a big thanks to everyone for the warm words and their good will to find a solution - I very much appreciate this, and may this was Bernhards intention when reopening the thread.
I’m also very happy in (as suggested by most of you) to move the development discussion, back to the mailing list. I’ll send a corresponding mail for starting it today evening.
I kindly invite you @jon to join this upcoming discussion, because you are most familiar with DNS and especially with the RPZ feature. So your expertise of it’s pro and cons will help us to understand why you have decided to base your work on it and to find the correct “filter” location and mechanism.
I would not be to afraid or worry about Michael and a possible “naughty list” - IMHO there has to be much more as a few strong words in a forum to get on such a list - even if it exists or not. As far as I know, he is no person, which blocks a good and fact based discussion - so I see no bigger problems with blaming you or the “how” and “who” questions in the future.
In this point I have to disagree with you - such an important and widely used feature should be part of the core distribution.
Thanks once again to everyone, lets keep the good spirit and hopefully we see us back on the mailing list.
I am pinging a domain listed in RPZ zonefile and I am getting a response
perhaps my Zonefiles are not updating?
# ping myvcart.com
PING myvcart.com (3.33.130.190) 56(84) bytes of data.
64 bytes from a2aa9ff50de748dbe.awsglobalaccelerator.com (3.33.130.190): icmp_seq=1 ttl=243 time=16.0 ms
64 bytes from a2aa9ff50de748dbe.awsglobalaccelerator.com (3.33.130.190): icmp_seq=2 ttl=243 time=14.6 ms
64 bytes from a2aa9ff50de748dbe.awsglobalaccelerator.com (3.33.130.190): icmp_seq=3 ttl=243 time=19.4 ms
64 bytes from a2aa9ff50de748dbe.awsglobalaccelerator.com (3.33.130.190): icmp_seq=4 ttl=243 time=18.1 ms
64 bytes from a2aa9ff50de748dbe.awsglobalaccelerator.com (3.33.130.190): icmp_seq=5 ttl=243 time=15.6 ms
the domain above is listed in the Zonefile called ‘urlhaus’
[**root@ipfire** ~] # nslookup blogspot.com
;; Got recursion not available from 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53
** server can't find blogspot.com: NXDOMAIN
[**root@ipfire** ~] # ping blogspot.com
ping: blogspot.com: Name or service not known
The urlhaus is only blocking www.myvcart.com so anything else like 123456.myvcart.com will be passed on to the internet.
so this is the right answer to block other subdomains:
This will block something like 123456.myvcart.com
When I added urlhaus as a RPZ list, then I see this:
[root@ipfire ~] # nslookup www.myvcart.com
;; Got recursion not available from 127.0.0.1
Server: 127.0.0.1
Address: 127.0.0.1#53
** server can't find www.myvcart.com: NXDOMAIN
[root@ipfire ~] #
The lists have existed for years, are publicly accessible via the GitHub repo and CDN mirrors, and I’ve been actively maintaining them with updates 1-6 times daily.
False positives are a priority: I monitor reports via GitHub issues, and fixes are typically pushed within hours or days depending on the list.
No prior discussions on licensing or maintenance have happened with me directly, but I’m happy to support integration.
Best,
Gerd
HaGeZi DNS-Blocklists
Sent from Proton Mail for iOS.
-------- Original Message --------
On Thursday, 12/04/25 at 20:32 raffe wrote:
Hi hagezi!
A member of the IPFire open-source firewall community (Jon) has created a test version of an RPZ add-on for the firewall. There’s a long discussion thread about it, and now that we’re starting to discuss how to proceed officially, the question of using your blocklists has come up:
Would you be willing to share your position on licensing and maintenance?
You’re very welcome to reply directly in the IPFire DNS forum here: https://community.ipfire.org/c/networking/dns/25
Or, if you prefer, you can reply to me and I’ll paste your answer into the thread for you
