Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      docjay
      last edited by

      @BBcan177

      'If there are errors starting/stopping the DNSBL service, those will be logged to the pfSense System log.  The RC file for the DNSBL service is here (/usr/local/etc/rc.d/dnsbl.sh [stop|start|restart])'

      I didn't see anything logged in my system log to help me identify my problem.  Luckily I saw your post - :)

      My DNSBL service won't start.  When I attempt to start it from command line it comes back with:

      
      [2.2.5-RELEASE][root@cerberus.home]/root: /usr/local/etc/rc.d/dnsbl.sh start
      2015-11-22 12:06:31: (network.c.542) SSL: BIO_read_filename('/var/unbound/dnsbl_cert.pem') failed
      

      when I dive into 'var/unbound/' there is no 'dnsbl_cert.pem' file.

      I would rather not lose all of my settings to reinstall the package.  I've already tried this with the box checked 'keep settings' but it still didn't let the service start.  Is there a way to get the file 'dnsbl_cert.pem' or a way to backup my settings and reapply them after I completely wipe the package?

      thank you!

      ;D

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @docjay:

        Is there a way to get the file 'dnsbl_cert.pem' or a way to backup my settings and reapply them after I completely wipe the package?

        If you run 'Force Update' that pem file should be automatically created.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • D
          docjay
          last edited by

          Just did a 'force update' and it still didn't create the 'dnsbl_cert.pem' file.  ..and I do have 'Enable DNSBL' checked.

          from the log viewer:

          http://pastebin.com/HbA3ZRiK

          Thanks

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            It looks like Cron was running in the background when you pressed "Save"… This was in the log:

            ** DNSBL Disabled **

            Try another 'Force update'. You also have to change the 'State' to 'Flex' for some of those lists that are failing.

            Also Toasted Spam has this URL
            http://toastedspam.com/deny

            Also put 'StopForumSpam' into its own Alias and set the frequency to 'Once per day', as that List is rate-limiting connections.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • D
              docjay
              last edited by

              Okay - I uncheck the 'enable DNSBL' box, saved it & then rechecked it.  Saved it again, all while I made sure CRON was not running.

              I also made the changes you suggested, thanks!  :D

              log:  http://pastebin.com/jHQnF1qH

              it still tells me

              DNSBL Disabled

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                One of the required DNSBL settings is missing. Do you have the DNS Resolver (Unbound) enabled?

                I also fixed an issue with the Download Failure function.
                https://github.com/pfsense/pfsense-packages/pull/1192

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • D
                  docjay
                  last edited by

                  I was just replying to you about my mistake!  ::)

                  @BBcan177

                  Sorry to waste your time.  I didn't have the DNS Resolver enabled.  I disabled the DNS forwarder, enabled DNS Resolver & did another 'force update' & it built the file and updated the config.

                  Thanks & again, sorry!

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    NP. This will probably help someone else who hits the same scenario. Either way, seeing your 'pfblockerng.log' tweaked me to check the code and find a small error with the download failure function. ;)

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • D
                      docjay
                      last edited by

                      You da man - DNSBL is so worth while, thanks for all of your hard work & for the re-write!  ;D  It makes websites load much faster & I get the screw over the man by not looking at ads.

                      I will be donating to you if you accept donations.

                      –** Good Job**--

                      1 Reply Last reply Reply Quote 0
                      • M
                        michaelmullanyza
                        last edited by

                        Hey BB.

                        I'd just like some clarification as I'm not sure what the differences are.

                        I'm currently making use of IPv4 lists in PfBlockerNG. For example, I have the "spyware" iblocklist as an alias, and deny outbound.

                        As you know, this converts the lists into a Firewall IP Alias and denies Outbound on LAN for this Alias.

                        What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

                        If I haven't understood it correct, please let me know :)

                        1 Reply Last reply Reply Quote 0
                        • M
                          mygeeknc
                          last edited by

                          I'm having the same issue as the other fellow that the dnsbl web server is not starting. I don't see any errors in the System -> General logs either.

                          1 Reply Last reply Reply Quote 0
                          • N
                            ntct
                            last edited by

                            I recommend to use deinstall and install new package, not use reinstall…

                            Maybe this way will help.

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              @mygeeknc:

                              I'm having the same issue as the other fellow that the dnsbl web server is not starting. I don't see any errors in the System -> General logs either.

                              Checklist:

                              • pfBlockerNG enabled in General Tab

                              • DNSBL enabled in DNSBL Tab

                              • VIP, port and ssl port defined in DNSBL Tab

                              • DNS Resolver enabled

                              Then run a 'Force Update'. If it still doesn't start, execute the following and see if it shows any additional info:

                              /usr/local/etc/rc.d/dnsbl.sh start
                              

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                @michaelmullanyza:

                                What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

                                There are several other lists the perform better than IBlock lists. They have too many false positives. See the script that I wrote to add over 50+ different blocklists for IP Reputation.

                                Both IP Reputation and DNSBL achieve two different layer of protection. Not too mention that DNSBL also properly handles ADvert blocking.

                                Some additional reading:
                                https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @BBcan177:

                                  I also fixed an issue with the Download Failure function.
                                  https://github.com/pfsense/pfsense-packages/pull/1192

                                  Pull Request has been merged. Latest version is 2.0.1

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    @docjay:

                                    I will be donating to you if you accept donations. 
                                    –** Good Job**--

                                    NP :)

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      Panja
                                      last edited by

                                      @BBcan177:

                                      Both IP Reputation and DNSBL achieve two different layer of protection.

                                      What are the differences? I'm just curious.
                                      I love your work btw! Great job.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        asterix
                                        last edited by

                                        @tonymorella:

                                        @doktornotor:

                                        @Asterix:

                                        Getting this EasyList error for w/o elements.

                                        [ DNSBL_EasyList - w/o Elements ] Download FAIL
                                          Could not determine IP address of host.
                                          Firewall and/or IDS are not blocking download.

                                        Well that's not a package error. You need working DNS. :D

                                        
                                        $ host easylist-downloads.adblockplus.org
                                        easylist-downloads.adblockplus.org has address 148.251.139.76
                                        easylist-downloads.adblockplus.org has address 144.76.100.145
                                        easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:200:114f::2
                                        easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:192:7126::2
                                        
                                        

                                        Filter out easylist-downloads.adblockplus.org via DNSBL as well as add it to an allow alias and see if this helps. Depending out how you having things setup could be blocking.  Host lookup most likely works because it's doing is via unbound. Just a thought let us know :)

                                        Tony M

                                        DNS is working fine. It downloads the "Privacy" list which is just after w/o Elements.

                                        1 Reply Last reply Reply Quote 0
                                        • Q
                                          q54e3w
                                          last edited by

                                          Some additional reading:
                                          https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

                                          thanks for that - useful reading for anyone thinking about using DNSBL.

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            cjbujold
                                            last edited by

                                            Where can i find the list referred in your post.

                                            "See the script that I wrote to add over 50+ different blocklists for IP Reputation."

                                            Thanks

                                            cjb

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.