Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      captain1980
      last edited by

      Ok thanks for the reply.

      Is it possible to use another DNS then the one from the VPN server to use both systems.

      When i run the VPN and DNSBL the NTp clock syc & dns resoler go "off" and then nothing works anymore.

      Hj

      1 Reply Last reply Reply Quote 0
      • R
        Ramosel
        last edited by

        @BBcan177:

        I don't personally use a VPM like PIA, but the only way for DNSBL to function, is if the pfSense Resolver is used for the DNS requests. If the VPN uses a different DNS server, then DNSBL will not block any domains…

        I think I understand the issue when running a PIA client on a device behind the pfSense system.

        Does this issue exist if you use pfSense/OpenVPN system as the VPN client?  If so, is the fix as simple as using PIA's DNS values in pfSense?

        1 Reply Last reply Reply Quote 0
        • C
          captain1980
          last edited by

          Using the DNS of the VPN server did not change the problem.

          When i start running the Openvpn client "unbound" will stop together with the "ntp sync" internet. Running no client VPN everything runs well.

          My goal is to run client VPN to PIA plus use the capabilities of pfblockerng dnsbl for ad blocking, trackers etc. In don,t want my IP to be shown.

          1 Reply Last reply Reply Quote 0
          • R
            Ramosel
            last edited by

            @captain1980:

            Using the DNS of the VPN server did not change the problem.

            My goal is to run client VPN to PIA plus use the capabilities of pfblockerng dnsbl for ad blocking, trackers etc. In don,t want my IP to be shown.

            Thanks for the information.  This is the direction I'm heading too.  I have a few more things to clean up before I (re)invoke my PIA connection.  I'll keep an eye on your issue.

            Rick

            1 Reply Last reply Reply Quote 0
            • C
              cmpufxr
              last edited by

              @chadb:

              I am seeing an issue where the pages with ads can take up to 20 seconds to timeout prior to loading the page…

              Example:  landsend.com will sit blank for 20 seconds waiting on assets.adobedtm.com, then loads immediately.

              -Chad

              I have been dealing with this issue also, I have found using wireshark that the VIP network request is being sent to 10.10.10.1 on port 80 (not the port that you have set) so the website waits until it times out to load the page.

              A previous post mentioned that it was squid that was sending traffic to port 80. (to see the 1x1 gif you need to go to 10.10.10.1 on the port you have set.)

              I have also set the VIP ip to 172.16.0.5 and the ports to 8178 and 8179 (suricata off, squid off, squidguard off) using wireshark I still see traffic going to 10.10.10.1 port 80

              Also on systems that do not use the squid3 have the same delay also on windows or centos. The websites I am using to test are newegg and foxnews.

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                Hi cmpufxr,

                Check your desktop DNS settings, and make sure they are only pointing to the pfSense Resolver IP address. If you have a multi-segmented LAN network, make sure to add the DNSBL allow firewall rule to allow those other subnets access to the VIP address. Make sure you can ping and browse to the DNSBL VIP, without that connectivity working properly, you will see those timeouts.

                Keep in mind that there are two NAT rules that forward traffic from the VIP address on ports 80/443 to the 127.0.0.1 DNSBL Port/SSL ports.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • C
                  cmpufxr
                  last edited by

                  @BBcan177:

                  Hi cmpufxr,

                  Check your desktop DNS settings, and make sure they are only pointing to the pfSense Resolver IP address. If you have a multi-segmented LAN network, make sure to add the DNSBL allow firewall rule to allow those other subnets access to the VIP address. Make sure you can ping and browse to the DNSBL VIP, without that connectivity working properly, you will see those timeouts.

                  Keep in mind that there are two NAT rules that forward traffic from the VIP address on ports 80/443 to the 127.0.0.1 DNSBL Port/SSL ports.

                  Dns settings are good, I have access to the VIP I can only browse to the VIP with 10.10.10.1:8178 and https:\10.10.10.1:8179 (vip address and port)

                  It looks like the NAT rule is not forwarding from 80 and 443 to 8178 and 8179.

