Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      @Panja:

      Nope, did not miss that.
      As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
      I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

      Have hard time seeing how's that screenshot showing anything floating.

      1 Reply Last reply Reply Quote 0
      • P
        Panja
        last edited by

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by

          Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.

          1 Reply Last reply Reply Quote 0
          • J
            Jamerson
            last edited by

            Guys, any suggestions why the webserver is not starting ?
            pfBlockerNG DNSBL Web Server is not starting,
            I've reinstalled the package but still no vail !

            1 Reply Last reply Reply Quote 0
            • P
              Panja
              last edited by

              @doktornotor:

              Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.

              How would you do it any differently than?
              I want my WIFI_GUEST interface to have no access to the firewall.
              Guests are not to be allowed to do anything except browse the internet.

              [UPDATE]

              Is this any better than.  8)
              I have blocked the admin ports (http/https + ssh) to the firewall instead of all.

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan
                last edited by

                @Panja:

                I want my WIFI_GUEST interface to have no access to the firewall.
                Guests are not to be allowed to do anything except browse the internet.

                Understandable. I thing the same way.
                I did the same thing as you, and added 'sensitive ports' …..
                See image.

                CPFW.png
                CPFW.png_thumb

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • P
                  Panja
                  last edited by

                  Thanks fellow Dutchman.  ;D
                  I have created an alias with the admin ports now as well.
                  See post above –> [UPDATE]

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    @Jamerson:

                    Guys, any suggestions why the webserver is not starting ?
                    pfBlockerNG DNSBL Web Server is not starting,

                    Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

                    Copy and paste this to Diagnostics - Command Prompt - PHP Execute, click the 'Execute' button and problem fixed.

                    
                    $pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
                    $rc = array();
                    $rc['file'] = 'dnsbl.sh';
                    $rc['start'] = << <eof<br># Start DNSBL Lighttpd webserver
                    	if [ -f '{$pfb['dnsbl_conf']}' ]; then
                    		/usr/local/sbin/lighttpd_pfb -f '{$pfb['dnsbl_conf']}'
                    	fi
                    
                    	# Terminate DNSBL HTTPS Daemon if found
                    	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
                    	if [ ! -z "\${pidnum}" ]; then
                    		/bin/kill -9 "\${pidnum}"
                    		/bin/sleep 2
                    	fi
                    
                    	# Start DNSBL HTTPS Daemon
                    	/usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &
                    
                    EOF;
                    
                    $rc['stop'] = << <eof<br># Terminate DNSBL Lighttpd webserver, if found.
                    	pidnum="$(/bin/pgrep lighttpd_pfb)"
                    	if [ ! -z "\${pidnum}" ]; then
                    		/usr/bin/killall lighttpd_pfb
                    	fi
                    
                    	# Terminate DNSBL HTTPS Daemon, if found.
                    	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
                    	if [ ! -z "\${pidnum}" ]; then
                    		/bin/kill -9 "\${pidnum}"
                    		/bin/sleep 2
                    	fi
                    
                    EOF;
                    
                    write_rcfile($rc);
                    
                    mwexec("/usr/bin/sed -i -e 's/\r//g' /usr/local/etc/rc.d/dnsbl.sh");
                    mwexec_bg("/usr/local/etc/rc.d/dnsbl.sh start");</eof<br></eof<br> 
                    
                    1 Reply Last reply Reply Quote 0
                    • P
                      Panja
                      last edited by

                      Is there a way, or will there be a way (in a future release) to add our own EasyList?
                      As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

                      Thanks

                      1 Reply Last reply Reply Quote 0
                      • J
                        Jamerson
                        last edited by

                        @doktornotor:

                        @Jamerson:

                        Guys, any suggestions why the webserver is not starting ?
                        pfBlockerNG DNSBL Web Server is not starting,

                        Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

                        Copy and paste this to Diagnostics - Command Prompt - PHP Execute, click the 'Execute' button and problem fixed.

                        
                        $pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
                        $rc = array();
                        $rc['file'] = 'dnsbl.sh';
                        $rc['start'] = << <eof<br># Start DNSBL Lighttpd webserver
                        	if [ -f '{$pfb['dnsbl_conf']}' ]; then
                        		/usr/local/sbin/lighttpd_pfb -f '{$pfb['dnsbl_conf']}'
                        	fi
                        
                        	# Terminate DNSBL HTTPS Daemon if found
                        	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
                        	if [ ! -z "\${pidnum}" ]; then
                        		/bin/kill -9 "\${pidnum}"
                        		/bin/sleep 2
                        	fi
                        
                        	# Start DNSBL HTTPS Daemon
                        	/usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &
                        
                        EOF;
                        
                        $rc['stop'] = << <eof<br># Terminate DNSBL Lighttpd webserver, if found.
                        	pidnum="$(/bin/pgrep lighttpd_pfb)"
                        	if [ ! -z "\${pidnum}" ]; then
                        		/usr/bin/killall lighttpd_pfb
                        	fi
                        
                        	# Terminate DNSBL HTTPS Daemon, if found.
                        	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
                        	if [ ! -z "\${pidnum}" ]; then
                        		/bin/kill -9 "\${pidnum}"
                        		/bin/sleep 2
                        	fi
                        
                        EOF;
                        
                        write_rcfile($rc);
                        
                        mwexec("/usr/bin/sed -i -e 's/\r//g' /usr/local/etc/rc.d/dnsbl.sh");
                        mwexec_bg("/usr/local/etc/rc.d/dnsbl.sh start");</eof<br></eof<br> 
                        

                        thank you mate,
                        runned the php code but nothing happens .

