Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      vito
      last edited by

      @pfcode:

      Work like a charm, Thanks! For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

      I had this also, second time worked fine
      prior, i was on the latest build of PFB 1.x

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        Looks like I have a file caching issue with the download function. I will get that resolved asap and add the relevant download code directly to the install code.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • B
          Bastion
          last edited by

          Installed and configured with DNSBL, all went smoothly and working flawlessly since.

          Great package by great people ! Many thanks BBcan177

          1 Reply Last reply Reply Quote 0
          • W
            Wolf666
            last edited by

            After months of testing I just installed pfBlockerNG 2.0 from official repository, everything is ok.
            Thanks BBCan, ottimo lavoro amico mio!

            Modem Draytek Vigor 130
            pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
            Switch Cisco SG350-10
            AP Netgear R7000 (Stock FW)
            HTPC Intel NUC5i3RYH
            NAS Synology DS1515+
            NAS Synology DS213+

            1 Reply Last reply Reply Quote 0
            • J
              JasonJoel
              last edited by

              @pfcode:

              For some reason, First attempt stuck at the 'Downloading MaxMind databases' part. Second attempt worked.

              Ditto. Worked on 2nd try.

              I setup DNSBL per the instructions above, and it looks like everything is worked as advertised. Great work!

              Jason

              1 Reply Last reply Reply Quote 0
              • I
                Ibor Daru
                last edited by

                Excellent!!!

                Confirmed also: second try (simply reinstalled package after first update attempt)

                Really great job. Where can I donate?

                1 Reply Last reply Reply Quote 0
                • T
                  trinidadrancheria
                  last edited by

                  Installed, It stopped at the same place as most others, being lazy I refreshed which reinstalled it again :D (3 less clicks than packages/reinstall/confirm) :P

                  Working GREAT! Gonna enable DNSBL for INBOUND Monday (using Alias) :)

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    Here is a PR to fix the Installation issue being reported…

                    https://github.com/pfsense/pfsense-packages/pull/1189

                    Once this is merged, if anyone has similar issues, please report back. Thanks!

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • F
                      fraglord
                      last edited by

                      If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver

                      pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

                      1 Reply Last reply Reply Quote 0
                      • H
                        Hugovsky
                        last edited by

                        Thanks BBcan177, and everyone that made this package possible. Great jpb.

                        @fraglord:

                        If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver

                        Can you elaborate? I have multi-wan and forwarding disabled and everything works.

                        1 Reply Last reply Reply Quote 0
                        • C
                          cmb
                          last edited by

                          Latest PR merged.

                          1 Reply Last reply Reply Quote 0
                          • D
                            Dpain
                            last edited by

                            @BBcan177:

                            There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

                            Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate? I'd like to thank you, you have no idea I've been trying to block ads on my wireless devices and had been trying to do this on an Asus RT-68U (AP mode)  with both tomato and merlin and was having issues.  PfBlockerNG 2.0 has solved this issue for me, I no longer have to mess around with the Asus router and don't have to worry bout getting ads on my sons ipad/pc. I added a feed from http://winhelp2002.mvps.org/hosts.htm would this work for host files as well? In the log it does seem to have downloaded the .txt file (see attached screenshot)  Thanks  again  BBcan177 for your work!

                            mvphost3.png_thumb
                            mvphost3.png

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              Here are more DNSBL Feeds that can be used in pfBlockerNG.
                              (Copy and paste URLS as plain text)

                              1. Create a new alias for these.
                                These are not necessarily ADvert domains. So I named mine "Malicious"

                              hpHosts
                              http://hosts-file.net/download/hosts.zip

                              SWC
                              http://someonewhocares.org/hosts/hosts

                              spam404
                              https://spam404bl.com/blacklist.txt
                              https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

                              malc0de
                              https://malc0de.com/bl/BOOT

                              MDS (use 'Flex' state)
                              https://mirror1.malwaredomains.com/files/justdomains

                              MVPS
                              http://winhelp2002.mvps.org/hosts.txt

                              MDL
                              http://www.malwaredomainlist.com/hostslist/hosts.txt

                              Discontinued
                              GJTech
                              http://adblock.gjtech.net/?format=unix-hosts

                              dShield_SD  (They also have a conservative list available)
                              https://www.dshield.org/feeds/suspiciousdomains_High.txt

                              Zeus
                              https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

                              1. These two feeds post full URLs, so there can be some more false positives.
                                Create a new Alias, and use Alexa as a recommendation.

