Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      Panja
      last edited by

      Nope… The line was there:
      server:include: /var/unbound/pfb_dnsbl.conf

      But I removed it, did a force update and rebooted.
      Same problem.
      Unbound is stopped when the reboot is done.

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        Try to set the Resolver without the two DHCP registration checkboxs enabled… See the first post in this thread :)

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • P
          Panja
          last edited by

          I have read that post. :)

          Disable the two "DHCP registrations" checkboxes, unless you really require those options.

          I really require those, thats the reason I left them checked…  8)
          Will uncheck them and check if it fixes things for me.

          1 Reply Last reply Reply Quote 0
          • P
            Panja
            last edited by

            It indeed works now.  ;D
            I will leave the two checkboxes unchecked and live without them.

            Btw many thanks for bringing this awesome package to us BBcan177.
            Much appreciated!

            1 Reply Last reply Reply Quote 0
            • A
              AndrewZ
              last edited by

              @BBcan177:

              This warning indicates that the masterfile is out of sync with the files in the /deny folder. This is a new feature that was added to v2.0 to warn users about this issue. Usually running a 'Force Reload' is sufficient to fix that warning; however, clearing out all the files and starting fresh might be needed in certain conditions. If this is still an issue, please review the pfblockerng.log file for other clues.

              Re-installed and re-configured from scratch, nothing helps, the warning is still there.
              No error in the log.
              /var/db/pfblockerng/deny is empty (I have permit aliases only).

              1 Reply Last reply Reply Quote 0
              • P
                Panja
                last edited by

                I'm having another problem.
                All is working on my LAN interface but I have created a WIFI_GUEST interface.
                On the WIFI_GUEST interface it's not working. Some sites won't load at all.
                I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

                WIFI_GUEST firewall rules:

                1 Reply Last reply Reply Quote 0
                • J
                  Jamerson
                  last edited by

                  Thank you so much,
                  any suggestions how to configure this ?
                  on the list of action, have to use disable or deny inbound ?

                  I've configured deny inbound and enabled alexa list but the webserver isn't starting at all
                  pfBlockerNG DNSBL Web Server is not started yet .

                  what I am doing wrong ?

                  1 Reply Last reply Reply Quote 0
                  • H
                    Hugovsky
                    last edited by

                    @Panja:

                    I'm having another problem.
                    All is working on my LAN interface but I have created a WIFI_GUEST interface.
                    On the WIFI_GUEST interface it's not working. Some sites won't load at all.
                    I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

                    WIFI_GUEST firewall rules:

                    You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.

                    1 Reply Last reply Reply Quote 0
                    • T
                      trinidadrancheria
                      last edited by

                      Does this only work with lists, or will it work with live dnsbl queries?

                      1 Reply Last reply Reply Quote 0
                      • D
                        doktornotor Banned
                        last edited by

                        @trinidadrancheria:

                        will it work with live dnsbl queries?

                        No.

                        1 Reply Last reply Reply Quote 0
                        • H
                          ha11oga11o
                          last edited by

                          Dear BBcan177 i just want to express my huge gratitude to you incorporating DNSBL. Im using it for couple of days so far. It is insane how god is behave on my network. It is really insane how good it is. It simply work and it blocks so much garbage that is almost impossible to believe.

                          THANK YOU!

                          1 Reply Last reply Reply Quote 0
                          • J
                            Jamerson
                            last edited by

                            cant get it to work,
                            the service is not starting." pfBlockerNG DNSBL Web Server "

                            rebooted the box, remove the package , reinstall it, no vail

                            please advise

                            1 Reply Last reply Reply Quote 0
                            • P
                              Panja
                              last edited by

                              @Hugovsky:

                              You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.

                              Thanks! It's working now. Created an alias for port 8081 + 8443 and added it to a rule to allow to 127.0.0.1
                              It was the "Block access to firewall" rule that prevented it to work, right?

                              This is the setup now, which is working. :)

                              1 Reply Last reply Reply Quote 0
                              • D
                                doktornotor Banned
                                last edited by

                                I think you guys are missing this (on the DNSBL tab) with multiple LANs:

                                1 Reply Last reply Reply Quote 0
                                • P
                                  Panja
                                  last edited by

                                  Nope, did not miss that.
                                  As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
                                  I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

                                  So I checked both interfaces (LAN + WIFI_GUEST) on the DNSBL tab.
                                  And after that I went to the floating rule and both interfaces were marked in that rule.

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by

                                    @Panja:

                                    Nope, did not miss that.
                                    As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
                                    I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

                                    Have hard time seeing how's that screenshot showing anything floating.

                                    1 Reply Last reply Reply Quote 0
                                    • P
                                      Panja
                                      last edited by

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        doktornotor Banned
                                        last edited by

                                        Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          Jamerson
                                          last edited by

                                          Guys, any suggestions why the webserver is not starting ?
                                          pfBlockerNG DNSBL Web Server is not starting,
                                          I've reinstalled the package but still no vail !

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            Panja
                                            last edited by

                                            @doktornotor:

                                            Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.

                                            How would you do it any differently than?
                                            I want my WIFI_GUEST interface to have no access to the firewall.
                                            Guests are not to be allowed to do anything except browse the internet.

                                            [UPDATE]

                                            Is this any better than.  8)
                                            I have blocked the admin ports (http/https + ssh) to the firewall instead of all.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.