@tagit446: I was getting the same errors with those list so I gave up. I did however get this one to work: https://raw.githubusercontent.com/CHEF-KOCH/NSABlocklist/master/HOSTS Thank you Tagit446…that worked.

I work with firewalls all day long and every other major brand out there (CheckPoint, Fortinet, Palo Alto) implements geo-blocking as a separate process outside of firewall rules, otherwise you get the things I complained about. But with pfSense, I guess I'll have to re-order and manipulate things to get what I want.  Obviously it works fine with blacklisting, but with whitelisting, allowing North America does nothing to block Russia. Then change it to a rule that blocks everything except your work IP. I didn't need to do that before I implemented GeoIP blocking.  It was already assumed by my original rule.  Now I need to add a bunch more.

That's one way, the nice way.  Another way is to simply put in a firewall block on port 53 except for pfSense and let your kids figure out why they can't get anywhere.

Try going into pfBlocker - updates - force reload both IP & DNSBL.

Can you access those lists from a client on the network?

You'll need to look at all the domains the page loads and see what they are. The comments are blocked on mine too, and I took a quick look and saw requests go from one article to subdomains of:- optimizely.com googleapis.com googletagservices.com twitter.com tiqcdn.com typekit.net addthis.net That list may not be exhaustive, but if you use the debug tools of your browser (I happen to be using MS Edge for this, use the F12 dev tools -> Network, then open the page) you should be able to see what sites requests are going to and can work through them one by one.

I have mailed BBCAN177 and asked about whitelisting list domains automatically and his response was whitelisting them would be unexpected behaviour for end users and I agree that it would be a bad thing. He did suggest that theoretically as the whitelisting can now be done instantly that code to temporarily whitelist domains and then revert them afterwards could be possible at some point in the future. Without knowledge of what blocking you have in place it's difficult to say what you could do reliably.  If you're ok with web-based proxies then that is one option.  That way pfBlocker would only see the request to the proxy domain, not the blocked domain which is either part of the URL or encrypted/obfuscated entirely. For example I put a list I use into one proxy site and got this URL back… https ://www.sitenameredacted.com/browse.php/jFq3YZ2gvRvXF3vBTEqKxhzEqhrhb9TNwIVIO6BD649KAQxY7W0fRByEs2TrB8Z5uRyDQTRJxht5weSttltrT64_3D/b29/fnorefer/ ..so long as the proxy site is not blocked then your lists will be accessible to pfBlocker.  Obviously you have to trust that proxy not to MITM your traffic or otherwise break stuff, which is why I've not included the name here.

@BBcan177: I don't think this has anything to do with pfBlockerNG….  Try to post in the "Installation/Upgrade" forum and I'm sure someone will be able to help there... The latest version should be fine now for DNSBL and 2.4... There is a PR which will increase the memory for PHP which seems to fix the issues for some... This was merged today... https://github.com/pfsense/pfsense/pull/3881 Hope this helps! It's work thanks :)

For now, the only automatic whitelisting option is with TOP1M. To automate DNSBL whitelisting, more code would need to be added. So for now, you will have to update the DNS Whitelist when the ebates-cash-back-shopping.txt list change.

Thanks, Grimson, I missed that on the first page. I will give that a try.

Not familiar with your hardware but if your Asus router can handle VLANs in AP mode you should be good. I am sure others have more experience with this…its likely good for a single WLAN. You have a Managed switch which can handle VLANs (although some have expressed concern with TPlink...I am sure it is fine!) As mentioned it looks like your pfbox works...nice RAM(32G)! The Unifi AP is well regarded and super easy to setup for VLANs. Again find out if your ASUS supports VLANs before spending the $100. Not a huge value in GeoBlocking I also share the same concern...TOR, VPN, hijacked PC are likely the hackers route. I only suggested getting IPv4 and GeoBlocking as a way to get started with pfBlockerNG. The real prize, I found is with DNSBL in the blocking of ads but it requires you to make sure your DNS Resolver is set specifically. Make sure you can navigate to the DNSBL Virtual IP...if not it won't work. Also go to the alerts tab and see if you get an alert after navigating to the DNSBL Virtual IP....

OK, I think I have it.  I had to disable all of the other GeoIP rules and only chose the two United States rules.  I then did a "Deny Inbound", and then chose the "Inverse" in the advanced options.  This seems to be working now.

This might be a stupid question, but is your DNSBL working? I see this behavior since DNSBL doesn't work for me because I'm also using OpenVPN. So far I can't find a way to make them work together in a secure way.

So you are just using the default DNS servers? Aren't those your ISP's DNS servers? That means you'll be leaking DNS, which defeats the purpose of using the VPN. I'm still trying to solve this issue too, but that doesn't seem like the way to do it.

I checked the DNS at whatsmydns.net and it came back with all green check marks.  I assume that is good.  As far as the rest of the thread, there were a lot of commands that went over my head. I have not seen the problem since that one incident.  It so happened when this incident happened, the finance.yahoo.com site was real sluggish and I would get a lot of connection errors.  So maybe yahoo was under attacked? I did a full scan of my laptop with Windows defender and it came back clean.

You have to inspect the System Logs, Resolver Logs and pfblockerng.log to pinpoint the issue. Depending on your system, Unbound reload can take minutes to complete, during that time no DNS resolution is available. Check Services / DNS Resolver / General Settings DHCP Registration should be uncheck as every DHCP lease will reload Unbound.

…looking back at comments, I found out this domain blocked as well, somewhat similar config... (192.168.0.1 being my VIP) grep steepto.com /var/db/pfblockerng/dnsbl/.txt /var/db/pfblockerng/dnsblorig/.orig /var/unbound/pfb_dnsbl.conf /usr/local/pkg/pfblockerng/dnsbl_tld /var/db/pfblockerng/dnsbl/easy_list.txt:local-data: "steepto.com 60 IN A 192.168.0.1" /var/db/pfblockerng/dnsblorig/ad_servers.orig:127.0.0.1 imgg.steepto.com /var/db/pfblockerng/dnsblorig/easy_list.orig:||steepto.com^$third-party /var/db/pfblockerng/dnsblorig/easylist.orig:||steepto.com^$third-party /var/db/pfblockerng/dnsblorig/hpHosts.orig:127.0.0.1 imgg.steepto.com /var/db/pfblockerng/dnsblorig/hpHosts_ads.orig:127.0.0.1 imgg.steepto.com /var/unbound/pfb_dnsbl.conf:local-zone: "steepto.com" redirect local-data: "steepto.com 60 IN A 192.168.0.1"

Try to increase the Firewall Maximum Table Entries  under  System / Advanced / Firewall & NAT

I never had luck with that list…try doing a "Force reload" with the list removed. Maybe a reinstall of package(making sure you "checked" the box that says "don't keep block or settings".

Thanks for the update Rick, hopefully BBcan will provide more info on the feed choices. Either way it certainly looks like the next big release has some really exciting stuff in it.