• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG v2.0 w/DNSBL

Scheduled Pinned Locked Moved pfBlockerNG
1.1k Posts 192 Posters 1.7m Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • W
    wcrowder
    last edited by Nov 17, 2015, 11:08 PM

    ETA is as soon as the Dev's validate the package, package has been submitted… Yeah!!!!! :)

    https://github.com/pfsense/pfsense-packages/pull/1174

    1 Reply Last reply Reply Quote 0
    • T
      trinidadrancheria
      last edited by Nov 18, 2015, 1:22 AM

      @wcrowder:

      ETA is as soon as the Dev's validate the package, package has been submitted… Yeah!!!!! :)

      https://github.com/pfsense/pfsense-packages/pull/1174

      HOLY Poop!!! 23 changed files  with 8,591 additions and 5,267 deletions Total re-write? :D

      1 Reply Last reply Reply Quote 0
      • P
        Panja
        last edited by Nov 18, 2015, 8:20 AM

        Looking forward to this release!
        Keep up the good work mate. Awesome!  8)

        1 Reply Last reply Reply Quote 0
        • B
          BBcan177 Moderator
          last edited by Nov 19, 2015, 12:43 AM

          @mygeeknc:

          Great work sir! I'm looking forward to this release. Will there be any special instructions for upgrading?

          There should be no concerns in migrating to pfBNG v2.0 from the existing v1.10.

          pfSense has two types of DNS Services

          • DNS Forwarder

          • DNS Resolver

          If you plan on using the DNSBL feature, you will need to use the DNS Resolver for your DNS queries, the DNS Forwarder is not an option for DNSBL. Its probably best to ensure that the DNS Resolver is working before using DNSBL.

          The DNS Resolver is developed by NLnet Labs and is named 'Unbound'. It is a validating, recursive and caching DNS resolver.  https://www.unbound.net/index.html

          Some recommendations:

          • The DNS Resolver can also be used in 'Forwardering mode'; however its best to not use this 'Forwarding mode' and keep it in 'resolver mode' as this will query the Root DNS servers for the DNS queries instead of relying on an ISPs DNS etc…

          • If you use the 'DNS Resolver Forwarder mode', only configure 'DNSSEC' if the configured DNS servers support DNSSEC. The enabling of 'DNSSEC' to harden your DNS security is highly recommended.

          • Disable the two "DHCP registrations" checkboxes, unless you really require those options.

          Here is a good primer about the DNS Resolver (Unbound) https://calomel.org/unbound_dns.html

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 1
          • G
            gsiemon
            last edited by Nov 19, 2015, 4:28 AM

            @BBcan177:

            If you plan on using the DNSBL feature, you will need to use the DNS Resolver for your DNS queries, the DNS Forwarder is not an option for DNSBL. Its probably best to ensure that the

            I'm using the Bind package instead of Unbound.  Will V2.0 support that or is it hard coded to use only Unbound?  If it only supports Unbound, is it possible to support Bind in the future?

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by Nov 19, 2015, 8:26 AM

              @gsiemon:

              I'm using the Bind package instead of Unbound.  Will V2.0 support that

              No.

              1 Reply Last reply Reply Quote 0
              • F
                fraglord
                last edited by Nov 19, 2015, 6:56 PM

                You doin a great job! I appreciate it and many others do so as well. It is a leightweight alternative to squid when it comes to ad-blocking.
                I was allowed ot participate in the beta test program and the DNSBL feature is my favourite. Minor issues have been ironed out with the latest upgdates so it for sure feels ready to be released.

                pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

                1 Reply Last reply Reply Quote 0
                • A
                  a-a-ron
                  last edited by Nov 19, 2015, 7:10 PM

                  @fraglord:

                  You doin a great job! I appreciate it and many others do so as well. It is a leightweight alternative to squid when it comes to ad-blocking.
                  I was allowed ot participate in the beta test program and the DNSBL feature is my favourite. Minor issues have been ironed out with the latest upgdates so it for sure feels ready to be released.

                  Same here, it was a pleasure to help BBcan177. Hopefully I wasn't too much of a pain :D

                  1 Reply Last reply Reply Quote 0
                  • M
                    musicwizard
                    last edited by Nov 19, 2015, 10:49 PM

                    yup the beta one works really nice :)
                    Running my own DNS server and not from my ISP/google/ etc
                    so dnsbl is really nice on it also. Keep it up BBcan

                    1 Reply Last reply Reply Quote 0
                    • C
                      cmb
                      last edited by Nov 20, 2015, 10:18 AM

                      This has been merged, it'll be live in the package repo within at most ~15 minutes of the time of this post.

                      I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance. If there are issues, BBCan, please follow up with pull requests and I'll make sure one of us gets them merged promptly. Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

                      Thanks BBCan!

