Enter a domain below and we'll resolve its live IPs, generate a ready-to-paste pfSense Alias + Firewall rule, a DNS Resolver override, a pfBlockerNG feed, and the raw pfctl CLI commands. Works with any public domain.
facebook.comBest for a fixed-IP service. Creates a reusable IP alias and a rule that references it. Fast, deterministic, easy to audit.
...
...
Open the aliases page and add a new Host(s) alias with the IPs above.
Firewall › Aliases › IP › AddUse the Name from the alias code block above. Paste each IP on its own row. Each IP can have the domain as its description for audit logs.
Add a new rule on the LAN (or whichever inside interface your users are on) that references the alias.
Firewall › Rules › LAN › AddDrag the rule above your default allow-LAN rule so it gets evaluated first.
Click the orange Apply Changes banner at the top. Blocking is immediate for new connections.
Best for CDN-hosted services with rotating IPs. We sinkhole the domain to 0.0.0.0 so no matter which IP the CDN is using, clients can't resolve it.
...
Click Add to create a new override.
Host: the subdomain (leave blank for root). Domain: the main domain. IP: 0.0.0.0 (sinkhole). Description: Block <domain>.
Click Save, then Apply Changes. Flush client DNS cache (ipconfig /flushdns on Windows) to see the effect immediately.
Add a firewall rule that blocks DNS-over-HTTPS traffic (port 443 to known DoH resolvers) so clients can't bypass your DNS.
Enterprise-grade blocking with 50,000+ categorised domains (ads, malware, adult, social, gambling). Install pfBlockerNG from the package manager first.
...
Paste the content from the code block above into the Custom List text area.
Under List Action set to Unbound and save.
Fastest way to block an IP during an incident. Changes are ephemeral — lost on reboot unless baked into the ruleset. Great for on-call response.
...
Use the admin account with public-key auth. See our hardening guide Step 7.
The pfSense console menu; gives you a full FreeBSD shell.
Each command adds an IP to the blocked_ips table used by your alias.
Run pfctl -t blocked_ips -T show to confirm the IPs are in the table.
Changes are in-memory only. For permanent blocks, add to an alias in the WebGUI (Method 1) so they survive reboots.
Bulk domain blocking, scheduled rules (social media during work hours), per-user VLAN policies, and ongoing AMC — talk to our engineers.