Block AI Tools on pfSense
and OPNsense Firewalls

# Test that AI tool domains resolve to the DNSBL sinkhole
# Run from any client on the LAN, or from the pfSense shell

# Query a known AI tool domain against the pfSense resolver
dig @192.168.1.1 chat.openai.com +short
# Expected: 10.10.10.1 (your DNSBL VIP sinkhole address)

dig @192.168.1.1 claude.ai +short
# Expected: 10.10.10.1

dig @192.168.1.1 midjourney.com +short
# Expected: 10.10.10.1

# Verify a non-AI domain resolves normally
dig @192.168.1.1 google.com +short
# Expected: normal Google IP (e.g., 142.250.x.x)

# Check pfBlockerNG DNSBL statistics
pfctl -t pfB_DNSBLIP -T show | wc -l
# Shows the number of IPs in the DNSBL sinkhole table

#!/bin/sh
# Resolve AI tool domains to IP addresses for pfBlockerNG IP blocking
# Creates a pfBlockerNG-compatible IPv4 list

DOMAIN_LIST="/var/db/pfblockerng/ai_tools_domains.txt"
IP_OUTPUT="/var/db/pfblockerng/ai_tools_ips.txt"
TEMP_FILE="/tmp/ai_resolve_tmp.txt"

# Download latest domain list
fetch -q -o "$DOMAIN_LIST" \
  "https://feeds.aitoolsblocklist.com/v1/dnsbl/domains.txt"

# Resolve each domain and collect unique IPs
> "$TEMP_FILE"
while read domain; do
  case "$domain" in ""|"#"*) continue ;; esac
  drill "$domain" A 2>/dev/null | \
    awk '/IN[[:space:]]A[[:space:]]/ {print $NF}' >> "$TEMP_FILE"
done < "$DOMAIN_LIST"

# Deduplicate, remove RFC1918 and shared hosting IPs
sort -u "$TEMP_FILE" | grep -vE '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)' \
  > "$IP_OUTPUT"

IP_COUNT=$(wc -l < "$IP_OUTPUT")
echo "Resolved ${IP_COUNT} unique IPs from AI tool domains"

# Reload pfBlockerNG to apply the updated IP list
/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php update 2&>1

#!/bin/sh
# Custom update script for the AI Tools Blocklist on pfSense
# Includes download validation, backup, and logging
# Schedule via cron: 0 3 * * * /root/update_ai_blocklist.sh

FEED_URL="https://feeds.aitoolsblocklist.com/v1/dnsbl/domains.txt"
DEST="/var/db/pfblockerng/dnsbl/ai_tools_domains.txt"
BACKUP="/var/db/pfblockerng/dnsbl/ai_tools_domains.bak"
LOG="/var/log/ai_blocklist_update.log"
MIN_DOMAINS=5000

TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S")

# Backup current list before updating
if [ -f "$DEST" ]; then
  cp "$DEST" "$BACKUP"
fi

# Download new list
fetch -q -o "$DEST.tmp" "$FEED_URL"
RESULT=$?

if [ "$RESULT" -ne 0 ]; then
  echo "[$TIMESTAMP] ERROR: Download failed (exit code $RESULT)" >> "$LOG"
  exit 1
fi

# Validate download - check minimum domain count
NEW_COUNT=$(grep -cvE '^(#|$)' "$DEST.tmp")
if [ "$NEW_COUNT" -lt "$MIN_DOMAINS" ]; then
  echo "[$TIMESTAMP] ERROR: Only $NEW_COUNT domains (min: $MIN_DOMAINS), keeping previous" >> "$LOG"
  rm -f "$DEST.tmp"
  exit 1
fi

# Deploy the new list
mv "$DEST.tmp" "$DEST"
echo "[$TIMESTAMP] SUCCESS: Updated to $NEW_COUNT domains" >> "$LOG"

# Force pfBlockerNG to reload DNSBL
/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php update 2>&1 >> "$LOG"

echo "[$TIMESTAMP] pfBlockerNG DNSBL reload complete" >> "$LOG"