PfBlockerNG v2.0 w/DNSBL

Panja

You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.

Thanks! It's working now. Created an alias for port 8081 + 8443 and added it to a rule to allow to 127.0.0.1
It was the "Block access to firewall" rule that prevented it to work, right?

This is the setup now, which is working. :)

doktornotor

I think you guys are missing this (on the DNSBL tab) with multiple LANs:

Panja

Nope, did not miss that.
As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

So I checked both interfaces (LAN + WIFI_GUEST) on the DNSBL tab.
And after that I went to the floating rule and both interfaces were marked in that rule.

doktornotor

@Panja:

Nope, did not miss that.
As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

Have hard time seeing how's that screenshot showing anything floating.

Panja

doktornotor

Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.

Jamerson

Guys, any suggestions why the webserver is not starting ?
pfBlockerNG DNSBL Web Server is not starting,
I've reinstalled the package but still no vail !

Panja

@doktornotor:

Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.

How would you do it any differently than?
I want my WIFI_GUEST interface to have no access to the firewall.
Guests are not to be allowed to do anything except browse the internet.

[UPDATE]

Is this any better than. 8)
I have blocked the admin ports (http/https + ssh) to the firewall instead of all.

Gertjan

@Panja:

I want my WIFI_GUEST interface to have no access to the firewall.
Guests are not to be allowed to do anything except browse the internet.

Understandable. I thing the same way.
I did the same thing as you, and added 'sensitive ports' …..
See image.

CPFW.png_thumb

Panja

Thanks fellow Dutchman. ;D
I have created an alias with the admin ports now as well.
See post above –> [UPDATE]

doktornotor

@Jamerson:

Guys, any suggestions why the webserver is not starting ?
pfBlockerNG DNSBL Web Server is not starting,

Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

Copy and paste this to Diagnostics - Command Prompt - PHP Execute, click the 'Execute' button and problem fixed.


$pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
$rc = array();
$rc['file'] = 'dnsbl.sh';
$rc['start'] = << <eof<br># Start DNSBL Lighttpd webserver
	if [ -f '{$pfb['dnsbl_conf']}' ]; then
		/usr/local/sbin/lighttpd_pfb -f '{$pfb['dnsbl_conf']}'
	fi

	# Terminate DNSBL HTTPS Daemon if found
	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
	if [ ! -z "\${pidnum}" ]; then
		/bin/kill -9 "\${pidnum}"
		/bin/sleep 2
	fi

	# Start DNSBL HTTPS Daemon
	/usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &

EOF;

$rc['stop'] = << <eof<br># Terminate DNSBL Lighttpd webserver, if found.
	pidnum="$(/bin/pgrep lighttpd_pfb)"
	if [ ! -z "\${pidnum}" ]; then
		/usr/bin/killall lighttpd_pfb
	fi

	# Terminate DNSBL HTTPS Daemon, if found.
	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
	if [ ! -z "\${pidnum}" ]; then
		/bin/kill -9 "\${pidnum}"
		/bin/sleep 2
	fi

EOF;

write_rcfile($rc);

mwexec("/usr/bin/sed -i -e 's/\r//g' /usr/local/etc/rc.d/dnsbl.sh");
mwexec_bg("/usr/local/etc/rc.d/dnsbl.sh start");</eof<br></eof<br>

Panja

Is there a way, or will there be a way (in a future release) to add our own EasyList?
As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

Thanks

Jamerson

@doktornotor:

@Jamerson:

Guys, any suggestions why the webserver is not starting ?
pfBlockerNG DNSBL Web Server is not starting,

Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

Copy and paste this to Diagnostics - Command Prompt - PHP Execute, click the 'Execute' button and problem fixed.


$pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
$rc = array();
$rc['file'] = 'dnsbl.sh';
$rc['start'] = << <eof<br># Start DNSBL Lighttpd webserver
	if [ -f '{$pfb['dnsbl_conf']}' ]; then
		/usr/local/sbin/lighttpd_pfb -f '{$pfb['dnsbl_conf']}'
	fi

	# Terminate DNSBL HTTPS Daemon if found
	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
	if [ ! -z "\${pidnum}" ]; then
		/bin/kill -9 "\${pidnum}"
		/bin/sleep 2
	fi

	# Start DNSBL HTTPS Daemon
	/usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &

EOF;

$rc['stop'] = << <eof<br># Terminate DNSBL Lighttpd webserver, if found.
	pidnum="$(/bin/pgrep lighttpd_pfb)"
	if [ ! -z "\${pidnum}" ]; then
		/usr/bin/killall lighttpd_pfb
	fi

	# Terminate DNSBL HTTPS Daemon, if found.
	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
	if [ ! -z "\${pidnum}" ]; then
		/bin/kill -9 "\${pidnum}"
		/bin/sleep 2
	fi

EOF;

write_rcfile($rc);

mwexec("/usr/bin/sed -i -e 's/\r//g' /usr/local/etc/rc.d/dnsbl.sh");
mwexec_bg("/usr/local/etc/rc.d/dnsbl.sh start");</eof<br></eof<br>

thank you mate,
runned the php code but nothing happens .

I get this error

Diagnostics: Execute command help

Note: this function is unsupported. Use it on your own risk!

rebooted the firewall but the services still not starting

doktornotor

And what exactly did you expect to happen? Check that the service is running. If not, post the output of


/usr/local/etc/rc.d/dnsbl.sh start

here. And post the entire file here as attachment.

Jamerson

@doktornotor:

And what exactly did you expect to happen? Check that the service is running. If not, post the output of
/usr/local/etc/rc.d/dnsbl.sh start
here. And post the entire file here as attachment.

thank you for your answer,
I was expecting the service would start after I run the command.
isn't that the aim ?
when I run the command the firewall doesn't respond at all !
i'v tired different command to check if it will responde and it does.

the command

[2.2.5-RELEASE][root@firewall]/root: /usr/local/etc/rc.d/dnsbl.sh start

[2.2.5-RELEASE][root@Pfsense]/root:
[2.2.5-RELEASE][root@Pfsense]/root:

is not responding at all.

doktornotor

Uhm??? And what output exactly are you expecting? This is NORMAL! If there are no errors, there won't be any output. How exactly are you determining that your service is NOT running?

Jamerson

Than you for your answer,
attached picture is showing that the services is not running .
when i try to run the service manually it said it started but nothings happend

thank you

![Screen Shot 2015-11-25 at 9.13.32 PM.png](/public/imported_attachments/1/Screen Shot 2015-11-25 at 9.13.32 PM.png)
![Screen Shot 2015-11-25 at 9.13.32 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-11-25 at 9.13.32 PM.png_thumb)

schnubert

Hi!

I am having a short question to the different aliases for the different lists as suggested here https://forum.pfsense.org/index.php?topic=102470.msg573159#msg573159.
So, apart from having the possibility to set a different update-interval is thtere another benefitout of it?

thanks in advance and many thanks to BBCan177 :)!

doktornotor

V@schnubert:

So, apart from having the possibility to set a different update-interval is thtere another benefitout of it?

The Alexa whitelisting is also per-alias. (You normally do NOT want to whitelist most "popular" advertising sites…)

schnubert

Valid point… ;)

I wasnt investing Alexa so far, it seems I should!

thanks! :D