Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      @Gé:

      How can I make a whitelist for pfblocker or more for dnsbl?
      I created a alias with 2 test domains and set it as the first floating rule but that didn't work the 2 test domains can't be reached.

      How do i do this the best way?

      The IP rules are independent of DNSBL…

      Currently, you can't create access-control type refinements in DNSBL. If you want to have some devices to bypass DNSBL, then those devices need to use a different DNS server. I have plans for improvement in this area, but that involves enabling python support in Unbound and designing a python script for DNSBL

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • G
        Gerard64
        last edited by

        Sounds complicated.
        Good luck with this future improvement.

        Using a alternative DNS is a good enough solution to reach a site I can't reach thru dnsbl wen needed.

        Thank you!

        1 Reply Last reply Reply Quote 0
        • H
          hda
          last edited by

          @Gé:

          …Using a alternative...

          pfBlockerNG: DNSBL: Settings (Custom Domain Suppression) ? No ?

          1 Reply Last reply Reply Quote 0
          • Y
            yea
            last edited by

            @BBcan177:

            Hi yea,

            When you hit "save" to update that DNSBL list, do you know if the pfBNG cron task might have been running in the background at the same time? Can you see the pfblockerng.log?

            Hi BBcan177 nothing warned me of such. Couldn't prove either way I'm afraid.

            1 Reply Last reply Reply Quote 0
            • C
              chadb
              last edited by

              I am seeing an issue where the pages with ads can take up to 20 seconds to timeout prior to loading the page…

              Example:  landsend.com will sit blank for 20 seconds waiting on assets.adobedtm.com, then loads immediately.

              Our DNSBL webserver is set at 192.168.192.168 and i can ping it from my computer, it is also set to allow all traffic to/from this address in the floating rules.

              My internal network is 10.0.0.0/12 and Guest network is in 172.16.0.0/16 range.

              I have followed all the instructions in this forum, and all is working well, except this delay between DNSBL and the computer.

              Are there any more tests i can do to check the connection to the DNSBL webserver?  If I browse to the IP or request a jpg file it times out.

              Thanks for any help or suggestions.

              -Chad

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @chadb:

                I am seeing an issue where the pages with ads can take up to 20 seconds to timeout prior to loading the page…
                If I browse to the IP or request a jpg file it times out.

                Hi Chad,

                You have to check your Firewall/NAT rules to see if a rule is blocking access to the DNSBL VIP from your LAN. Without fixing that you will get timeouts as you are experiencing.  You have to ensure that you can ping and browse to the VIP.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • J
                  Jamerson
                  last edited by

                  @BBcan177:

                  I have hard coded some domains so that they can't be suppressed ;) <kidding>Run the following command to see if the domain is in the DNSBL list:
                  grep "example.com" /var/unbound/pfb_dnsbl.conf

                  pinging those domains should also resolve to the DNSBL VIP address.

                  If the domain is listed there, then check to see if your device DNS is pointed to the Resolver, and is not resolving from to a different DNS server…</kidding>

                  if I ping the domains its resolve the DNSBL IP 10.10.10.1
                  now somehow stuff start working and it blocks the sites.
                  maybe it needed time ? I didn't change anything from side .

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    I have posted a Pull Request #1223:

                    • Fix 'Match Outbound' rule variable name

                    • Remove duplicate Alexa variable as its already in pfb_global()

                    • Determine if a DNSBL background reload is running before updating DNSBL

                    • Change "${cmd}"  variable name to  "{$cmd}"

                    • Add $pfb['ccdir'] explicitly due to file caching issue.

                    • Fix dShield URL

                    • Add tcpiputils to DNSBL Domain threat lookup

                    • Add log size settings (5000 & 10000 lines) for limited storage installations. (Not recommended)

                    • Add Paypal 'support the Developer' link

                    • Remove extra whitespace

                    Also, the following issue was included in Pull Request #1219

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @BBcan177:

                      I have posted a Pull Request #1223:

                      PR has been merged. pfBlockerNG v2.0.4

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • C
                        captain1980
                        last edited by

                        I have a question of running VPN next to/ together with DNSBL.