                              PhishTank
                              https://data.phishtank.com/data/online-valid.csv.bz2

                              OpenPhish
                              https://www.openphish.com/feed.txt

                              MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
                              https://lists.malwarepatrol.net

                              1. This is a feed that I manage (as time permits)
                                MS_2
                                https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

                              2. Use this in its own Alias:

                              BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
                              http://osint.bambenekconsulting.com/feeds/dga-feed.gz

                              BBC_C2
                              http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

                              1. Use this feed in its own alias as it is updated more frequently.
                                So you can update it more often than once per day.

                              hpHosts_partial
                              http://hosts-file.net/hphosts-partial.asp

                              If users find other feeds, please post back so that others may benefit also.
                              Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • T
                                tonymorella
                                last edited by

                                @BBcan177:

                                Here are some basic instructions to get started with DNSBL.

                                1. Open the pfBNG "DNSBL" Tab:

                                (Use the defaults unless you have a need to use otherwise)
                                Enter the DNSBL VIP as 10.10.10.1
                                Enter the DNSBL Listening Port as 8081
                                Enter the DNSBL SSL Listening port as 8443
                                Select the DNSBL Listening Interface as Lan

                                For the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
                                Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.

                                DNSBL IP Firewall Rule Settings:
                                Select Deny outbound or as per your requirements
                                select Enable logging

                                Alexa  (is optional, you can skip this until later if you wish)
                                Select Top 1K
                                Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.

                                In the Custom List you may enter any domain you wish to Whitelist.

                                Save your settings

                                1. Open the "DNSBL Feeds" Tab:

                                Create a new DNSBL Alias

                                Enter DNS Group Name as ADs
                                Enter Description as DNSBL ADverts

                                DNSBL:

                                Enter the Header/Label and Source URL as follows:
                                (Use copy/paste as plain text for the URL)

                                Format Auto and State ON

                                yoyo
                                http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext

                                hpHosts_ads
                                http://hosts-file.net/ad_servers.txt

                                Adaway
                                https://adaway.org/hosts.txt

                                Cameleon
                                http://sysctl.org/cameleon/hosts

                                Select List Action as Unbound
                                Select Update Frequency as Once a day

                                Alexa:
                                Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.

                                Add any other domains that you wish to block in the Custom List.

                                Save your settings

                                1. Open the "DNSBL" Tab:

                                Click DNSBL Enable checkbox.
                                Save your settings

                                1. Open the "Update" Tab:

                                Select Force Update

                                You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.

                                1. Goto the pfBlockerNG "Alerts" Tab:

                                Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.

                                As a test, goto www.aol.com  and www.yahoo.com  and see some alerts populate.

                                There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

                                Have been using the beta code for some time and noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter.

                                popcash.net
www.popcash.net
outbrain.com
www.outbrain.com
onclickads.net
www.onclickads.net
googleadservices.com
www.googleadservices.com
adcash.com
www.adcash.com
popads.net
www.popads.net

                                To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @Dpain:

                                  @BBcan177:

                                  There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

                                  Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?

                                  Thanks  again  BBcan177 for your work!

                                  I could use a lifetime pfSense Gold subscription… :) But I think all developers should get that as a bonus :)

                                  My email is at the bottom of the pfBNG general tab.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    Dpain
                                    last edited by

                                    @BBcan177:

                                    @Dpain:

                                    @BBcan177:

                                    There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

                                    Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?

                                    Thanks  again  BBcan177 for your work!

