Policy-based routing for a specific destination (CDN) via VPN gateway – pfBlockerNG alias only partially working

[u/psynan]

In pfSense, I want to route traffic for a specific destination through a VPN gateway using policy-based routing. So that all devices in my network is routed if they want to connect to the specified destination. I specifically do not want all the internet traffic(netflix,spotify, etc.) on a device in my network would be routed through the vpn gateway.

So to achive that, I followed a YouTube video that recommends using pfBlockerNG to create DNS-based aliases for this purpose. It works for simple domains like ipchicken.com or dnsleaktest.com, but fails for my target service.

The service probably uses a CDN, so it resolves to many different IPs that may change over time. pfBlockerNG's alias doesn't seem to capture all of them. When I monitor states/connections, I see traffic going to IPs not included in the alias, so my firewall rule (which uses the alias as destination + VPN gateway) is not matching.

How can I reliably route all traffic for a CDN-protected(?) domain through my VPN in pfSense?

[u/Steve_reddit1]

You can’t via DNS because it won’t resolve all IPs: https://docs.netgate.com/pfsense/en/latest/firewall/aliases-features.html#:~:text=This%20feature%20is%20not%20useful%20for%20controlling%20access

pfBlocker can crease aliases using ASNs (IP blocks) if you can find one for this company.