restart

```

---

_[View the full topic](https://community.ipfire.org/t/dohblock-blocking-dns-over-https-via-rpz/10295)._