--- title: Configuring a list of devices exempt from access control in pfSense® description: Additional configuration for pfSense and Lumiun DNS, aimed at keeping certain devices outside the control of Lumiun DNS, without filters or blocks. --- [Skip to content](https://help.lumiun.com/en-us/hc/configurando-no-pfsense-uma-lista-de-dispositivos-isentos-do-controle-de-acesso#main-content) - [English - United States](https://help.lumiun.com/en-us/hc/configurando-no-pfsense-uma-lista-de-dispositivos-isentos-do-controle-de-acesso) - [Português - Brasil](https://help.lumiun.com/pt-br/hc/configurando-no-pfsense-uma-lista-de-dispositivos-isentos-do-controle-de-acesso) English - United States Show submenu for translations [Request Support](https://help.lumiun.com/en-us/hc/kb-tickets/new?hsLang=en-us) [My Tickets](https://tickets.lumiun.com/tickets?hsLang=en-us) [![logo lumiundns](https://help.lumiun.com/hubfs/lumiundns-x-color.svg)](https://help.lumiun.com/?hsLang=en-us) Open main navigation Close main navigation - - [English - United States](https://help.lumiun.com/en-us/hc/configurando-no-pfsense-uma-lista-de-dispositivos-isentos-do-controle-de-acesso) - [Português - Brasil](https://help.lumiun.com/pt-br/hc/configurando-no-pfsense-uma-lista-de-dispositivos-isentos-do-controle-de-acesso) English - United States Show submenu for translations - [Request Support](https://help.lumiun.com/en-us/hc/kb-tickets/new) - [My Tickets](https://tickets.lumiun.com/tickets) - [Go to Dashboard](https://dns.lumiun.com/) [Go to Dashboard](https://dns.lumiun.com/) How can we help? - There are no suggestions because the search field is empty. 1. [Lumiun DNS Help Center](https://help.lumiun.com/en-us/hc?hsLang=en-us) 2. [FAQ](https://help.lumiun.com/en-us/hc/faq?hsLang=en-us) 3. [pfSense](https://help.lumiun.com/en-us/hc/faq?hsLang=en-us#pfsense) # Configuring a list of devices exempt from access control in pfSense® ## This article explains how to create a NAT port forwarding rule in pfSense® to redirect DNS queries from listed devices to a DNS server of your choice, whether internal or external. In the context of creating a list of devices exempt from Lumiun DNS access control, this rule is intended to redirect DNS queries to other servers, rather than directing them to Lumiun DNS servers, as is done with other controlled devices. In this article, we will address two scenarios: [With Internal DNS Server](https://help.lumiun.com/en-us/hc/configurando-no-pfsense-uma-lista-de-dispositivos-isentos-do-controle-de-acesso#with-ad) and [Without Internal DNS Server](https://help.lumiun.com/en-us/hc/configurando-no-pfsense-uma-lista-de-dispositivos-isentos-do-controle-de-acesso#without-ad). **Important**: Before making this configuration, ensure that your pfSense® DNS service is working. To test it, use a command such as `nslookup` `google.com` `192.168.0.1` from any computer on your network, replacing 192.168.0.1 with your pfSense® IP address. **Note:** Ensure that your pfSense® receives DNS queries only from your local network. If it is exposed to the internet, configure the firewall to allow access to port 53 (tcp and udp) only from the local network. ### With internal DNS server 1. #### **Enable automatic reflection NAT** 1. Go to the **System** → **Advanced** → **Firewall & NAT** menu. 2. Enable the **Enable automatic outbound NAT for Reflection **option. 3. Save the configuration by clicking the **Save button**. 2. #### **Prevent filtering of queries originating from your internal domain's DNS server** 1. Go to the **Firewall** → **NAT** menu and stay on the **Port Forwarding** tab. 2. Click the **Add** button. 3. Fill in the details: • **Interface**: LAN **• Protocol**: TCP/UDP • Click the **Display Advanced** button in the Source section. **• Source - Type:** Address or alias **• Source - Address**: *internal domain DNS server IP (AD)* **• Destination - Type**: Any **• Destination port range - From port**: DNS **• Destination port range - To port**: DNS **• Redirect target IP - Type**: Address or Alias **• Redirect target IP - Address**: `8.8.8.8` **• Redirect target port - Port**: DNS 4. Save the configuration by clicking the **Save button** and confirm by clicking **Apply Changes**. 3. #### **Configure conditional DNS forwarding based on the internal domain in the pfSense® DNS service** 1. Go to the **Services** → **DNS Forwarder** menu. 2. Further down the page, in the **Domain overrides** section, click the **Add** button. 