                        On my laptop and Iphone/ Ipad i have client software running PIA VPN.  With the VPN on nothing seem to be blocked, when switched of DNSBL is working. This is confirmed in the alerts tab and log.

                        Is it not possible to run VPN and DNSBL ? My understanding of the system is still limited. Hope you guys could point me in the right direction.

                        Greets,

                        HJ

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          @captain1980:

                          Is it not possible to run VPN and DNSBL ? My understanding of the system is still limited.

                          I don't personally use a VPM like PIA, but the only way for DNSBL to function, is if the pfSense Resolver is used for the DNS requests. If the VPN uses a different DNS server, then DNSBL will not block any domains…

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • C
                            captain1980
                            last edited by

                            Ok thanks for the reply.

                            Is it possible to use another DNS then the one from the VPN server to use both systems.

                            When i run the VPN and DNSBL the NTp clock syc & dns resoler go "off" and then nothing works anymore.

                            Hj

                            1 Reply Last reply Reply Quote 0
                            • R
                              Ramosel
                              last edited by

                              @BBcan177:

                              I don't personally use a VPM like PIA, but the only way for DNSBL to function, is if the pfSense Resolver is used for the DNS requests. If the VPN uses a different DNS server, then DNSBL will not block any domains…

                              I think I understand the issue when running a PIA client on a device behind the pfSense system.

                              Does this issue exist if you use pfSense/OpenVPN system as the VPN client?  If so, is the fix as simple as using PIA's DNS values in pfSense?

                              1 Reply Last reply Reply Quote 0
                              • C
                                captain1980
                                last edited by

                                Using the DNS of the VPN server did not change the problem.

                                When i start running the Openvpn client "unbound" will stop together with the "ntp sync" internet. Running no client VPN everything runs well.

                                My goal is to run client VPN to PIA plus use the capabilities of pfblockerng dnsbl for ad blocking, trackers etc. In don,t want my IP to be shown.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  Ramosel
                                  last edited by

                                  @captain1980:

                                  Using the DNS of the VPN server did not change the problem.

                                  My goal is to run client VPN to PIA plus use the capabilities of pfblockerng dnsbl for ad blocking, trackers etc. In don,t want my IP to be shown.

                                  Thanks for the information.  This is the direction I'm heading too.  I have a few more things to clean up before I (re)invoke my PIA connection.  I'll keep an eye on your issue.

                                  Rick

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    cmpufxr
                                    last edited by

                                    @chadb:

                                    I am seeing an issue where the pages with ads can take up to 20 seconds to timeout prior to loading the page…

                                    Example:  landsend.com will sit blank for 20 seconds waiting on assets.adobedtm.com, then loads immediately.

                                    -Chad

                                    I have been dealing with this issue also, I have found using wireshark that the VIP network request is being sent to 10.10.10.1 on port 80 (not the port that you have set) so the website waits until it times out to load the page.

                                    A previous post mentioned that it was squid that was sending traffic to port 80. (to see the 1x1 gif you need to go to 10.10.10.1 on the port you have set.)

                                    I have also set the VIP ip to 172.16.0.5 and the ports to 8178 and 8179 (suricata off, squid off, squidguard off) using wireshark I still see traffic going to 10.10.10.1 port 80

                                    Also on systems that do not use the squid3 have the same delay also on windows or centos. The websites I am using to test are newegg and foxnews.

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      Hi cmpufxr,

                                      Check your desktop DNS settings, and make sure they are only pointing to the pfSense Resolver IP address. If you have a multi-segmented LAN network, make sure to add the DNSBL allow firewall rule to allow those other subnets access to the VIP address. Make sure you can ping and browse to the DNSBL VIP, without that connectivity working properly, you will see those timeouts.

                                      Keep in mind that there are two NAT rules that forward traffic from the VIP address on ports 80/443 to the 127.0.0.1 DNSBL Port/SSL ports.

