Configuring NxFilter for DNS Content Filtering with pfSense

As an administrator, you may have encountered situations where it's essential to control and monitor the content accessed by your network users. One effective way to achieve this is by implementing a DNS-based content filtering solution using NxFilter. In this article, we will explore how to configure NxFilter in conjunction with pfSense for robust DNS content filtering.

To get started, you can filter the whitelist with nxFilter. Then, make the primary DNS Server on your pfSense setup 10.127.1.240, which is your nxFilter instance. Set the secondary DNS Server to 1.1.1.1, and configure NxFilter's upstream DNS Server as 10.127.1.254, which points back to pfSense.

In the configuration section of NxFilter, enable NAT Redirect DNS with the following settings:

* Protocol: IPv4

* TCP/UDP: *

* Destination Port: 53 (DNS)

* Gateway: 127.0.0.1

* Description: Block All other DNS Servers

With this setup, NxFilter becomes the only DNS server that your users can utilize, and their DNS setup will be automatically configured to point to NxFilter.

To ensure that users cannot bypass NxFilter by changing their device's DNS settings, implement firewall rules on pfSense to block access to any other DNS servers. Specifically, you need to block outgoing UDP/53 and TCP/53 traffic except for NxFilter. This way, even if a user attempts to change their DNS settings to point to another server, the traffic will be blocked by the firewall.

In our setup, we run pfSense (10.127.1.254) as the main firewall/router and have NxFilter (10.127.1.240) on a separate device for filtering DNS content. This configuration works seamlessly, allowing us to filter web content at the DNS level.

By implementing this solution, you can effectively control and monitor the content accessed by your network users, ensuring a safer and more secure online environment for your organization.

Nxfilter port 53