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by Nov 20, 2015, 10:53 AM

                        @cmb:

                        Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

                        Done, all works pretty well (as before). :D

                        1 Reply Last reply Reply Quote 0
                        • B
                          BBcan177 Moderator
                          last edited by Nov 20, 2015, 11:54 AM

                          @cmb:

                          This has been merged, it'll be live in the package repo within at most ~15 minutes of the time of this post.

                          I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance. If there are issues, BBCan, please follow up with pull requests and I'll make sure one of us gets them merged promptly. Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

                          Thanks BBCan!

                          Thanks Chris!  :)

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • H
                            hda
                            last edited by Nov 20, 2015, 1:06 PM Nov 20, 2015, 12:08 PM

                            Package update succeeded on the second reinstall from v1.10, after ~11 min. on an Alix pfSense 2.2.5 (ro). Thank you BBcan :)

                            Update: I followed BBcan's instructions below for starting DNSBL and that worked too. Excellent extension.

                            1 Reply Last reply Reply Quote 0
                            • B
                              BBcan177 Moderator
                              last edited by Nov 20, 2015, 12:15 PM

                              Here are some basic instructions to get started with DNSBL.

                              1. Open the pfBNG "DNSBL" Tab:

                              (Use the defaults unless you have a need to use otherwise)
                              Enter the DNSBL VIP as 10.10.10.1
                              Enter the DNSBL Listening Port as 8081
                              Enter the DNSBL SSL Listening port as 8443
                              Select the DNSBL Listening Interface as Lan

                              For the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
                              Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.

                              DNSBL IP Firewall Rule Settings:
                              Select Deny outbound or as per your requirements
                              select Enable logging

                              Alexa  (is optional, you can skip this until later if you wish)
                              Select Top 1K
                              Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.

                              In the Custom List you may enter any domain you wish to Whitelist.

                              Save your settings

                              1. Open the "DNSBL Feeds" Tab:

                              Create a new DNSBL Alias

                              Enter DNS Group Name as ADs
                              Enter Description as DNSBL ADverts

                              DNSBL:

                              Enter the Header/Label and Source URL as follows:
                              (Use copy/paste as plain text for the URL)

                              Format Auto and State ON

                              yoyo
                              http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext

                              hpHosts_ads
                              http://hosts-file.net/ad_servers.txt

                              Adaway
                              https://adaway.org/hosts.txt

                              Cameleon
                              http://sysctl.org/cameleon/hosts

                              Select List Action as Unbound
                              Select Update Frequency as Once a day

                              Alexa:
                              Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.

                              Add any other domains that you wish to block in the Custom List.

                              Save your settings

                              1. Open the "DNSBL" Tab:

                              Click DNSBL Enable checkbox.
                              Save your settings

                              1. Open the "Update" Tab:

                              Select Force Update

                              You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.

                              1. Goto the pfBlockerNG "Alerts" Tab:

                              Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.

                              As a test, goto www.aol.com  and www.yahoo.com  and see some alerts populate.

                              There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • N
                                n3by
                                last edited by Nov 20, 2015, 12:23 PM

                                @cmb:

                                …

                                I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance.
                                ...
                                Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

                                Thanks BBCan!

                                uninstalled test 77 DEV and installed 2.0 from official on 2 boxes v2.2.4 & v2.2.5

                                At first look it was ok, up and running but I see that I have to manual start service```
                                dnsbl pfBlockerNG DNSBL Web Server

                                This service not running after update is something that I had before when beta testing on all boxes.
                                1 Reply Last reply Reply Quote 0
                                • N
                                  ntct
                                  last edited by Nov 20, 2015, 2:30 PM

                                  I also update from dev to 2.0, it work properly, a powerful package

                                  Thanks! BBcan177

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    wcrowder
                                    last edited by Nov 20, 2015, 3:42 PM

                                    @cmb:

                                    Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

                                    Thanks BBCan!

                                    Done, ran the standard tests, all good. Thanks for all the work BB!

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      pfcode
                                      last edited by Nov 20, 2015, 4:16 PM

                                      Work like a charm, Thanks! For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

                                      Release: pfSense 2.4.3(amd64)
                                      M/B: Supermicro A1SRi-2558F
                                      HDD: Intel X25-M 160G
                                      RAM: 2x8Gb Kingston ECC ValueRAM
                                      AP: Netgear R7000 (XWRT), Unifi AC Pro

                                      1 Reply Last reply Reply Quote 0
                                      • V
                                        vito
                                        last edited by Nov 20, 2015, 4:45 PM

                                        @pfcode:

                                        Work like a charm, Thanks! For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

                                        I had this also, second time worked fine
                                        prior, i was on the latest build of PFB 1.x

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          BBcan177 Moderator
                                          last edited by Nov 20, 2015, 5:14 PM

                                          Looks like I have a file caching issue with the download function. I will get that resolved asap and add the relevant download code directly to the install code.

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          15 out of 1077
                                          • First post
                                            15/1077
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received