Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hda
      last edited by

      Package update succeeded on the second reinstall from v1.10, after ~11 min. on an Alix pfSense 2.2.5 (ro). Thank you BBcan :)

      Update: I followed BBcan's instructions below for starting DNSBL and that worked too. Excellent extension.

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        Here are some basic instructions to get started with DNSBL.

        1. Open the pfBNG "DNSBL" Tab:

        (Use the defaults unless you have a need to use otherwise)
        Enter the DNSBL VIP as 10.10.10.1
        Enter the DNSBL Listening Port as 8081
        Enter the DNSBL SSL Listening port as 8443
        Select the DNSBL Listening Interface as Lan

        For the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
        Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.

        DNSBL IP Firewall Rule Settings:
        Select Deny outbound or as per your requirements
        select Enable logging

        Alexa  (is optional, you can skip this until later if you wish)
        Select Top 1K
        Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.

        In the Custom List you may enter any domain you wish to Whitelist.

        Save your settings

        1. Open the "DNSBL Feeds" Tab:

        Create a new DNSBL Alias

        Enter DNS Group Name as ADs
        Enter Description as DNSBL ADverts

        DNSBL:

        Enter the Header/Label and Source URL as follows:
        (Use copy/paste as plain text for the URL)

        Format Auto and State ON

        yoyo
        http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext

        hpHosts_ads
        http://hosts-file.net/ad_servers.txt

        Adaway
        https://adaway.org/hosts.txt

        Cameleon
        http://sysctl.org/cameleon/hosts

        Select List Action as Unbound
        Select Update Frequency as Once a day

        Alexa:
        Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.

        Add any other domains that you wish to block in the Custom List.

        Save your settings

        1. Open the "DNSBL" Tab:

        Click DNSBL Enable checkbox.
        Save your settings

        1. Open the "Update" Tab:

        Select Force Update

        You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.

        1. Goto the pfBlockerNG "Alerts" Tab:

        Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.

        As a test, goto www.aol.com  and www.yahoo.com  and see some alerts populate.

        There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • N
          n3by
          last edited by

          @cmb:

          …

          I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance.
          ...
          Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

          Thanks BBCan!

          uninstalled test 77 DEV and installed 2.0 from official on 2 boxes v2.2.4 & v2.2.5

          At first look it was ok, up and running but I see that I have to manual start service```
          dnsbl pfBlockerNG DNSBL Web Server

          This service not running after update is something that I had before when beta testing on all boxes.
          1 Reply Last reply Reply Quote 0
          • N
            ntct
            last edited by

            I also update from dev to 2.0, it work properly, a powerful package

            Thanks! BBcan177

            1 Reply Last reply Reply Quote 0
            • W
              wcrowder
              last edited by

              @cmb:

              Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

              Thanks BBCan!

              Done, ran the standard tests, all good. Thanks for all the work BB!

              1 Reply Last reply Reply Quote 0
              • P
                pfcode
                last edited by

                Work like a charm, Thanks! For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

                Release: pfSense 2.4.3(amd64)
                M/B: Supermicro A1SRi-2558F
                HDD: Intel X25-M 160G
                RAM: 2x8Gb Kingston ECC ValueRAM
                AP: Netgear R7000 (XWRT), Unifi AC Pro

                1 Reply Last reply Reply Quote 0
                • V
                  vito
                  last edited by

                  @pfcode:

                  Work like a charm, Thanks! For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

                  I had this also, second time worked fine
                  prior, i was on the latest build of PFB 1.x

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    Looks like I have a file caching issue with the download function. I will get that resolved asap and add the relevant download code directly to the install code.

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • B
                      Bastion
                      last edited by

                      Installed and configured with DNSBL, all went smoothly and working flawlessly since.

                      Great package by great people ! Many thanks BBcan177

                      1 Reply Last reply Reply Quote 0
                      • W
                        Wolf666
                        last edited by

                        After months of testing I just installed pfBlockerNG 2.0 from official repository, everything is ok.
                        Thanks BBCan, ottimo lavoro amico mio!

                        Modem Draytek Vigor 130
                        pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                        Switch Cisco SG350-10
                        AP Netgear R7000 (Stock FW)
                        HTPC Intel NUC5i3RYH
                        NAS Synology DS1515+
                        NAS Synology DS213+

                        1 Reply Last reply Reply Quote 0
                        • J
                          JasonJoel
                          last edited by

                          @pfcode:

                          For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

                          Ditto. Worked on 2nd try.

                          I setup DNSBL per the instructions above, and it looks like everything is worked as advertised. Great work!

                          Jason

                          1 Reply Last reply Reply Quote 0
                          • I
                            Ibor Daru
                            last edited by

                            Excellent!!!

                            Confirmed also: second try (simply reinstalled package after first update attempt)

                            Really great job. Where can I donate?

                            1 Reply Last reply Reply Quote 0
                            • T
                              trinidadrancheria
                              last edited by

                              Installed, It stopped at the same place as most others, being lazy I refreshed which reinstalled it again :D (3 less clicks than packages/reinstall/confirm) :P

                              Working GREAT! Gonna enable DNSBL for INBOUND Monday (using Alias) :)

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                Here is a PR to fix the Installation issue being reported…

                                https://github.com/pfsense/pfsense-packages/pull/1189

                                Once this is merged, if anyone has similar issues, please report back. Thanks!

