PfBlockerNG v2.0 w/DNSBL

michaelmullanyza

Hey BB.

I'd just like some clarification as I'm not sure what the differences are.

I'm currently making use of IPv4 lists in PfBlockerNG. For example, I have the "spyware" iblocklist as an alias, and deny outbound.

As you know, this converts the lists into a Firewall IP Alias and denies Outbound on LAN for this Alias.

What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

If I haven't understood it correct, please let me know :)

mygeeknc

I'm having the same issue as the other fellow that the dnsbl web server is not starting. I don't see any errors in the System -> General logs either.

ntct

I recommend to use deinstall and install new package, not use reinstall…

Maybe this way will help.

BBcan177

@mygeeknc:

I'm having the same issue as the other fellow that the dnsbl web server is not starting. I don't see any errors in the System -> General logs either.

Checklist:

pfBlockerNG enabled in General Tab
DNSBL enabled in DNSBL Tab
VIP, port and ssl port defined in DNSBL Tab
DNS Resolver enabled

Then run a 'Force Update'. If it still doesn't start, execute the following and see if it shows any additional info:

/usr/local/etc/rc.d/dnsbl.sh start

BBcan177

@michaelmullanyza:

What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

There are several other lists the perform better than IBlock lists. They have too many false positives. See the script that I wrote to add over 50+ different blocklists for IP Reputation.

Both IP Reputation and DNSBL achieve two different layer of protection. Not too mention that DNSBL also properly handles ADvert blocking.

Some additional reading:
https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

BBcan177

@BBcan177:

I also fixed an issue with the Download Failure function.
https://github.com/pfsense/pfsense-packages/pull/1192

Pull Request has been merged. Latest version is 2.0.1

BBcan177

@docjay:

I will be donating to you if you accept donations.
–** Good Job**--

NP :)

Panja

@BBcan177:

Both IP Reputation and DNSBL achieve two different layer of protection.

What are the differences? I'm just curious.
I love your work btw! Great job.

asterix

@tonymorella:

@doktornotor:
@Asterix:

Getting this EasyList error for w/o elements.

[ DNSBL_EasyList - w/o Elements ] Download FAIL
Could not determine IP address of host.
Firewall and/or IDS are not blocking download.

Well that's not a package error. You need working DNS. :D
$ host easylist-downloads.adblockplus.org
easylist-downloads.adblockplus.org has address 148.251.139.76
easylist-downloads.adblockplus.org has address 144.76.100.145
easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:200:114f::2
easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:192:7126::2
Filter out easylist-downloads.adblockplus.org via DNSBL as well as add it to an allow alias and see if this helps. Depending out how you having things setup could be blocking. Host lookup most likely works because it's doing is via unbound. Just a thought let us know :)

Tony M

DNS is working fine. It downloads the "Privacy" list which is just after w/o Elements.

q54e3w

Some additional reading:
https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

thanks for that - useful reading for anyone thinking about using DNSBL.

cjbujold

Where can i find the list referred in your post.

"See the script that I wrote to add over 50+ different blocklists for IP Reputation."

Thanks

cjb

BBcan177

@cjbujold:

Where can i find the list referred in your post.

https://forum.pfsense.org/index.php?topic=86212.msg549973#msg549973

@Asterix:

[ DNSBL_EasyList - w/o Elements ] Download FAIL
Could not determine IP address of host.
Firewall and/or IDS are not blocking download.

Is the 'Header' set as "w/o Elements"… Don't add special characters or spaces... just call it "EasyList" and the other "EasyPrivacy" as the Header/Label. Did you configure the Categories for both lists? In the latest version 2.0.1, there is a fix which might help diagnose this issue for you.

ha11oga11o

@BBcan177:

@michaelmullanyza:

What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

There are several other lists the perform better than IBlock lists. They have too many false positives. See the script that I wrote to add over 50+ different blocklists for IP Reputation.

Both IP Reputation and DNSBL achieve two different layer of protection. Not too mention that DNSBL also properly handles ADvert blocking.

Some additional reading:
https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

Finally server started and i got data at logs.

Many thnx :)

BBcan177

@ha11oga11o:

Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

Finally server started and i got data at logs.

When you were at the Dashboard: Services Status Widget, if DNSBL was not running, it would have shown a red "X" and a single "Start" Icon". The "Restart" Icon is only visible when the service is already started? Can you try to stop/start the DNSBL service from the Dashboard? I can't duplicate this issue?

asterix

@BBcan177:

@cjbujold:

Where can i find the list referred in your post.

https://forum.pfsense.org/index.php?topic=86212.msg549973#msg549973

@Asterix:

[ DNSBL_EasyList - w/o Elements ] Download FAIL
Could not determine IP address of host.
Firewall and/or IDS are not blocking download.

Is the 'Header' set as "w/o Elements"… Don't add special characters or spaces... just call it "EasyList" and the other "EasyPrivacy" as the Header/Label. Did you configure the Categories for both lists? In the latest version 2.0.1, there is a fix which might help diagnose this issue for you.

Removing "w/o" has fixed this. Thank you!

ha11oga11o

@BBcan177:

@ha11oga11o:

Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

Finally server started and i got data at logs.

When you were at the Dashboard: Services Status Widget, if DNSBL was not running, it would have shown a red "X" and a single "Start" Icon". The "Restart" Icon is only visible when the service is already started? Can you try to stop/start the DNSBL service from the Dashboard? I can't duplicate this issue?

mine fault, it was only start which was doing nothing. Alsop nothing at system logs. Now, i tried to actually restart and works fine now.

Cheers :)

PS. At first post i wanted to quote this, sorry:

Checklist:

pfBlockerNG enabled in General Tab
DNSBL enabled in DNSBL Tab
VIP, port and ssl port defined in DNSBL Tab
DNS Resolver enabled

Then run a 'Force Update'. If it still doesn't start, execute the following and see if it shows any additional info:
Code: [Select]

/usr/local/etc/rc.d/dnsbl.sh start

trinidadrancheria

I was thinking about using the new features of pfBlockerNG 2.0 to stop spam at the firewall since the current version of PostFix does not yet support DNSBL out of the box…
I was thinking of setting the list action to alias, then putting the firewall rules in to block all incoming from the sites. Problem I think is that the SpamHaus DNS list is a live list (query).... Is this supported?

Panja

I have installed pfBlockerNG v2.01 on my APU1D4 pfSense 2.2.5

I'm blocking a few countries for inbound traffic.
I also setup DNSBL as per post: https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943

I'm using OpenDNS in General Setup and DNS Resolver is enabled with the following options:
Enable Forwarding Mode (this is needed for my OpenDNS filtering)
Register DHCP leases in the DNS Resolver
Register DHCP static mappings in the DNS Resolver

All is working, ads are being blocked.
Only problem is when I reboot my box the Unbound Service is not started automatically (or is being stopped).
So with every reboot I do, I have to manually start the Unbound Service.

What could be the problem?

hda

@Panja:

…
So with every reboot I do, I have to manually start the Unbound Service.

What could be the problem?

You lost the pfb_dnsbl.conf, in Unbound(Advanced) conf, due to /var in RAM ?
Delete that line and do a pfB Force Update.

Panja

Nope… The line was there:
server:include: /var/unbound/pfb_dnsbl.conf

But I removed it, did a force update and rebooted.
Same problem.
Unbound is stopped when the reboot is done.