                        I get this error

                        Diagnostics: Execute command help

                        Note: this function is unsupported. Use it on your own risk!

                        rebooted the firewall but the services still not starting

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          And what exactly did you expect to happen? Check that the service is running. If not, post the output of

                          
                          /usr/local/etc/rc.d/dnsbl.sh start
                          
                          

                          here. And post the entire file here as attachment.

                          1 Reply Last reply Reply Quote 0
                          • J
                            Jamerson
                            last edited by

                            @doktornotor:

                            And what exactly did you expect to happen? Check that the service is running. If not, post the output of

                            
                            /usr/local/etc/rc.d/dnsbl.sh start
                            
                            

                            here. And post the entire file here as attachment.

                            thank you for your answer,
                            I was expecting the service would start after I run the command.
                            isn't that the aim ?
                            when I run the command the firewall doesn't respond at all !
                            i'v tired different command to check if it will responde and it does.

                            the command

                            [2.2.5-RELEASE][root@firewall]/root: /usr/local/etc/rc.d/dnsbl.sh start

                            [2.2.5-RELEASE][root@Pfsense]/root:
                            [2.2.5-RELEASE][root@Pfsense]/root:

                            is not responding at all.

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              Uhm??? And what output exactly are you expecting? This is NORMAL! If there are no errors, there won't be any output. How exactly are you determining that your service is NOT running?

                              1 Reply Last reply Reply Quote 0
                              • J
                                Jamerson
                                last edited by

                                Than you for your answer,
                                attached picture is showing that the services is not running .
                                when i try to run the service manually it said it started but nothings happend

                                thank you

                                ![Screen Shot 2015-11-25 at 9.13.32 PM.png](/public/imported_attachments/1/Screen Shot 2015-11-25 at 9.13.32 PM.png)
                                ![Screen Shot 2015-11-25 at 9.13.32 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-11-25 at 9.13.32 PM.png_thumb)

                                1 Reply Last reply Reply Quote 0
                                • S
                                  schnubert
                                  last edited by

                                  Hi!

                                  I am having a short question to the different aliases for the different lists as suggested here https://forum.pfsense.org/index.php?topic=102470.msg573159#msg573159.
                                  So, apart from having the possibility to set a different update-interval is thtere another benefitout of it?

                                  thanks in advance and many thanks to BBCan177  :)!

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by

                                    V@schnubert:

                                    So, apart from having the possibility to set a different update-interval is thtere another benefitout of it?

                                    The Alexa whitelisting is also per-alias. (You normally do NOT want to whitelist most "popular" advertising sites…)

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      schnubert
                                      last edited by

                                      Valid point…  ;)

                                      I wasnt investing Alexa so far, it seems I should!

                                      thanks!  :D

                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        Gerard64
                                        last edited by

                                        Today I updated PfblockerNG to version 2.0.1 and enabled and configured DNSBL like BBcan177 explained at https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943 after some fiddling around (I exchanged dnsforwarder with dnsresolver) it started. But now I have another problem I can't solve. I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

                                        How can I make reverse lookups work again?

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          @trinidadrancheria:

                                          I was thinking about using the new features of pfBlockerNG 2.0 to stop spam at the firewall since the current version of PostFix does not yet support DNSBL out of the box..

                                          IP lists and DNSBL feeds can protect a Mail server, but it won't replace DNS RBL functionality of Postfix/SpamAssassin etc…

                                          @AndrewZ:

                                          Re-installed and re-configured from scratch, nothing helps, the warning is still there.
                                          No error in the log.
                                          /var/db/pfblockerng/deny is empty (I have permit aliases only).

                                          @AndrewZ,
                                          De-duplication is only used for Deny rules. So just disable dedup to clear that warning message.

                                          @ha11oga11o:

                                          Dear BBcan177 i just want to express my huge gratitude to you incorporating DNSBL. Im using it for couple of days so far. It is insane how god is behave on my network. It is really insane how good it is. It simply work and it blocks so much garbage that is almost impossible to believe.

                                          THANK YOU!

                                          Thanks!

                                          @doktornotor:

                                          Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

                                          Thanks Dok… I will get that variable fixed asap.

                                          @schnubert:

                                          So, apart from having the possibility to set a different update-interval is there another benefit out of it?

                                          @schnubert,
                                          Most DNSBL lists are updated on a daily basis… hpHosts has a partial feed that updates more frequently. You can see the last updated timestamp for IP/DNSBL Lists/feeds at the end of the pfBlockerng.log after any Cron event.

                                          @Gé:

                                          I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

                                          Probably best to ask for help in the DNS forum section for this issue.

                                          @Jamerson:

                                          Than you for your answer, attached picture is showing that the services is not running .
                                          when i try to run the service manually it said it started but nothings happened

                                          @Jamerson,
                                          Please edit the following file  /usr/local/etc/rc.d/dnsbl.sh

                                          and add the line in red as shown below:

                                          186 update_static_output(" done.\nCreating DNSBL web server start-up script…");
                                                $pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
                                          187 $rc = array();

                                          Then run:

                                          /usr/local/etc/rc.d/dnsbl.sh start
                                          

                                          Also did you follow the checklist here:
                                          https://forum.pfsense.org/index.php?topic=102470.msg573776#msg573776

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            Panja
                                            last edited by

                                            @Panja:

                                            Is there a way, or will there be a way (in a future release) to add our own EasyList?
                                            As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

                                            Thanks

                                            Can this be done?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.