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        cmpufxr
                                        last edited by

                                        @BBcan177:

                                        Hi cmpufxr,

                                        Check your desktop DNS settings, and make sure they are only pointing to the pfSense Resolver IP address. If you have a multi-segmented LAN network, make sure to add the DNSBL allow firewall rule to allow those other subnets access to the VIP address. Make sure you can ping and browse to the DNSBL VIP, without that connectivity working properly, you will see those timeouts.

                                        Keep in mind that there are two NAT rules that forward traffic from the VIP address on ports 80/443 to the 127.0.0.1 DNSBL Port/SSL ports.

                                        Dns settings are good, I have access to the VIP I can only browse to the VIP with 10.10.10.1:8178 and https:\10.10.10.1:8179 (vip address and port)

                                        It looks like the NAT rule is not forwarding from 80 and 443 to 8178 and 8179.

                                        Thanks, I have at least identified the issue, now to fix it.

                                        I run a website so incoming port 80 on the wan is already forwarded. I also block all outgoing and have rules setup to allow 80 and 443 out on the LAN. I wonder if these are causing issues.

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          cmpufxr
                                          last edited by

                                          Ok, I found out the reason for why some websites were slow. ( newegg cnn fox landsend )

                                          On my system I block all incoming and outgoing traffic on lan, vlan1, vlan2

                                          When I setup pfblockerng with dnsbl I did not add the outgoing rules on the lan interface for both the dnsbl ip's.

                                          So in the floating rule that I already had for outgoing system ports I added both the ip's for the dnsbl web server.

                                          so the only traffic that was going out was the 80 and 443 and when the NAT rule tried to forward this traffic to 127.0.0.1 port 8178 and 8179 (this is also outgoing traffic from lan to 127.0.0.1) so I had to add 8178 and 8179 to my LAN outgoing port rules.

                                          before the rule I could ping 10.10.10.1 but NOT browse to the 1x1 pixel gif unles I added the port (ie 10.10.10.1:8178). After I can browse and ping to 10.10.10.1 without having to add the port

                                          I hope this helps someone else… Thank you for all your help

                                          Thanks BBcan177 for getting me on the right track...

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            chain
                                            last edited by

                                            When creating the Alias are you add them into a larger group or are you leaving them as they are individual items? Is there a limitation on amount of alias you can add to a group?

                                            @BBcan177:

                                            Here are more DNSBL Feeds that can be used in pfBlockerNG.
                                            (Copy and paste URLS as plain text)

                                            1. Create a new alias for these.
                                              These are not necessarily ADvert domains. So I named mine "Malicious"

                                            hpHosts
                                            http://hosts-file.net/download/hosts.zip

                                            SWC
                                            http://someonewhocares.org/hosts/hosts

                                            spam404
                                            https://spam404bl.com/blacklist.txt

                                            malc0de
                                            https://malc0de.com/bl/BOOT

                                            MDS (use 'Flex' state)
                                            https://mirror1.malwaredomains.com/files/justdomains

                                            MVPS
                                            http://winhelp2002.mvps.org/hosts.txt

                                            MDL
                                            http://www.malwaredomainlist.com/hostslist/hosts.txt

                                            GJTech
                                            http://adblock.gjtech.net/?format=unix-hosts

                                            dShield_SD  (They also have a conservative list available)
                                            https://www.dshield.org/feeds/suspiciousdomains_High.txt

                                            Zeus
                                            https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

                                            1. These two feeds post full URLs, so there can be some more false positives.
                                              Create a new Alias, and use Alexa as a recommendation.

                                            PhishTank
                                            https://data.phishtank.com/data/online-valid.csv.bz2

                                            OpenPhish
                                            https://www.openphish.com/feed.txt

                                            MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
                                            https://lists.malwarepatrol.net

                                            1. This is a feed that I manage (as time permits)
                                              MS_2
                                              https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

                                            2. Use this in its own Alias:

                                            BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
                                            http://osint.bambenekconsulting.com/feeds/dga-feed.gz

                                            BBC_C2
                                            http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

                                            1. Use this feed in its own alias as it is updated more frequently.
                                              So you can update it more often than once per day.

                                            hpHosts_partial
                                            http://hosts-file.net/hphosts-partial.asp

                                            If users find other feeds, please post back so that others may benefit also.
                                            Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.