Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cmpufxr
      last edited by

      Ok, I found out the reason for why some websites were slow. ( newegg cnn fox landsend )

      On my system I block all incoming and outgoing traffic on lan, vlan1, vlan2

      When I setup pfblockerng with dnsbl I did not add the outgoing rules on the lan interface for both the dnsbl ip's.

      So in the floating rule that I already had for outgoing system ports I added both the ip's for the dnsbl web server.

      so the only traffic that was going out was the 80 and 443 and when the NAT rule tried to forward this traffic to 127.0.0.1 port 8178 and 8179 (this is also outgoing traffic from lan to 127.0.0.1) so I had to add 8178 and 8179 to my LAN outgoing port rules.

      before the rule I could ping 10.10.10.1 but NOT browse to the 1x1 pixel gif unles I added the port (ie 10.10.10.1:8178). After I can browse and ping to 10.10.10.1 without having to add the port

      I hope this helps someone else… Thank you for all your help

      Thanks BBcan177 for getting me on the right track...

      1 Reply Last reply Reply Quote 0
      • C
        chain
        last edited by

        When creating the Alias are you add them into a larger group or are you leaving them as they are individual items? Is there a limitation on amount of alias you can add to a group?

        @BBcan177:

        Here are more DNSBL Feeds that can be used in pfBlockerNG.
        (Copy and paste URLS as plain text)

        1. Create a new alias for these.
          These are not necessarily ADvert domains. So I named mine "Malicious"

        hpHosts
        http://hosts-file.net/download/hosts.zip

        SWC
        http://someonewhocares.org/hosts/hosts

        spam404
        https://spam404bl.com/blacklist.txt

        malc0de
        https://malc0de.com/bl/BOOT

        MDS (use 'Flex' state)
        https://mirror1.malwaredomains.com/files/justdomains

        MVPS
        http://winhelp2002.mvps.org/hosts.txt

        MDL
        http://www.malwaredomainlist.com/hostslist/hosts.txt

        GJTech
        http://adblock.gjtech.net/?format=unix-hosts

        dShield_SD  (They also have a conservative list available)
        https://www.dshield.org/feeds/suspiciousdomains_High.txt

        Zeus
        https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

        1. These two feeds post full URLs, so there can be some more false positives.
          Create a new Alias, and use Alexa as a recommendation.

        PhishTank
        https://data.phishtank.com/data/online-valid.csv.bz2

        OpenPhish
        https://www.openphish.com/feed.txt

        MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
        https://lists.malwarepatrol.net

        1. This is a feed that I manage (as time permits)
          MS_2
          https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

        2. Use this in its own Alias:

        BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
        http://osint.bambenekconsulting.com/feeds/dga-feed.gz

        BBC_C2
        http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

        1. Use this feed in its own alias as it is updated more frequently.
          So you can update it more often than once per day.

        hpHosts_partial
        http://hosts-file.net/hphosts-partial.asp

        If users find other feeds, please post back so that others may benefit also.
        Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

        1 Reply Last reply Reply Quote 0
        • C
          chain
          last edited by

          Did you create a group per each item that is shown below?

          @tonymorella:

          Few things I found out while beta testing V2

          • First rule is take your time and be patient. Adding to may rules at once will casue alot of blocks you may or may not way. Wildcards are not supported, or wanted in most cases. For example adding google.com does not filter all the hosts for the domain, need to add each host that is being blocked to the filter lists
          • Make sure to double check ASN's, especially for large companies that have acquired other companies, more than one ASN might exist
            *** Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.
          • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around
          • I wanted to have my allow rules > pfb block rules > my block rules > my per interface rules.  Did this by enabling "Floating Rules" and using "pfb_pass/match  | pfsense pass/match |  pfb_block/reject"
          • If you have WIFI make sure to enable "DNSBL Firewall Rule" and select both LAN and WIFI or the NAT: Port Forward rule for 10.10.10.1 is not setup correctly.  If you don't change this setting things still work but everything runs slow over wifi.
          • Make sure to whitelist all the DNSBL sites FQDN via an allow aliases, some IPv4 block-lists include the IP space the DNSBL are found in
          • DBSBL is basicly a man in the middle for DNS so any site that is block but running https will create warrnings. Depending on how the brower is setup it might just ignore or not display the error.  CTRL+SHIFT+I on both Chrome and Firebox will bring up dev panel where you can see which pages are not loading. Chrome will show an error, Firefox will show a red slash throught the lock icon.
          • Noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter. To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
          popcash.net
          www.popcash.net
          cdn.popcash.net
          outbrain.com
          www.outbrain.com
          onclickads.net
          www.onclickads.net
          googleadservices.com
          www.googleadservices.com
          adcash.com
          www.adcash.com
          popads.net
          www.popads.net
          popmyads.com
          www.popmyads.com
          