3. Fill in the details: **• Domain**: *your internal network domain* **• IP Address**: *IP address of the internal domain DNS server (AD)* 4. Save the configuration by clicking the **Save** button. 4. #### **Create the list of exceptions (devices exempt from filtering)** 1. Go to the **Firewall** → **Aliases** menu 2. Click on **Add** 3. Fill in the details: **• Name** = `unfiltered_devices` or whatever name you prefer **• Type** = Host(s) **• IP** = IP of a device that will not have controlled DNS traffic• To add more IP addresses, click the **Add Hosts** button below. 4. Save the configuration by clicking the **Save button** and confirm by clicking **Apply Changes**. 1. #### **Create the NAT rule to prevent DNS filtering of exempt devices** 1. Go to the **Firewall** → **NAT** menu and stay on the **Port Forwarding** tab. 2. Click the **Add** button. 3. Fill in the details: **• Interface**: LAN **• Protocol**: TCP/UDP • Click the **Display Advanced** button in the Source section. **• Source - Type**: Address or Alias **• Source - Address**: `unfiltered_devices` **• Destination - Type**: This firewall (Self) • **Destination port range - From port**: DNS • **Destination port range - To port**: DNS • **Redirect target IP - Type**: Address or Alias • **Redirect target IP - Address**: *internal domain DNS server IP (AD) •* **Redirect target port - Port**: DNS 4. Save the configuration by clicking the **Save button** and confirm by clicking **Apply Changes**. That's it! Setup complete. --- ### Without Internal DNS Server 1. #### **Create the list of exceptions (devices exempt from filtering)** 1. Go to the **Firewall** → **Aliases** menu 2. Click on **Add** 3. Fill in the details: **• Name** = `unfiltered_devices` or whatever name you prefer **• Type** = Host(s) **• IP** = IP of a device that will not have controlled DNS traffic• To add more IP addresses, click the **Add Hosts** button below. 4. Save the configuration by clicking the **Save button** and confirm by clicking **Apply Changes**. 2. #### **Create the NAT rule to prevent DNS filtering of exempt devices** 1. Go to the **Firewall** → **Aliases** menu 2. Click on **Add** 3. Fill in the details: **• Interface**: LAN **• Protocol**: TCP/UDP • Click the **Display Advanced** button in the Source section. • **Source - Type**: Address or Alias **• Source - Address**: `unfiltered_devices` **• Destination - Type**: Any **• Destination port range - From port**: DNS **• Destination port range - To port**: DNS • **Redirect target IP - Type**: Address or Alias **• Redirect target IP - Address**: `8.8.8.8` **• Redirect target port - Port**: DNS 4. Save the configuration by clicking the **Save button** and confirm by clicking **Apply Changes**. That's it! Setup complete. - [Integrations](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#main-content) - [Routers](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#routers) - [Firewalls](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#firewalls) - [Servers](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#servers) - [Computers](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#computers) - [Smartphones](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#smartphones) - [Browser](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#browser) - [General](https://help.lumiun.com/en-us/hc/integrations?hsLang=en-us#general) - [Policies and Filters](https://help.lumiun.com/en-us/hc/policies-and-filters?hsLang=en-us) - [Networks and Sites](https://help.lumiun.com/en-us/hc/networks-and-sites?hsLang=en-us) - [Reports](https://help.lumiun.com/en-us/hc/reports?hsLang=en-us) - [Your Account](https://help.lumiun.com/en-us/hc/your-account?hsLang=en-us#main-content) - [Plans and Billing](https://help.lumiun.com/en-us/hc/your-account?hsLang=en-us#plans-and-billing) - [Partners](https://help.lumiun.com/en-us/hc/partners?hsLang=en-us) - [FAQ](https://help.lumiun.com/en-us/hc/faq?hsLang=en-us#main-content) - [General](https://help.lumiun.com/en-us/hc/faq?hsLang=en-us#general) - [pfSense](https://help.lumiun.com/en-us/hc/faq?hsLang=en-us#pfsense) [![logo lumiun dns](https://help.lumiun.com/hubfs/lumiun-dns.svg "logo lumiun dns")](https://help2.lumiun.com/?hsLang=en-us) Copyright © 2026, Lumiun