                                    I could use a lifetime pfSense Gold subscription… :) But I think all developers should get that as a bonus :)

                                    My email is at the bottom of the pfBNG general tab.

                                    :o lifetime ?  That would be $99 x how many ever years you have left  ;D :P  so is the email there attached to a paypal account? Not sure if donation talk is allowed on forum if not, I apologize mods. Also , It does seem to be working for host files from http://winhelp2002.mvps.org/hosts.htm Thanks!

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      fraglord
                                      last edited by

                                      Can you elaborate? I have multi-wan and forwarding disabled and everything works.

                                      If you enable forwarding mode then a foward-zone named "." is created as well as some forward-addr entries with the DNS servers you sepcified system->general setup.
                                      Default behavior of unbound is to query the Root servers. But if you have a multi-WAN configuration and need to specifiy a different DNS server for each WAN(gateway) you need forwarding mode to be enabled. So yeah, works without forwarding mode for some multi-WAN configs that are fine with just the Root servers.

                                      pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

                                      1 Reply Last reply Reply Quote 0
                                      • V
                                        vito
                                        last edited by

                                        BBCan177,
                                        Any problems running your list import script on PFB 2.0?

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          tonymorella
                                          last edited by

                                          Few things I found out while beta testing V2

                                          • First rule is take your time and be patient. Adding to may rules at once will casue alot of blocks you may or may not way. Wildcards are not supported, or wanted in most cases. For example adding google.com does not filter all the hosts for the domain, need to add each host that is being blocked to the filter lists
                                          • Make sure to double check ASN's, especially for large companies that have acquired other companies, more than one ASN might exist
                                            *** Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.
                                          • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around
                                          • I wanted to have my allow rules > pfb block rules > my block rules > my per interface rules.  Did this by enabling "Floating Rules" and using "pfb_pass/match  | pfsense pass/match |  pfb_block/reject"
                                          • If you have WIFI make sure to enable "DNSBL Firewall Rule" and select both LAN and WIFI or the NAT: Port Forward rule for 10.10.10.1 is not setup correctly.  If you don't change this setting things still work but everything runs slow over wifi.
                                          • Make sure to whitelist all the DNSBL sites FQDN via an allow aliases, some IPv4 block-lists include the IP space the DNSBL are found in
                                          • DBSBL is basicly a man in the middle for DNS so any site that is block but running https will create warrnings. Depending on how the brower is setup it might just ignore or not display the error.  CTRL+SHIFT+I on both Chrome and Firebox will bring up dev panel where you can see which pages are not loading. Chrome will show an error, Firefox will show a red slash throught the lock icon.
                                          • Noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter. To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
                                          popcash.net
www.popcash.net
cdn.popcash.net
outbrain.com
www.outbrain.com
onclickads.net
www.onclickads.net
googleadservices.com
www.googleadservices.com
adcash.com
www.adcash.com
popads.net
www.popads.net
popmyads.com
www.popmyads.com
                                          • List of domains added to DNSBL Custom Domain Suppression to stop them from being blocked
                                          
