Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cjbujold
      last edited by

      Where can i find the list referred in your post.

      "See the script that I wrote to add over 50+ different blocklists for IP Reputation."

      Thanks

      cjb

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @cjbujold:

        Where can i find the list referred in your post.

        https://forum.pfsense.org/index.php?topic=86212.msg549973#msg549973

        @Asterix:

        [ DNSBL_EasyList - w/o Elements ] Download FAIL
          Could not determine IP address of host.
          Firewall and/or IDS are not blocking download.

        Is the 'Header' set as "w/o Elements"… Don't add special characters or spaces... just call it "EasyList" and the other "EasyPrivacy" as the Header/Label. Did you configure the Categories for both lists? In the latest version 2.0.1, there is a fix which might help diagnose this issue for you.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • H
          ha11oga11o
          last edited by

          @BBcan177:

          @michaelmullanyza:

          What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

          There are several other lists the perform better than IBlock lists. They have too many false positives. See the script that I wrote to add over 50+ different blocklists for IP Reputation.

          Both IP Reputation and DNSBL achieve two different layer of protection. Not too mention that DNSBL also properly handles ADvert blocking.

          Some additional reading:
          https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

          Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

          Finally server started and i got data at logs.

          Many thnx :)

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @ha11oga11o:

            Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

            Finally server started and i got data at logs.

            When you were at the Dashboard: Services Status Widget, if DNSBL was not running, it would have shown a red "X" and a single "Start" Icon". The "Restart" Icon is only visible when the service is already started?  Can you try to stop/start the DNSBL service from the Dashboard? I can't duplicate this issue?

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • A
              asterix
              last edited by

              @BBcan177:

              @cjbujold:

              Where can i find the list referred in your post.

              https://forum.pfsense.org/index.php?topic=86212.msg549973#msg549973

              @Asterix:

              [ DNSBL_EasyList - w/o Elements ] Download FAIL
                Could not determine IP address of host.
                Firewall and/or IDS are not blocking download.

              Is the 'Header' set as "w/o Elements"… Don't add special characters or spaces... just call it "EasyList" and the other "EasyPrivacy" as the Header/Label. Did you configure the Categories for both lists? In the latest version 2.0.1, there is a fix which might help diagnose this issue for you.

              Removing "w/o" has fixed this. Thank you!

              1 Reply Last reply Reply Quote 0
              • H
                ha11oga11o
                last edited by

                @BBcan177:

                @ha11oga11o:

                Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

                Finally server started and i got data at logs.

                When you were at the Dashboard: Services Status Widget, if DNSBL was not running, it would have shown a red "X" and a single "Start" Icon". The "Restart" Icon is only visible when the service is already started?  Can you try to stop/start the DNSBL service from the Dashboard? I can't duplicate this issue?

                mine fault, it was only start which was doing nothing. Alsop nothing at system logs. Now, i tried to actually restart and works fine now.

                Cheers :)

                PS. At first post i wanted to quote this, sorry:

                Checklist:

                pfBlockerNG enabled in General Tab
                    DNSBL enabled in DNSBL Tab
                    VIP, port and ssl port defined in DNSBL Tab
                    DNS Resolver enabled

                Then run a 'Force Update'. If it still doesn't start, execute the following and see if it shows any additional info:
                Code: [Select]

                /usr/local/etc/rc.d/dnsbl.sh start

                1 Reply Last reply Reply Quote 0
                • T
                  trinidadrancheria
                  last edited by

                  I was thinking about using the new features of pfBlockerNG 2.0 to stop spam at the firewall since the current version of PostFix does not yet support DNSBL out of the box…
                  I was thinking of setting the list action to alias, then putting the firewall rules in to block all incoming from the sites. Problem I think is that the SpamHaus DNS list is a live list (query).... Is this supported?

