• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG

Scheduled Pinned Locked Moved pfBlockerNG
1.2k Posts 210 Posters 1.9m Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B
    BBcan177 Moderator
    last edited by Dec 20, 2015, 4:05 AM

    @bluepr0:

    In any case, for domains that I WANT to block… should I accept the cert? It' just I'm a bit lost about what it means accepting it and why it shows up!

    When the browser makes an HTTPs request to a domain that is blacklisted by DNSBL, The Resolver (Unbound) forwards the browser to the DNSBL webserver, however the browser sees that the DNSBL webservers certificate is not the same as the domain that it requested, so it reports the cert error. Other browsers like Chrome and Firefox, just drop the failed connection attempts. Safari and IE are always behind the times it seems. If Safari allows accepting the cert, then go ahead. It shouldn't tho as its not the correct certificate. The last thing that you want is to Man-In-The-middle the HTTPs traffic and impersonate a domain. Lots of bad things happen when you do that…

    More details here:
    https://forum.pfsense.org/index.php?topic=102470.msg573329#msg573329

    "Experience is something you don't get until just after you need it."

    Website: http://pfBlockerNG.com
    Twitter: @BBcan177  #pfBlockerNG
    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

    1 Reply Last reply Reply Quote 0
    • H
      heliop100
      last edited by Dec 20, 2015, 7:44 PM

      Hil,

      I want to allow NAT to my servers only from IPs in Brazil, so I use one country list (alias permit), and use that list as source on my NAT rule. Working as expected.

      But I use DNS failover from DNS Made Easy, and monitoring from Uptime Robot, and both are been blocked.

      For now I create a second alias, and setup a second NAT.

      Are some way to merge both lists? When I try to create one new alias with both alias on, I receive one error that it's not possible because the to aliases are from different types.

      Thanks

      1 Reply Last reply Reply Quote 0
      • B
        BBcan177 Moderator
        last edited by Dec 21, 2015, 5:30 AM

        @heliop100:

        Are some way to merge both lists? When I try to create one new alias with both alias on, I receive one error that it's not possible because the to aliases are from different types.

        Please see the following links:
        https://forum.pfsense.org/index.php?topic=102071.0
        https://forum.pfsense.org/index.php?topic=86212.msg548324#msg548324
        https://forum.pfsense.org/index.php?topic=86212.msg553921#msg553921

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • S
          spencerthomass
          last edited by Dec 21, 2015, 7:57 AM

          I have been playing around with pfblockerng and so far I love it. I have found one problem though. I use some blacklists from squidblacklist.org and they work great except if you put www in front of the domain. For example, playboy.com is blocked but www,playboy.com is not. Anyway to fix this?

          1 Reply Last reply Reply Quote 0
          • B
            BBcan177 Moderator
            last edited by Dec 21, 2015, 3:22 PM

            @spencerthomass:

            I have been playing around with pfblockerng and so far I love it. I have found one problem though. I use some blacklists from squidblacklist.org and they work great except if you put www in front of the domain. For example, playboy.com is blocked but www,playboy.com is not. Anyway to fix this?

            Did you manually add the www. domain to a customlist? If so, make sure to select "Update custom list' at the bottom of the page before running a "Force Update"

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • S
              spencerthomass
              last edited by Dec 21, 2015, 3:24 PM

              @BBcan177:

              @spencerthomass:

              I have been playing around with pfblockerng and so far I love it. I have found one problem though. I use some blacklists from squidblacklist.org and they work great except if you put www in front of the domain. For example, playboy.com is blocked but www,playboy.com is not. Anyway to fix this?

              Did you manually add the www. domain to a customlist? If so, make sure to select "Update custom list' at the bottom of the page before running a "Force Update"

              No, I used the porn block list from squidblacklist.org.

              1 Reply Last reply Reply Quote 0
              • B
                BBcan177 Moderator
                last edited by Dec 21, 2015, 3:42 PM

                @spencerthomass:

                @BBcan177:

                @spencerthomass:

                I have been playing around with pfblockerng and so far I love it. I have found one problem though. I use some blacklists from squidblacklist.org and they work great except if you put www in front of the domain. For example, playboy.com is blocked but www,playboy.com is not. Anyway to fix this?

                Did you manually add the www. domain to a customlist? If so, make sure to select "Update custom list' at the bottom of the page before running a "Force Update"

                No, I used the porn block list from squidblacklist.org.

                The issue there is that DNSBL (unbound) will need to add an extra line for each domain (in bold)

                local-zone: "doubleclick.net" redirect
                local-data: "doubleclick.net A 10.0.0.111"

                It can cause some false positives depending on the domain name… Some ADvert servers like:

                ads.example.com

                You want to block just the ads.example.com and not example.com...