          
          • List of domains added to DNSBL Custom Domain Suppression to stop them from being blocked
          
          goo.gl
          google.com
          www.google.com
          mail.google.com
          docs.google.com
          sites.google.com
          fonts.googleapis.com
          cache.google.com
          clients.google.com
          clients0.google.com
          clients1.google.com
          clients2.google.com
          clients3.google.com
          clients4.google.com
          clients5.google.com
          clients6.google.com
          clients7.google.com
          clients8.google.com
          clients9.google.com
          www.maxmind.com
          s3.amazonaws.com
          fls-na.amazon.com
          login.live.com
          redis.io
          pgl.yoyo.org
          someonewhocares.org
          www.thingamajob.com
          winhelp2002.mvps.org
          hosts-file.net
          www.hosts-file.net
          adaway.org
          sysctl.org
          adblock.gjtech.net
          www.dshield.org
          malwaredomainlist.com
          malwaredomains.com
          bambenekconsulting.com
          malwarepatrol.net
          zeustracker.abuse.ch
          malc0de.com
          curl.haxx.se
          dl.dropboxusercontent.com
          whois.cymru.com
          github.com
          collector-cdn.github.com
          pivotal.github.com
          cloud.github.com
          raw.githubusercontent.com
          raw.github.com
          stopforumspam.com
          www.stopforumspam.com
          sourceforge.net
          www.sourceforge.net
          iweb.dl.sourceforge.net
          chase.com
          www.chase.com
          mint.com
          www.mint.com
          americanexpress.com
          www.americanexpress.com
          online.americanexpress.com
          linuxquestions.org
          www.linuxquestions.org
          optimizely.com
          www.optimizely.com
          api.optimizely.com
          cdn.optimizely.com
          cdn2.optimizely.com
          cdn3.optimizely.com
          slashdot.org
          www.slashdot.org
          ebay.com
          www.ebay.com
          rover.ebay.com
          srx.main.ebayrtm.com
          openbl.org
          www.openbl.org
          www.us.openbl.org
          delta.com
          www.delta.com
          aa.com
          www.aa.com
          cruisesonly.com
          www.cruisesonly.com
          ripe.net
          www.ripe.net
          weather.com
          www.weather.com
          lacnic.net
          www.lacnic.net
          tvrage.com
          services.tvrage.com
          www.tvrage.com
          publicbt.com
          device.maxmind.com
          www.boingo.com
          xda-developers.com
          www.xda-developers.com
          forum.xda-developers.com
          opengapps.org
          download.mono-project.com
          
          
          • Ads DNS Group

          • Update Frequency: Once a Day

          • Enable Alexa Whitelist: NOT Enabled

          • Add Custom Block List noted above

          
          http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintextoup	yoyo
          http://hosts-file.net/ad_servers.txt							hphosts_ats
          https://adaway.org/hosts.txt								adaway
          http://sysctl.org/cameleon/hosts							syctrl
          http://adblock.gjtech.net/?format=unix-hosts						gjtech
          
          
          • Privacy Fraud DNS Group

          • Update Frequency: Once a Day

          • Enable Alexa Whitelist: Enabled

          
          https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt			disconnect_basic
          http://hosts-file.net/fsa.txt								hphost_fsa
          http://hosts-file.net/hjk.txt								hphost_hjk
          http://hosts-file.net/pha.txt								hphost_psh
          https://www.dshield.org/feeds/suspiciousdomains_High.txt				dshield_sdh
          
          
          • Malware Exploit DNS Group

          • Update Frequency: Once a Day

          • Enable Alexa Whitelist: Enabled

          
          https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt			disconnect_malvertising
          http://www.malwaredomainlist.com/hostslist/hosts.txt					malwaredomainlist
          http://mirror1.malwaredomains.com/files/justdomains					malwaredomains			
          https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt				disconnect_malware
          http://hosts-file.net/emd.txt								hphosts_emd
          http://hosts-file.net/exp.txt								hphosts_exp
          http://hosts-file.net/mmt.txt								hphosts_mmt
          https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian malwarepatrol
          https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist			zeustracker
          https://malc0de.com/bl/BOOT								malc0de
          
          
          • SPAM DNS Group

          • Update Frequency: Once a Day

          • Enable Alexa Whitelist: Enabled

          
          http://hosts-file.net/grm.txt								hphost_grm
          http://hosts-file.net/hfs.txt								hphost_hfs
          https://spam404bl.com/blacklist.txt							spam_404
          
          
          • Malicious DNS Group

          • Update Frequency: Once a Day

          • Enable Alexa Whitelist: Enabled

          
          http://hosts-file.net/hphosts-partial.txt						hphost_partial
          http://winhelp2002.mvps.org/hosts.txt							mvps_hosts
          http://someonewhocares.org/hosts/hosts							SomeoneWhoCares
          https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw			BBcan177
          
          
          • BambenekConsulting DNS Group

          • Update Frequency: Once a Day

          • Enable Alexa Whitelist: Enabled

          
          http://osint.bambenekconsulting.com/feeds/dga-feed.gz					bambenek_dga
          http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt				bambenek_c2
          
          

          Thanks
          Tony M.**

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @chain:

            When creating the Alias are you add them into a larger group or are you leaving them as they are individual items? Is there a limitation on amount of alias you can add to a group?

            That is personal preference… There is no limit to either method...

            I prefer to create an "ADs" alias, "Malicious" Alias etc instead of making an Alias with a single feed in it.... The other post that you linked has the "DNS Group Name" listed also for your reference...