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • F
                                  fraglord
                                  last edited by

                                  If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver

                                  pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

                                  1 Reply Last reply Reply Quote 0
                                  • H
                                    Hugovsky
                                    last edited by

                                    Thanks BBcan177, and everyone that made this package possible. Great jpb.

                                    @fraglord:

                                    If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver

                                    Can you elaborate? I have multi-wan and forwarding disabled and everything works.

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      cmb
                                      last edited by

                                      Latest PR merged.

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        Dpain
                                        last edited by

                                        @BBcan177:

                                        There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

                                        Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate? I'd like to thank you, you have no idea I've been trying to block ads on my wireless devices and had been trying to do this on an Asus RT-68U (AP mode)  with both tomato and merlin and was having issues.  PfBlockerNG 2.0 has solved this issue for me, I no longer have to mess around with the Asus router and don't have to worry bout getting ads on my sons ipad/pc. I added a feed from http://winhelp2002.mvps.org/hosts.htm would this work for host files as well? In the log it does seem to have downloaded the .txt file (see attached screenshot)  Thanks  again  BBcan177 for your work!

                                        mvphost3.png_thumb
                                        mvphost3.png

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          Here are more DNSBL Feeds that can be used in pfBlockerNG.
                                          (Copy and paste URLS as plain text)

                                          1. Create a new alias for these.
                                            These are not necessarily ADvert domains. So I named mine "Malicious"

                                          hpHosts
                                          http://hosts-file.net/download/hosts.zip

                                          SWC
                                          http://someonewhocares.org/hosts/hosts

                                          spam404
                                          https://spam404bl.com/blacklist.txt
                                          https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

                                          malc0de
                                          https://malc0de.com/bl/BOOT

                                          MDS (use 'Flex' state)
                                          https://mirror1.malwaredomains.com/files/justdomains

                                          MVPS
                                          http://winhelp2002.mvps.org/hosts.txt

                                          MDL
                                          http://www.malwaredomainlist.com/hostslist/hosts.txt

                                          Discontinued
                                          GJTech
                                          http://adblock.gjtech.net/?format=unix-hosts

                                          dShield_SD  (They also have a conservative list available)
                                          https://www.dshield.org/feeds/suspiciousdomains_High.txt

                                          Zeus
                                          https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

                                          1. These two feeds post full URLs, so there can be some more false positives.
                                            Create a new Alias, and use Alexa as a recommendation.

                                          PhishTank
                                          https://data.phishtank.com/data/online-valid.csv.bz2

                                          OpenPhish
                                          https://www.openphish.com/feed.txt

                                          MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
                                          https://lists.malwarepatrol.net

                                          1. This is a feed that I manage (as time permits)
                                            MS_2
                                            https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

                                          2. Use this in its own Alias:

                                          BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
                                          http://osint.bambenekconsulting.com/feeds/dga-feed.gz

                                          BBC_C2
                                          http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

                                          1. Use this feed in its own alias as it is updated more frequently.
                                            So you can update it more often than once per day.

                                          hpHosts_partial
                                          http://hosts-file.net/hphosts-partial.asp

                                          If users find other feeds, please post back so that others may benefit also.
                                          Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tonymorella
                                            last edited by

                                            @BBcan177:

                                            Here are some basic instructions to get started with DNSBL.

                                            1. Open the pfBNG "DNSBL" Tab:

                                            (Use the defaults unless you have a need to use otherwise)
                                            Enter the DNSBL VIP as 10.10.10.1
                                            Enter the DNSBL Listening Port as 8081
                                            Enter the DNSBL SSL Listening port as 8443
                                            Select the DNSBL Listening Interface as Lan

                                            For the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
                                            Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.

                                            DNSBL IP Firewall Rule Settings:
                                            Select Deny outbound or as per your requirements
                                            select Enable logging

                                            Alexa  (is optional, you can skip this until later if you wish)
                                            Select Top 1K
                                            Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.

                                            In the Custom List you may enter any domain you wish to Whitelist.

                                            Save your settings

                                            1. Open the "DNSBL Feeds" Tab:

                                            Create a new DNSBL Alias

                                            Enter DNS Group Name as ADs
                                            Enter Description as DNSBL ADverts

                                            DNSBL:

                                            Enter the Header/Label and Source URL as follows:
                                            (Use copy/paste as plain text for the URL)

                                            Format Auto and State ON

                                            yoyo
                                            http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext

                                            hpHosts_ads
                                            http://hosts-file.net/ad_servers.txt

                                            Adaway
                                            https://adaway.org/hosts.txt

                                            Cameleon
                                            http://sysctl.org/cameleon/hosts

                                            Select List Action as Unbound
                                            Select Update Frequency as Once a day

                                            Alexa:
                                            Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.

                                            Add any other domains that you wish to block in the Custom List.

                                            Save your settings

                                            1. Open the "DNSBL" Tab:

                                            Click DNSBL Enable checkbox.
                                            Save your settings

                                            1. Open the "Update" Tab:

                                            Select Force Update

                                            You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.

                                            1. Goto the pfBlockerNG "Alerts" Tab:

                                            Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.

                                            As a test, goto www.aol.com  and www.yahoo.com  and see some alerts populate.

                                            There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

                                            Have been using the beta code for some time and noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter.

                                            popcash.net
                                            www.popcash.net
                                            outbrain.com
                                            www.outbrain.com
                                            onclickads.net
                                            www.onclickads.net
                                            googleadservices.com
                                            www.googleadservices.com
                                            adcash.com
                                            www.adcash.com
                                            popads.net
                                            www.popads.net
                                            
                                            

                                            To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.