                I will see if I can come up with a workaround for that... In the short term, you can add any additional domains to a custom list and block them that way.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • S
                  spencerthomass
                  last edited by Dec 21, 2015, 3:59 PM

                  @BBcan177:

                  @spencerthomass:

                  @BBcan177:

                  @spencerthomass:

                  I have been playing around with pfblockerng and so far I love it. I have found one problem though. I use some blacklists from squidblacklist.org and they work great except if you put www in front of the domain. For example, playboy.com is blocked but www,playboy.com is not. Anyway to fix this?

                  Did you manually add the www. domain to a customlist? If so, make sure to select "Update custom list' at the bottom of the page before running a "Force Update"

                  No, I used the porn block list from squidblacklist.org.

                  The issue there is that DNSBL (unbound) will need to add an extra line for each domain (in bold)

                  local-zone: "doubleclick.net" redirect
                  local-data: "doubleclick.net A 10.0.0.111"

                  It can cause some false positives depending on the domain name… Some ADvert servers like:

                  ads.example.com

                  You want to block just the ads.example.com and not example.com...

                  I will see if I can come up with a workaround for that... In the short term, you can add any additional domains to a custom list and block them that way.

                  I was scared you would say that. There are around 1 million domains on the list and it would take a very long time to make a custom list.

                  1 Reply Last reply Reply Quote 0
                  • B
                    BBcan177 Moderator
                    last edited by Dec 21, 2015, 4:25 PM

                    Here is a temporary workaround. Edit the file  /usr/local/pkg/pfblockerng/pfblockerng.inc

                    And add this code after Line 2758

                    
                    if (substr($line, 0, 4) != 'www.') {
                            $domain_data .= "local-data: \"www." . $line . " 60 IN A {$pfb['dnsbl_vip']}\"\n";
                    }
                    
                    

                    https://github.com/pfsense/pfsense-packages/blob/master/config/pfblockerng/pfblockerng.inc#L2758

                    So it will look like this:

                    
                    // Remove suppressed domain names
                    if (!in_array($line, $pfb_dnssupp)) {
                            $domain_data .= "local-data: \"" . $line . " 60 IN A {$pfb['dnsbl_vip']}\"\n";
                            if (substr($line, 0, 4) != 'www.') {
                                    $domain_data .= "local-data: \"www." . $line . " 60 IN A {$pfb['dnsbl_vip']}\"\n";
                            }
                    }
                    
                    

                    Then execute a "Force Reload" for DNSBL.

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • S
                      spencerthomass
                      last edited by Dec 21, 2015, 4:43 PM

                      Thank you BBcan177. That works.

                      1 Reply Last reply Reply Quote 0
                      • A
                        abujammy
                        last edited by Dec 31, 2015, 8:55 PM

                        @BBcan177 what do you think about adding a format so that we can import "host" file formats and it can parse out the domain name to lookup the IP?

                        So basically I believe like the "whois" works but it just knows that the first part of the line is an IP that doesn't matter.

                        0.0.0.0 facebook.com
                        127.0.0.1 google.com
                        

                        Like that.

                        There are a lot of good, free lists out there that are in this format.

                        Thoughts?

                        1 Reply Last reply Reply Quote 0
                        • B
                          BBcan177 Moderator
                          last edited by Dec 31, 2015, 8:58 PM

                          If your talking about DNSBL, the parser is already there to parse for the domain name in a host feed…  Try it and if there are issues with the parser, send me the URL if it doesn't work.

                          Have you seen this thread:
                          https://forum.pfsense.org/index.php?topic=102470.0

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • A
                            abujammy
                            last edited by Dec 31, 2015, 11:52 PM

                            @BBcan177 man, that's perfect.  I cannot tell you how much your work helps me out.  Thank you so much for all that you do.  pfBlocker is amazing. :)

                            1 Reply Last reply Reply Quote 0
                            • C
                              chain
                              last edited by Jan 1, 2016, 4:50 PM Jan 1, 2016, 6:38 AM

                              i get this error when saving pfblockerng

                              Fatal error: Cannot unset string offsets in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 3921

                              I have setup that iblock_level3 url, that block ip address, how do I excluded a set of IP address from being blocked?

                              1 Reply Last reply Reply Quote 0
                              • H
                                heliop100
                                last edited by Jan 2, 2016, 9:06 PM

                                @BBcan177:

                                @heliop100:

                                Are some way to merge both lists? When I try to create one new alias with both alias on, I receive one error that it's not possible because the to aliases are from different types.

