PfBlockerNG
-
Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search
did not bring up anything.Its one time use. you may delete it after you were done.
-
Was finally able to do what you suggested. Got rid of those IBlock lists ….. No more reboot issues.
IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)
Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search did not bring up anything.
I am contemplating adding a feature to allow auto updating the Lists/Feeds for a future release. I am finalizing v2.0 which has DNSBL domain name blocking via Unbound Resolver and hope to get that released soon…
Especially BBcan177, without whom this would not be possible.
Thank You!
-
Was finally able to do what you suggested. Got rid of those IBlock lists ….. No more reboot issues.
IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)
I remember a long time ago I managed to break several boxes that way during the beta period, with a certain list :).
I must say pfblockerng is still my favorite package. Maintained and pretty much bug free. Now I should finally start testing the DNSBL..
-
Problem solved by BBcan177 with a minor edit to the following file:
/usr/local/www/pfblockerng/pfblockerng.php
Line 192
if (file_exists($local_file)) {
// Determine if URL is Remote or Local
if ($host['host'] == "127.0.0.1" || $host['host'] == $pfb['iplocal'] || empty($host['host'])) {
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));
} else {Original:
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));NEW:
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($list_url));Thanks!
To be very clear, change the variable $local_file to $list_url
I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list.
Once I regain my IP list I can see my updates.Any ideas?
-
I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list. Once I regain my IP list I can see my updates.
Hi serialdie,
How many pfBNG Aliases did you configure? I think you hit another bug that I haven't merged into the release… If you only have one, create a second Alias and use a list like Spamhaus drop. I think creating a second alias will fix this issue for you... (2 bugs for you in one day :) )
https://www.spamhaus.org/drop/drop.txt
-
I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list. Once I regain my IP list I can see my updates.
Hi serialdie,
How many pfBNG Aliases did you configure? I think you hit another bug that I haven't merged into the release… If you only have one, create a second Alias and use a list like Spamhaus drop. I think creating a second alias will fix this issue for you... (2 bugs for you in one day :) )
https://www.spamhaus.org/drop/drop.txt
HAHAHA! I get a cookie? :P
Yes I do have one list setup only so looks like you nailed it with this one.
I will try that and report back.Thanks!
-
I have asked this before but didn't get a answer
is there is a possibility to use PFblockerNG to block porns like proxy server ? -
is there is a possibility to use PFblockerNG to block porns like proxy server ?
Once pfBlockerNG 2.0 is ready it will have DNSBL available which could be used to block porn. Ive had good success using the DansGuardian formatted lists from http://www.squidblacklist.org
 -
pfBlockerNG v1.10 - Pull Request has been posted -
Changelog:
https://github.com/pfsense/pfsense-packages/pull/1033 -
IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)
Unfortunately did not have the time to test, sorry.
I am contemplating adding a feature to allow auto updating the Lists/Feeds for a future release. I am finalizing v2.0 which has DNSBL domain name blocking via Unbound Resolver and hope to get that released soon…
Looking forward to try this.
Thank You
-
It seems logical to have detail allow rules followed by pfBlockerNG block rules before allowing destination ANY rules, did I miss an option to have it work in this order?
If I am reading your request correctly, you are asking to sort the pfSense (Permit/Match) rules to be placed before and after the pfBNG rules… I would think it would be rather cumbersome and not sure if others would use it? For more complex setups, that is where the "Alias" type Rules are better utilized. If I have read this incorrectly, please let me know.
Yes, you are reading this correctly. Figured out how to get floating rules working the way I needed then changed settings to pfBlockerNG block > pfSence Allow and it fixed my set .
Thanks
-
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
Tony -
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
TonyPfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.
-
pfBlockerNG v1.10 - Pull Request has been posted -
Changelog:
https://github.com/pfsense/pfsense-packages/pull/1033
**Pull request has been merged. Following this update, please execute a "Force Reload".Thanks!**
-
a small bug: After a pfBlockerNG upgrade, All the rules prior to original pfBlokerNG rules were put at the bottom in the floating rules page. I have to move them to the top.
-
@Music:
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
TonyPfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.
Not trying to block, want to allow any host for a domain :) I have been beta testing 2.0, at the moment have not seen any way to do via the GUI
Thanks
Tony -
If you are trying to suppress a domain, you can click the "+" icon in the Alerts Tab which will remove the domain instantly and not allow that domain to be added again. You can also add a domain to the "DNSBL" suppression list box but that will only take effect when the feeds are downloaded again or on a "Force Reload".
-
@Music:
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
TonyPfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.
Not trying to block, want to allow any host for a domain :) I have been beta testing 2.0, at the moment have not seen any way to do via the GUI
Thanks
TonyI found what I was looking for :) https://hackertarget.com/find-dns-host-records/ using the api can create a list of all the hosts for a domain and get a formated lists!
http://api.hackertarget.com/hostsearch/?q=ting.comFound two more useful tools for dns enumeration:
-
https://github.com/TheRook/subbrute
-
https://github.com/darkoperator/dnsrecon
-
-
I am currently blocking Asia and have hired a developer in India. How can I exclude his subnet and still have the rest of India blocked.
I have India( CTRL + CLICK to unselect countries) at the moment so he has access. -
@scott@hosiermail.com:
I am currently blocking Asia and have hired a developer in India. How can I exclude his subnet and still have the rest of India blocked.
I have India( CTRL + CLICK to unselect countries) at the moment so he has access.Just create a new floating rule and add his subnet as the source for incoming traffic for your WAN interface.
Tony