goo.gl
google.com
www.google.com
mail.google.com
docs.google.com
sites.google.com
fonts.googleapis.com
cache.google.com
clients.google.com
clients0.google.com
clients1.google.com
clients2.google.com
clients3.google.com
clients4.google.com
clients5.google.com
clients6.google.com
clients7.google.com
clients8.google.com
clients9.google.com
www.maxmind.com
s3.amazonaws.com
fls-na.amazon.com
login.live.com
redis.io
pgl.yoyo.org
someonewhocares.org
www.thingamajob.com
winhelp2002.mvps.org
hosts-file.net
www.hosts-file.net
adaway.org
sysctl.org
adblock.gjtech.net
www.dshield.org
malwaredomainlist.com
malwaredomains.com
bambenekconsulting.com
malwarepatrol.net
zeustracker.abuse.ch
malc0de.com
curl.haxx.se
dl.dropboxusercontent.com
whois.cymru.com
github.com
collector-cdn.github.com
pivotal.github.com
cloud.github.com
raw.githubusercontent.com
raw.github.com
stopforumspam.com
www.stopforumspam.com
sourceforge.net
www.sourceforge.net
iweb.dl.sourceforge.net
chase.com
www.chase.com
mint.com
www.mint.com
americanexpress.com
www.americanexpress.com
online.americanexpress.com
linuxquestions.org
www.linuxquestions.org
optimizely.com
www.optimizely.com
api.optimizely.com
cdn.optimizely.com
cdn2.optimizely.com
cdn3.optimizely.com
slashdot.org
www.slashdot.org
ebay.com
www.ebay.com
rover.ebay.com
srx.main.ebayrtm.com
openbl.org
www.openbl.org
www.us.openbl.org
delta.com
www.delta.com
aa.com
www.aa.com
cruisesonly.com
www.cruisesonly.com
ripe.net
www.ripe.net
weather.com
www.weather.com
lacnic.net
www.lacnic.net
tvrage.com
services.tvrage.com
www.tvrage.com
publicbt.com
device.maxmind.com
www.boingo.com
xda-developers.com
www.xda-developers.com
forum.xda-developers.com
opengapps.org
download.mono-project.com

                                          • Ads DNS Group

                                          • Update Frequency: Once a Day

                                          • Enable Alexa Whitelist: NOT Enabled

                                          • Add Custom Block List noted above

                                          
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintextoup	yoyo
http://hosts-file.net/ad_servers.txt							hphosts_ats
https://adaway.org/hosts.txt								adaway
http://sysctl.org/cameleon/hosts							syctrl
http://adblock.gjtech.net/?format=unix-hosts						gjtech

                                          • Privacy Fraud DNS Group

                                          • Update Frequency: Once a Day

                                          • Enable Alexa Whitelist: Enabled

                                          
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt			disconnect_basic
http://hosts-file.net/fsa.txt								hphost_fsa
http://hosts-file.net/hjk.txt								hphost_hjk
http://hosts-file.net/pha.txt								hphost_psh
https://www.dshield.org/feeds/suspiciousdomains_High.txt				dshield_sdh

                                          • Malware Exploit DNS Group

                                          • Update Frequency: Once a Day

                                          • Enable Alexa Whitelist: Enabled

                                          
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt			disconnect_malvertising
http://www.malwaredomainlist.com/hostslist/hosts.txt					malwaredomainlist
http://mirror1.malwaredomains.com/files/justdomains					malwaredomains			
https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt				disconnect_malware
http://hosts-file.net/emd.txt								hphosts_emd
http://hosts-file.net/exp.txt								hphosts_exp
http://hosts-file.net/mmt.txt								hphosts_mmt
https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian malwarepatrol
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist			zeustracker
https://malc0de.com/bl/BOOT								malc0de

                                          • SPAM DNS Group

                                          • Update Frequency: Once a Day

                                          • Enable Alexa Whitelist: Enabled

                                          
http://hosts-file.net/grm.txt								hphost_grm
http://hosts-file.net/hfs.txt								hphost_hfs
https://spam404bl.com/blacklist.txt							spam_404

                                          • Malicious DNS Group

                                          • Update Frequency: Once a Day

                                          • Enable Alexa Whitelist: Enabled

                                          
http://hosts-file.net/hphosts-partial.txt						hphost_partial
http://winhelp2002.mvps.org/hosts.txt							mvps_hosts
http://someonewhocares.org/hosts/hosts							SomeoneWhoCares
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw			BBcan177

                                          • BambenekConsulting DNS Group

                                          • Update Frequency: Once a Day

                                          • Enable Alexa Whitelist: Enabled

                                          
http://osint.bambenekconsulting.com/feeds/dga-feed.gz					bambenek_dga
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt				bambenek_c2

                                          Thanks
                                          Tony M.**

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tonymorella
                                            last edited by

                                            @vito:

                                            BBCan177,
                                            Any problems running your list import script on PFB 2.0?

                                            This scripted worked without an issue for me.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.