REGEX blocking

Antibiotic

@Gertjan Hello, are you still using regex blocking in pfblockerng?

Uglybrian

Yes Antibotic, its still working and I am still using the same list. so far so good.

Gertjan

yes :

It's pretty powerful.
Be aware : regex !

Read it like this : if any of the text in the lines (the requested host name) matches the regex list, the request gets blocked.

Antibiotic

@Gertjan Can you please post your regex in text format? I will copy

Gertjan

@Antibiotic

^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-] #test RGX1
^(.+[_.-])?telemetry[_.-] #test RGX2
^adim(age|g)s?[0-9]*[_.-] #test RGX4
^adtrack(er|ing)?[0-9]*[_.-] #test RGX5
^advert(s|is(ing|ements?))?[0-9]*[_.-] #test RGX6
^aff(iliat(es?|ion))?[_.-] #test RGX7
^analytics?[_.-] #test RGX8
^banners?[_.-] #test RGX9
^beacons?[0-9]*[_.-] #test RGX10
^count(ers?)?[0-9]*[_.-] #test RGX11
^pixels?[-.] #test RGX12
^stat(s|istics)?[0-9]*[_.-] #test RGX13
^stat(s|istics)?[0-9]*[_.-] #test RGX14

Antibiotic

@Gertjan Thank you

Gertjan

@Antibiotic

Keep an eye on it :

Antibiotic

@Gertjan Are you block for incoming?
What the reason, firewall block itself all in?

Gertjan

@Antibiotic said in REGEX blocking:

Are you block for incoming?

My LANs of course.

That's where the original DNS requests come from, and I want to 'disable' some of them like "incoming.telemetry.mozilla.org" (probably from my browser).
I don't know what beacons.gtv2.com is, the request came from my captive portal.

@Antibiotic said in REGEX blocking:

What the reason, firewall block itself all in?

The regex has nothing to with the/a firewall.
A DNS request came in "what is the A of incoming.telemetry.mozilla.org ?"
The regex filter found it, so pfBlockerng told unbound to tell the LAN client : it's 0.0.0.0.
When the LAN clients receives 0.0.0.0 it can't connect to "incoming.telemetry.mozilla.org" because it has no valid IP to connect to.
This is how DNSBL works.

I don't need (want) a firewall that blocks "Internet" IPs. My LAN firewall is wide open - the portal a bit less, though.

Antibiotic

@Gertjan are you using firefox?

Gertjan

@Antibiotic

The better part of my live, and for the moment, yeah....

Antibiotic

@Gertjan Idk, which platform you are using for firefox, linux or freebsd, but under windows firefox is disaster

Gertjan

@Antibiotic said in REGEX blocking:

but under windows firefox is disaster

Works fine for me, I only have Microsoft GUIs here.
Other OSs here have no GUI, only command line acces, and lynx if needed.

Antibiotic

@Gertjan Oki))I tried a few times , but on my laptop firefox tabs are a huge, actually all a huge . Do not like it at all and native edge better integrate to windows security options.

Gertjan

@Antibiotic
I have huge screens ^^

Antibiotic

@Gertjan What kind of dimension?

Gertjan

@Antibiotic 72 cm diagonal

Antibiotic

@Gertjan Is it not a PC screen right? It is TV screen

LarryFahnoe

@Gertjan said in REGEX blocking:

^stat(s|istics)?[0-9][_.-] #test RGX13
^stat(s|istics)?[0-9][_.-] #test RGX14

While I am conversant with regular expressions, I am puzzled by what appears to be duplicate tests?

--Larry

Antibiotic

@LarryFahnoe I have the same question))) Is it type error?