@bhjitsense said in Captive portal taking up to a minute to appear: Okay.... so what are you saying? I can't use forwarding? I'm not saying anything ^^ [image: 1572334305967-b182a6e4-21ad-4174-a438-5705b20286e0-image.png] I think that that text says : use Unbound in resolver mode .... but I might be wrong. DNSBL works fine for me. Btw : by default, unbound, the resolver uses the 'core' Internet DNS facilities and this should work as soon as you start pfSense for the first time and activate a WAN connection. If that doesn't work for you, your connection is not good. I'm not saying you can't use the Forward mode, but I suggest that you test with a (non modified) basic setup. When it works, you change things step by step. As soon as things stop to work, you will know what to undo .

Can't tell anymore. I completely removed pfBlockerNG. I'll start from scratch when I find time. Thank you.

Moved your question to the pfblocker section.. Not sure why this should be a question though... You create an alias, then use it in your rules to either allow or block access to the ports you have open.. Its not something you need a guide for, its just a basic firewall rule.. Block or Allow. I have plex allowed in my rules. I have a list setup that contains US, and Honduras, it also contains known IPs used by plex to test if server is available remotely.. And also included is IPs that test from 3rd party if the port is open - so I can get notified if not available. These are the only IPs that are allowed to use the rule, they are the source. Above that rule I have a different list (bad actors) because they might be from the US, or Honduras.. So blocked them before they can get to the allow list. Remember rules are evaluated top down, first rule to trigger wins.. No other rules are evaluated.. So if create a rule that top that blocks who you want to block, then they would never get to your allowed rules.. You limit your allow rules with a source limit to only allow say US, even though they are not on a specific bad list.. They are not US so they are not allowed. So they will drop through to the default deny.

@rtkluttz said in pfblockerng not working for all ip's in the aliases: 45.82.152.0/23 What about pfB_Europe_v4? Do you have anything in there in your WAN Rules?

Hi, No way. Just keep the default ports (8081 and 8083). Same thing for the Virtual IP default 10.10.10. - except if this IP falls into one of your LAN's or other networks. Removing the '53' from unbound and be ready to 'break everything' ;)

@PaulMon123 said in DNSBL deny all except whitelisted: All I want to do is to block any DNS requests (except ones to specific services) to prevent data leaks using DNS tunneling. It seems that most of what I shared geared to accomplishing this, especially when an IPS/IDS is added to the mix. I take it others has physical access to the "secure environment" or it's a server. This data leaks using DNS tunneling is a hot topic, a potential headache, and I am hoping a package with DNS quarantine coming soon.

@tman222 Well, I think it would be pfSense that provided pfBlockerNG widget the packet info.

Make sure you are using pfBlockerNG-devel which is much improved over the release version.

OK thanks, I think I get it now. The ' IPv4 Suppression list' is a white list ? (clicking the '+' in the deny list) Just for clarity, I can see in /var/db/pfblockerng/deny the lists [image: 1571251233696-2019-10-16-19_38_24-deny-xcp-ng-dq77kb-winscp.jpg] and under pfBlockerNG > IP > IPv4 I can see the corresponding lists created from 'feeds' [image: 1571251549882-2019-10-16-19_43_51-pfsense.localdomain-firewall_-pfblockerng_-ip_-ipv4.jpg] But I still don't get where the pfB_DNSBLIP_v4 (DNSBLIP_v4.txt) is created from

@William-Barni said in pfSense pfBlocker and mobile phones apps: @pfSenseTest Hum... ok. Thanks for the answer. I need to learn a ton of new tools and to develop rules for them, understand their behavior, just to block youtube. YouTube does not want to be blocked ... . So they make sure it is somewhere between difficult and impossible to block their traffic. Google has gotta have that ad revenue you know ... .

@iTestAndroid said in i7 4GHz CPU + 128GB RAM, still slow when I load a large list in DNSBL: @tman222 Yes. Actually, with pfBlocker and list of around 400-500k, it works flawlessly, its super fast and blocks most ads. When I turn on all lists I have, the total count adds up to ~1.4M and that's when things start to go south. Otherwise both DNS resolver and pfBlocker works fine. So when 1.4M entry is added to pfBlocker, things get slow and some DNS requests hangs. DNS Query Forwarding -> Enabled Use SSL/TLS for outgoing DNS queries -> Enabled Custom Options: server: forward-zone: name: "." forward-ssl-upstream: yes forward-addr: 1.1.1.1@853 forward-addr: 1.0.0.1@853 forward-addr: 9.9.9.9@853 server:include: /var/unbound/pfb_dnsbl.*conf These are the DNS server addresses listed there 1.1.1.1 1.0.0.1 9.9.9.9 I have gigabit internet, RTT is acceptable: ping cloudflare.net PING cloudflare.net (104.16.208.90) 56(84) bytes of data. 64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=1 ttl=57 time=2.73 ms 64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=2 ttl=57 time=2.60 ms 64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=3 ttl=57 time=2.43 ms 64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=4 ttl=57 time=2.37 ms 64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=5 ttl=57 time=2.53 ms @provels Yes, I have both enabled and each of them have size of 4096MB (4GB) Hi @iTestAndroid - do you see any difference if you take out 9.9.9.9 and just use Cloudflare's 1.1.1.1 and 1.0.0.1 servers? Do you have DNSSEC checked or unchecked? I'm still not quite convinced this is a pfBlockerNG issue -- 1.4M is really not that big and you have got some pretty powerful hardware too. Hope this helps.

@RonpfS said in Embeeded youtube clips won't work. Firefox detected a potential security threat and did not continue to www.youtube-nocookie.com: Remove your Whitelisting of the domain, Force Reload All, then whitelist it using the Alert Tabs to see what pfblockerNG will whitelist. www.youtube-nocookie.com is a CNAME : youtube-ui.l.google.com that need to be whitelisted as well. Thank you now it works! It added the following to the whitelist: .www.youtube-nocookie.com .youtube-ui.l.google.com # CNAME for (www.youtube-nocookie.com)

pfBlockerNG-devel already has ASN support in the IP State setting. Also Radb registry isn't very accurate. The package is using bppview.io instead. https://api.bgpview.io/ip/<IP>

Your local device could have had the entry cached. Normally I will also disconnect my device from the network, and back on to force the device to flush local cache. Sometime a /flushdns on windows helps too.

@NasKar said in Access to my VPN and Plex Server while abroad: I would like to access my VPN to make changes to my firewall just in case and my Plex Server. Trust me, it's not a good idea to change your firewall through VPN. Make the changes before you go.

@Koent said in curl error 7 on all downloads: analyse the FW daily Me neither. But I do check 'basic' operations when changing 'major' things like interfaces that deal with outgoing traffic. In this case : because the NIC called WAN (actually : PPPoE) now faces the Internet directly. Before, pfSense was probably hidden behind another router (no standard, but normal for a DHCP client mode). Now, it's time to re check and double check your WAN rules : typically none should be there exception NAT rules.