                  Thanks, I have at least identified the issue, now to fix it.

                  I run a website so incoming port 80 on the wan is already forwarded. I also block all outgoing and have rules setup to allow 80 and 443 out on the LAN. I wonder if these are causing issues.

                  1 Reply Last reply Reply Quote 0
                  • C
                    cmpufxr
                    last edited by

                    Ok, I found out the reason for why some websites were slow. ( newegg cnn fox landsend )

                    On my system I block all incoming and outgoing traffic on lan, vlan1, vlan2

                    When I setup pfblockerng with dnsbl I did not add the outgoing rules on the lan interface for both the dnsbl ip's.

                    So in the floating rule that I already had for outgoing system ports I added both the ip's for the dnsbl web server.

                    so the only traffic that was going out was the 80 and 443 and when the NAT rule tried to forward this traffic to 127.0.0.1 port 8178 and 8179 (this is also outgoing traffic from lan to 127.0.0.1) so I had to add 8178 and 8179 to my LAN outgoing port rules.

                    before the rule I could ping 10.10.10.1 but NOT browse to the 1x1 pixel gif unles I added the port (ie 10.10.10.1:8178). After I can browse and ping to 10.10.10.1 without having to add the port

                    I hope this helps someone else… Thank you for all your help

                    Thanks BBcan177 for getting me on the right track...

                    1 Reply Last reply Reply Quote 0
                    • C
                      chain
                      last edited by

                      When creating the Alias are you add them into a larger group or are you leaving them as they are individual items? Is there a limitation on amount of alias you can add to a group?

                      @BBcan177:

                      Here are more DNSBL Feeds that can be used in pfBlockerNG.
                      (Copy and paste URLS as plain text)

                      1. Create a new alias for these.
                        These are not necessarily ADvert domains. So I named mine "Malicious"

                      hpHosts
                      http://hosts-file.net/download/hosts.zip

                      SWC
                      http://someonewhocares.org/hosts/hosts

                      spam404
                      https://spam404bl.com/blacklist.txt

                      malc0de
                      https://malc0de.com/bl/BOOT

                      MDS (use 'Flex' state)
                      https://mirror1.malwaredomains.com/files/justdomains

                      MVPS
                      http://winhelp2002.mvps.org/hosts.txt

                      MDL
                      http://www.malwaredomainlist.com/hostslist/hosts.txt

                      GJTech
                      http://adblock.gjtech.net/?format=unix-hosts

                      dShield_SD  (They also have a conservative list available)
                      https://www.dshield.org/feeds/suspiciousdomains_High.txt

                      Zeus
                      https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

                      1. These two feeds post full URLs, so there can be some more false positives.
                        Create a new Alias, and use Alexa as a recommendation.

                      PhishTank
                      https://data.phishtank.com/data/online-valid.csv.bz2

                      OpenPhish
                      https://www.openphish.com/feed.txt

                      MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
                      https://lists.malwarepatrol.net

                      1. This is a feed that I manage (as time permits)
                        MS_2
                        https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

                      2. Use this in its own Alias:

                      BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
                      http://osint.bambenekconsulting.com/feeds/dga-feed.gz

                      BBC_C2
                      http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

                      1. Use this feed in its own alias as it is updated more frequently.
                        So you can update it more often than once per day.

                      hpHosts_partial
                      http://hosts-file.net/hphosts-partial.asp

                      If users find other feeds, please post back so that others may benefit also.
                      Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

                      1 Reply Last reply Reply Quote 0
                      • C
                        chain
                        last edited by

                        Did you create a group per each item that is shown below?