                  1 Reply Last reply Reply Quote 0
                  • P
                    Panja
                    last edited by

                    I have installed pfBlockerNG v2.01 on my APU1D4 pfSense 2.2.5

                    I'm blocking a few countries for inbound traffic.
                    I also setup DNSBL as per post: https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943

                    I'm using OpenDNS in General Setup and DNS Resolver is enabled with the following options:
                    Enable Forwarding Mode (this is needed for my OpenDNS filtering)
                    Register DHCP leases in the DNS Resolver
                    Register DHCP static mappings in the DNS Resolver

                    All is working, ads are being blocked.
                    Only problem is when I reboot my box the Unbound Service is not started automatically (or is being stopped).
                    So with every reboot I do, I have to manually start the Unbound Service.

                    What could be the problem?

                    1 Reply Last reply Reply Quote 0
                    • H
                      hda
                      last edited by

                      @Panja:

                      …
                      So with every reboot I do, I have to manually start the Unbound Service.

                      What could be the problem?

                      You lost the pfb_dnsbl.conf, in Unbound(Advanced) conf, due to /var in RAM ?
                      Delete that line and do a pfB Force Update.

                      1 Reply Last reply Reply Quote 0
                      • P
                        Panja
                        last edited by

                        Nope… The line was there:
                        server:include: /var/unbound/pfb_dnsbl.conf

                        But I removed it, did a force update and rebooted.
                        Same problem.
                        Unbound is stopped when the reboot is done.

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          Try to set the Resolver without the two DHCP registration checkboxs enabled… See the first post in this thread :)

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • P
                            Panja
                            last edited by

                            I have read that post. :)

                            Disable the two "DHCP registrations" checkboxes, unless you really require those options.

                            I really require those, thats the reason I left them checked…  8)
                            Will uncheck them and check if it fixes things for me.

                            1 Reply Last reply Reply Quote 0
                            • P
                              Panja
                              last edited by

                              It indeed works now.  ;D
                              I will leave the two checkboxes unchecked and live without them.

                              Btw many thanks for bringing this awesome package to us BBcan177.
                              Much appreciated!

                              1 Reply Last reply Reply Quote 0
                              • A
                                AndrewZ
                                last edited by

                                @BBcan177:

                                This warning indicates that the masterfile is out of sync with the files in the /deny folder. This is a new feature that was added to v2.0 to warn users about this issue. Usually running a 'Force Reload' is sufficient to fix that warning; however, clearing out all the files and starting fresh might be needed in certain conditions. If this is still an issue, please review the pfblockerng.log file for other clues.

                                Re-installed and re-configured from scratch, nothing helps, the warning is still there.
                                No error in the log.
                                /var/db/pfblockerng/deny is empty (I have permit aliases only).

                                1 Reply Last reply Reply Quote 0
                                • P
                                  Panja
                                  last edited by

                                  I'm having another problem.
                                  All is working on my LAN interface but I have created a WIFI_GUEST interface.
                                  On the WIFI_GUEST interface it's not working. Some sites won't load at all.
                                  I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

                                  WIFI_GUEST firewall rules:

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    Jamerson
                                    last edited by

                                    Thank you so much,
                                    any suggestions how to configure this ?
                                    on the list of action, have to use disable or deny inbound ?

                                    I've configured deny inbound and enabled alexa list but the webserver isn't starting at all
                                    pfBlockerNG DNSBL Web Server is not started yet .

                                    what I am doing wrong ?

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      Hugovsky
                                      last edited by

                                      @Panja:

                                      I'm having another problem.
                                      All is working on my LAN interface but I have created a WIFI_GUEST interface.
                                      On the WIFI_GUEST interface it's not working. Some sites won't load at all.
                                      I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

                                      WIFI_GUEST firewall rules:

                                      You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        trinidadrancheria
                                        last edited by

                                        Does this only work with lists, or will it work with live dnsbl queries?

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          doktornotor Banned
                                          last edited by

                                          @trinidadrancheria:

                                          will it work with live dnsbl queries?

                                          No.

                                          1 Reply Last reply Reply Quote 0
                                          • H
                                            ha11oga11o
                                            last edited by

                                            Dear BBcan177 i just want to express my huge gratitude to you incorporating DNSBL. Im using it for couple of days so far. It is insane how god is behave on my network. It is really insane how good it is. It simply work and it blocks so much garbage that is almost impossible to believe.

                                            THANK YOU!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.