                                Please see the following links:
                                https://forum.pfsense.org/index.php?topic=102071.0
                                https://forum.pfsense.org/index.php?topic=86212.msg548324#msg548324
                                https://forum.pfsense.org/index.php?topic=86212.msg553921#msg553921

                                Hi, Thanks a lot.
                                Happy new year!!!

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kreindler
                                  last edited by Jan 2, 2016, 9:22 PM

                                  I have a fresh install of a pfsense 2.2.6 on a watchguard.

                                  Now, I am having some issues with the installation of several packages, one of which is pfBlockerNG.

                                  The package seems to install properly, no error during the installation, but it doesn't appear anywhere in the console.
                                  I had it installed before, on the 2.2.2 variant, and it worked as expected.

                                  I thought it was just an interface glitch, and tried to reinstall the package.

                                  Still not luck, so I used the "reinstall gui" option.

                                  Still no luck, so I tried manually addressing>
                                  https://192.168.1.1/pfblockerng/pfblockerng_alerts.php (which I had cached in my browser).

                                  This also didn't work.

                                  PS: between the reinstalls I have also rebooted the appliance.

                                  1 Reply Last reply Reply Quote 0
                                  • V
                                    vwgti
                                    last edited by Jan 3, 2016, 10:33 PM Jan 3, 2016, 10:24 PM

                                    I'm trying to whitelist access to a website behind my firewall to my own country only.

                                    When I create a Country list action as an 'alias permit' then use the resulting alias as the Source for the existing website NAT rule, it breaks my internal network access to the site. NAT Refelction is set to Enable (NAT + Proxy), what am i missing here?

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      trumee
                                      last edited by Jan 4, 2016, 2:15 AM

                                      I am starting to get errors. I guess the lists i am using are old. Where do i get the new list?

                                      pfblockerng.log

                                      
                                      [ Abuse_SSLBL ]		 Downloading update [ 01/02/16 6:01:12 ] .. 200 OK. completed ..
                                      
                                      [ dShield_Block ]	 Downloading update [ 01/02/16 6:01:13 ] . cURL Error: 51
                                      SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds...
                                      . cURL Error: 51
                                      SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds...
                                      . cURL Error: 51
                                      SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds...
                                      .. unknown http status code 
                                      
                                       [ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/02/16 6:01:29 ]
                                        Firewall and/or IDS are not blocking download.
                                      
                                      The Following list has been REMOVED [ dShield_Block ]
                                      
                                      [ Snort_BL ]		 Downloading update [ 01/02/16 6:01:30 ] . cURL Error: 60
                                      SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds...
                                      . cURL Error: 60
                                      SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds...
                                      . cURL Error: 60
                                      SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds...
                                      .. unknown http status code 
                                      
                                       [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/02/16 6:01:46 ]
                                        Firewall and/or IDS are not blocking download.
                                      
                                      The Following list has been REMOVED [ Snort_BL ]
                                      
                                      [ BBC_Goz ]		 exists. 
                                      [ Alienvault ]		 Downloading update  .. 200 OK.. completed ..
                                      
                                      

                                      error.log

                                      
                                      [ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/03/16 20:11:11 ]
                                        Firewall and/or IDS are not blocking download.
                                      . unknown http status code 
                                      
                                       [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/03/16 20:11:28 ]
                                        Firewall and/or IDS are not blocking download.
                                      . unknown http status code 
                                      
                                       [ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:11:47 ]
                                       [ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ]
                                      . unknown http status code 
                                      
                                       [ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:12:04 ]
                                       [ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ]
                                      . unknown http status code 
                                      
                                       [ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/03/16 20:13:12 ]
                                        Firewall and/or IDS are not blocking download.
                                      . unknown http status code 
                                      
                                       [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/03/16 20:13:29 ]
                                        Firewall and/or IDS are not blocking download.
                                      . unknown http status code 
                                      
                                       [ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:13:46 ]
                                       [ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ]
                                      . unknown http status code 
                                      
                                       [ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:14:08 ]
                                       [ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ]
                                      
                                      
                                      1 Reply Last reply Reply Quote 0
                                      • RonpfSR
                                        RonpfS
                                        last edited by Jan 4, 2016, 2:38 AM

                                        You can change the Lists state to FLEX for those lists and see if this help.

                                        2.4.5-RELEASE-p1 (amd64)
                                        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          Amuzed2pieces
                                          last edited by Jan 4, 2016, 7:51 PM

                                          PfBlockeNG sounds really great, but after reading through about 500 posts I found a few people requesting a shorter tutorial, but no one has responded to those request.

                                          Is there a concise guide to setting up and configuring PfblockerNG 2.0.4?  I could eliminate a lot of repetitive questions.

                                          I'd rather learn from the mistakes of others, than stay up to 2am trying figure out what setting I goofed.

                                          Thanks

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received