                        @tonymorella:

                        Few things I found out while beta testing V2

                        • First rule is take your time and be patient. Adding to may rules at once will casue alot of blocks you may or may not way. Wildcards are not supported, or wanted in most cases. For example adding google.com does not filter all the hosts for the domain, need to add each host that is being blocked to the filter lists
                        • Make sure to double check ASN's, especially for large companies that have acquired other companies, more than one ASN might exist
                          *** Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.
                        • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around
                        • I wanted to have my allow rules > pfb block rules > my block rules > my per interface rules.  Did this by enabling "Floating Rules" and using "pfb_pass/match  | pfsense pass/match |  pfb_block/reject"
                        • If you have WIFI make sure to enable "DNSBL Firewall Rule" and select both LAN and WIFI or the NAT: Port Forward rule for 10.10.10.1 is not setup correctly.  If you don't change this setting things still work but everything runs slow over wifi.
                        • Make sure to whitelist all the DNSBL sites FQDN via an allow aliases, some IPv4 block-lists include the IP space the DNSBL are found in
                        • DBSBL is basicly a man in the middle for DNS so any site that is block but running https will create warrnings. Depending on how the brower is setup it might just ignore or not display the error.  CTRL+SHIFT+I on both Chrome and Firebox will bring up dev panel where you can see which pages are not loading. Chrome will show an error, Firefox will show a red slash throught the lock icon.
                        • Noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter. To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
                        popcash.net
                        www.popcash.net
                        cdn.popcash.net
                        outbrain.com
                        www.outbrain.com
                        onclickads.net
                        www.onclickads.net
                        googleadservices.com
                        www.googleadservices.com
                        adcash.com
                        www.adcash.com
                        popads.net
                        www.popads.net
                        popmyads.com
                        www.popmyads.com
                        
                        
                        • List of domains added to DNSBL Custom Domain Suppression to stop them from being blocked
                        
                        goo.gl
                        google.com
                        www.google.com
                        mail.google.com
                        docs.google.com
                        sites.google.com
                        fonts.googleapis.com
                        cache.google.com
                        clients.google.com
                        clients0.google.com
                        clients1.google.com
                        clients2.google.com
                        clients3.google.com
                        clients4.google.com
                        clients5.google.com
                        clients6.google.com
                        clients7.google.com
                        clients8.google.com
                        clients9.google.com
                        www.maxmind.com
                        s3.amazonaws.com
                        fls-na.amazon.com
                        login.live.com
                        redis.io
                        pgl.yoyo.org
                        someonewhocares.org
                        www.thingamajob.com
                        winhelp2002.mvps.org
                        hosts-file.net
                        www.hosts-file.net
                        adaway.org
                        sysctl.org
                        adblock.gjtech.net
                        www.dshield.org
                        malwaredomainlist.com
                        malwaredomains.com
                        bambenekconsulting.com
                        malwarepatrol.net
                        zeustracker.abuse.ch
                        malc0de.com
                        curl.haxx.se
                        dl.dropboxusercontent.com
                        whois.cymru.com
                        github.com
                        collector-cdn.github.com
                        pivotal.github.com
                        cloud.github.com
                        raw.githubusercontent.com
                        raw.github.com
                        stopforumspam.com
                        www.stopforumspam.com
                        sourceforge.net
                        www.sourceforge.net
                        iweb.dl.sourceforge.net
                        chase.com
                        www.chase.com
                        mint.com
                        www.mint.com
                        americanexpress.com
                        www.americanexpress.com
                        online.americanexpress.com
                        linuxquestions.org
                        www.linuxquestions.org
                        optimizely.com
                        www.optimizely.com
                        api.optimizely.com
                        cdn.optimizely.com
                        cdn2.optimizely.com
                        cdn3.optimizely.com
                        slashdot.org
                        www.slashdot.org
                        ebay.com
                        www.ebay.com
                        rover.ebay.com
                        srx.main.ebayrtm.com
                        openbl.org
                        www.openbl.org
                        www.us.openbl.org
                        delta.com
                        www.delta.com
                        aa.com
                        www.aa.com
                        cruisesonly.com
                        www.cruisesonly.com
                        ripe.net
                        www.ripe.net
                        weather.com
                        www.weather.com
                        lacnic.net
                        www.lacnic.net
                        tvrage.com
                        services.tvrage.com
                        www.tvrage.com
                        publicbt.com
                        device.maxmind.com
                        www.boingo.com
                        xda-developers.com
                        www.xda-developers.com
                        forum.xda-developers.com
                        opengapps.org
                        download.mono-project.com
                        
