REGEX blocking

Cool_Corona

@gertjan https://www.independent.co.uk/tech/whatsapp-down-not-working-status-b2209835.html?utm_content=Echobox&utm_medium=Social&utm_campaign=Main&utm_source=Twitter#Echobox=1666682232

Gertjan

@cool_corona Twitter ?
Also on CNN, MSNBC, Foxnews, BBC, all major (local) french tv news, and soon many Youtube "facebook did it again" videos.

jc1976

@gertjan so i guess a really slick feature to pfblockerng-devel would be the ability to add regex lists from pihole, like how suricata can use snort lists.

pfsjap

At the bottom of Python Regex List section reads "Changes to this option will require a Force Update to take effect" but actually Reload is required.

Forumis

This post is deleted!

Antibiotic

@Uglybrian Is it still working?

Antibiotic

@Gertjan Hello, are you still using regex blocking in pfblockerng?

Uglybrian

Yes Antibotic, its still working and I am still using the same list. so far so good.

Gertjan

@Antibiotic

yes :

It's pretty powerful.
Be aware : regex !

Read it like this : if any of the text in the lines (the requested host name) matches the regex list, the request gets blocked.

Antibiotic

@Gertjan Can you please post your regex in text format? I will copy

Gertjan

@Antibiotic

^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-] #test RGX1
^(.+[_.-])?telemetry[_.-] #test RGX2
^adim(age|g)s?[0-9]*[_.-] #test RGX4
^adtrack(er|ing)?[0-9]*[_.-] #test RGX5
^advert(s|is(ing|ements?))?[0-9]*[_.-] #test RGX6
^aff(iliat(es?|ion))?[_.-] #test RGX7
^analytics?[_.-] #test RGX8
^banners?[_.-] #test RGX9
^beacons?[0-9]*[_.-] #test RGX10
^count(ers?)?[0-9]*[_.-] #test RGX11
^pixels?[-.] #test RGX12
^stat(s|istics)?[0-9]*[_.-] #test RGX13
^stat(s|istics)?[0-9]*[_.-] #test RGX14

Antibiotic

@Gertjan Thank you

Gertjan

@Antibiotic

Keep an eye on it :

Antibiotic

@Gertjan Are you block for incoming?
What the reason, firewall block itself all in?

Gertjan

@Antibiotic said in REGEX blocking:

Are you block for incoming?

My LANs of course.

That's where the original DNS requests come from, and I want to 'disable' some of them like "incoming.telemetry.mozilla.org" (probably from my browser).
I don't know what beacons.gtv2.com is, the request came from my captive portal.

@Antibiotic said in REGEX blocking:

What the reason, firewall block itself all in?

The regex has nothing to with the/a firewall.
A DNS request came in "what is the A of incoming.telemetry.mozilla.org ?"
The regex filter found it, so pfBlockerng told unbound to tell the LAN client : it's 0.0.0.0.
When the LAN clients receives 0.0.0.0 it can't connect to "incoming.telemetry.mozilla.org" because it has no valid IP to connect to.
This is how DNSBL works.

I don't need (want) a firewall that blocks "Internet" IPs. My LAN firewall is wide open - the portal a bit less, though.

Antibiotic

@Gertjan are you using firefox?

Gertjan

@Antibiotic

The better part of my live, and for the moment, yeah....

Antibiotic

@Gertjan Idk, which platform you are using for firefox, linux or freebsd, but under windows firefox is disaster

Gertjan

@Antibiotic said in REGEX blocking:

but under windows firefox is disaster

Works fine for me, I only have Microsoft GUIs here.
Other OSs here have no GUI, only command line acces, and lynx if needed.

Antibiotic

@Gertjan Oki))I tried a few times , but on my laptop firefox tabs are a huge, actually all a huge . Do not like it at all and native edge better integrate to windows security options.