                        
                        • Ads DNS Group

                        • Update Frequency: Once a Day

                        • Enable Alexa Whitelist: NOT Enabled

                        • Add Custom Block List noted above

                        
                        http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintextoup	yoyo
                        http://hosts-file.net/ad_servers.txt							hphosts_ats
                        https://adaway.org/hosts.txt								adaway
                        http://sysctl.org/cameleon/hosts							syctrl
                        http://adblock.gjtech.net/?format=unix-hosts						gjtech
                        
                        
                        • Privacy Fraud DNS Group

                        • Update Frequency: Once a Day

                        • Enable Alexa Whitelist: Enabled

                        
                        https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt			disconnect_basic
                        http://hosts-file.net/fsa.txt								hphost_fsa
                        http://hosts-file.net/hjk.txt								hphost_hjk
                        http://hosts-file.net/pha.txt								hphost_psh
                        https://www.dshield.org/feeds/suspiciousdomains_High.txt				dshield_sdh
                        
                        
                        • Malware Exploit DNS Group

                        • Update Frequency: Once a Day

                        • Enable Alexa Whitelist: Enabled

                        
                        https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt			disconnect_malvertising
                        http://www.malwaredomainlist.com/hostslist/hosts.txt					malwaredomainlist
                        http://mirror1.malwaredomains.com/files/justdomains					malwaredomains			
                        https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt				disconnect_malware
                        http://hosts-file.net/emd.txt								hphosts_emd
                        http://hosts-file.net/exp.txt								hphosts_exp
                        http://hosts-file.net/mmt.txt								hphosts_mmt
                        https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian malwarepatrol
                        https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist			zeustracker
                        https://malc0de.com/bl/BOOT								malc0de
                        
                        
                        • SPAM DNS Group

                        • Update Frequency: Once a Day

                        • Enable Alexa Whitelist: Enabled

                        
                        http://hosts-file.net/grm.txt								hphost_grm
                        http://hosts-file.net/hfs.txt								hphost_hfs
                        https://spam404bl.com/blacklist.txt							spam_404
                        
                        
                        • Malicious DNS Group

                        • Update Frequency: Once a Day

                        • Enable Alexa Whitelist: Enabled

                        
                        http://hosts-file.net/hphosts-partial.txt						hphost_partial
                        http://winhelp2002.mvps.org/hosts.txt							mvps_hosts
                        http://someonewhocares.org/hosts/hosts							SomeoneWhoCares
                        https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw			BBcan177
                        
                        
                        • BambenekConsulting DNS Group

                        • Update Frequency: Once a Day

                        • Enable Alexa Whitelist: Enabled

                        
                        http://osint.bambenekconsulting.com/feeds/dga-feed.gz					bambenek_dga
                        http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt				bambenek_c2
                        
                        

                        Thanks
                        Tony M.**

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          @chain:

                          When creating the Alias are you add them into a larger group or are you leaving them as they are individual items? Is there a limitation on amount of alias you can add to a group?

                          That is personal preference… There is no limit to either method...

                          I prefer to create an "ADs" alias, "Malicious" Alias etc instead of making an Alias with a single feed in it.... The other post that you linked has the "DNS Group Name" listed also for your reference...

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • C
                            cjbujold
                            last edited by

                            Getting error when rebooting with latest PFblockerng  not certain what the error is.  Any help on how to fix would be appreciated.

                            Thanks

                            12-26-15 11:48:19 [ PF was wedged/busy and has been reset.]
                            12-26-15 11:48:40 [ There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]: ]
                            12-26-15 11:49:15 [ Unresolvable source alias pfB_Top_v4 for rule pfB_Top_v4 auto rule]
                            12-26-15 11:49:17 [ Unresolvable source alias pfB_Top_v6 for rule pfB_Top_v6 auto rule]
                            12-26-15 11:49:19 [ Unresolvable destination alias pfB_Top_v4 for rule pfB_Top_v4 auto rule]
                            12-26-15 11:49:21 [ Unresolvable destination alias pfB_Top_v6 for rule pfB_Top_v6 auto rule]

                            1 Reply Last reply Reply Quote 0
                            • H
                              Hugovsky
                              last edited by

                              That error is normal. It's because when you reboot pfsense, pfblock needs some time to make the alias and the firewall complains about it.

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                @cjbujold:

                                Getting error when rebooting with latest PFblockerng

                                12-26-15 11:48:19 [ PF was wedged/busy and has been reset.]
                                12-26-15 11:48:40 [ There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]: ]

                                The error "PF was wedged/busy and has been reset" is an issue… When using "Alias type" rules, you can sometimes get an error when re-installing the package, or rebooting if you have a nanobsd or ramdisk installation; however, this error is indicating an error in loading the rules.  Not enough information to help you diagnose it... If it persists, maybe try to uncheck "Keep Settings", and disable pfBlockerNG, then "Save". Following that re-check "Keep Settings", and re-enable, followed by a "Force Reload"... There can also be an issue with a non-pfBNG rule that is causing this issue.

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • V
                                  Venlaw
                                  last edited by

                                  Why is it that my whitelist keeps getting pushed to the bottom of my floating firewall rules when it is at the top in the IPv4 lists? It was added after the blocklists, but as stated, its been moved to the top in the IPv4 tab in pfBlockerNG? I have to manually move it to the top of the floating firewall rules every reload.

                                  CPU: Celeron G1610 MB: Intel DQ77KB RAM: 4GB Corsair Vengeance Storage: 16GB SanDisk mSATA SSD NIC: Dual Onboard Intel (VLANs) WAN: 50/5mbps

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    Select the "Rule Order" setting that is appropriate for your setup in the General Tab.

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • V
                                      Venlaw
                                      last edited by

                                      Thank You.

                                      CPU: Celeron G1610 MB: Intel DQ77KB RAM: 4GB Corsair Vengeance Storage: 16GB SanDisk mSATA SSD NIC: Dual Onboard Intel (VLANs) WAN: 50/5mbps

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        Ramosel
                                        last edited by

                                        @tonymorella:

                                        Few things I found out while beta testing V2

                                        • Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.

                                        • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around

                                        Tony M.

                                        Tony, there are some recent posts from people either trying to get OpenVPN/PIA and pfBlockerNG/DNSBL working together or like me, looking to head that direction after I get some other fine tuning in place.  Can you please elaborate or cookbook your setup if it is indeed working correctly.

                                        For the 5 folks who asked me privately to keep you informed if I get any info on this…  I'll be asking these questions publicly.    If someone does respond privately I'll forward responses only if the OP approves.  Really, no one here bites (well, maybe Dok - grin)

                                        Rick

                                        1 Reply Last reply Reply Quote 0
                                        • W
                                          wiz561
                                          last edited by

                                          I am trying to setup the DNSBL portion of pfblocker and ran into a strange problem.  I have a pretty restrictive firewall setup where it's pretty much default deny; allow by exception.  When setting up the DNSBL portion, I see that the workstations are just timing out when accessing a known blocked site in the DNSBL.  In the firewall logs for pfsense, I see the workstation trying to get to 127.0.0.1:8081.  I fixed this timeout by adding the 127.0.0.1:8081 in the firewall and now it works properly.

                                          Why does DNSBL try doing a localhost instead of the 10.10.10.1?

                                          Thanks!

                                          1 Reply Last reply Reply Quote 0
                                          • RonpfSR
                                            RonpfS
                                            last edited by

                                            DNSBL create a NAT port forward to 127.0.0.1

                                            ![DSNBL NAT 3.jpg](/public/imported_attachments/1/DSNBL NAT 3.jpg)
                                            ![DSNBL NAT 3.jpg_thumb](/public/imported_attachments/1/DSNBL NAT 3.jpg_thumb)

                                            2.4.5-RELEASE-p1 (amd64)
                                            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.