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • C
              cjbujold
              last edited by

              Getting error when rebooting with latest PFblockerng  not certain what the error is.  Any help on how to fix would be appreciated.

              Thanks

              12-26-15 11:48:19 [ PF was wedged/busy and has been reset.]
              12-26-15 11:48:40 [ There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]: ]
              12-26-15 11:49:15 [ Unresolvable source alias pfB_Top_v4 for rule pfB_Top_v4 auto rule]
              12-26-15 11:49:17 [ Unresolvable source alias pfB_Top_v6 for rule pfB_Top_v6 auto rule]
              12-26-15 11:49:19 [ Unresolvable destination alias pfB_Top_v4 for rule pfB_Top_v4 auto rule]
              12-26-15 11:49:21 [ Unresolvable destination alias pfB_Top_v6 for rule pfB_Top_v6 auto rule]

              1 Reply Last reply Reply Quote 0
              • H
                Hugovsky
                last edited by

                That error is normal. It's because when you reboot pfsense, pfblock needs some time to make the alias and the firewall complains about it.

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  @cjbujold:

                  Getting error when rebooting with latest PFblockerng

                  12-26-15 11:48:19 [ PF was wedged/busy and has been reset.]
                  12-26-15 11:48:40 [ There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]: ]

                  The error "PF was wedged/busy and has been reset" is an issue… When using "Alias type" rules, you can sometimes get an error when re-installing the package, or rebooting if you have a nanobsd or ramdisk installation; however, this error is indicating an error in loading the rules.  Not enough information to help you diagnose it... If it persists, maybe try to uncheck "Keep Settings", and disable pfBlockerNG, then "Save". Following that re-check "Keep Settings", and re-enable, followed by a "Force Reload"... There can also be an issue with a non-pfBNG rule that is causing this issue.

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • V
                    Venlaw
                    last edited by

                    Why is it that my whitelist keeps getting pushed to the bottom of my floating firewall rules when it is at the top in the IPv4 lists? It was added after the blocklists, but as stated, its been moved to the top in the IPv4 tab in pfBlockerNG? I have to manually move it to the top of the floating firewall rules every reload.

                    CPU: Celeron G1610 MB: Intel DQ77KB RAM: 4GB Corsair Vengeance Storage: 16GB SanDisk mSATA SSD NIC: Dual Onboard Intel (VLANs) WAN: 50/5mbps

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      Select the "Rule Order" setting that is appropriate for your setup in the General Tab.

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • V
                        Venlaw
                        last edited by

                        Thank You.

                        CPU: Celeron G1610 MB: Intel DQ77KB RAM: 4GB Corsair Vengeance Storage: 16GB SanDisk mSATA SSD NIC: Dual Onboard Intel (VLANs) WAN: 50/5mbps

                        1 Reply Last reply Reply Quote 0
                        • R
                          Ramosel
                          last edited by

                          @tonymorella:

                          Few things I found out while beta testing V2

                          • Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.

                          • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around

                          Tony M.

                          Tony, there are some recent posts from people either trying to get OpenVPN/PIA and pfBlockerNG/DNSBL working together or like me, looking to head that direction after I get some other fine tuning in place.  Can you please elaborate or cookbook your setup if it is indeed working correctly.

                          For the 5 folks who asked me privately to keep you informed if I get any info on this…  I'll be asking these questions publicly.    If someone does respond privately I'll forward responses only if the OP approves.  Really, no one here bites (well, maybe Dok - grin)

                          Rick

                          1 Reply Last reply Reply Quote 0
                          • W
                            wiz561
                            last edited by

                            I am trying to setup the DNSBL portion of pfblocker and ran into a strange problem.  I have a pretty restrictive firewall setup where it's pretty much default deny; allow by exception.  When setting up the DNSBL portion, I see that the workstations are just timing out when accessing a known blocked site in the DNSBL.  In the firewall logs for pfsense, I see the workstation trying to get to 127.0.0.1:8081.  I fixed this timeout by adding the 127.0.0.1:8081 in the firewall and now it works properly.

                            Why does DNSBL try doing a localhost instead of the 10.10.10.1?

                            Thanks!

                            1 Reply Last reply Reply Quote 0
                            • RonpfSR
                              RonpfS
                              last edited by

                              DNSBL create a NAT port forward to 127.0.0.1

                              ![DSNBL NAT 3.jpg](/public/imported_attachments/1/DSNBL NAT 3.jpg)
                              ![DSNBL NAT 3.jpg_thumb](/public/imported_attachments/1/DSNBL NAT 3.jpg_thumb)

                              2.4.5-RELEASE-p1 (amd64)
                              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                              1 Reply Last reply Reply Quote 0
                              • W
                                wiz561
                                last edited by

                                @RonpfS:

                                DNSBL create a NAT port forward to 127.0.0.1

                                Makes sense.  Thank  You!

                                1 Reply Last reply Reply Quote 0
                                • C
                                  chain
                                  last edited by

                                  @RonpfS:

                                  DNSBL create a NAT port forward to 127.0.0.1

                                  Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

                                  I see alot of DNSBL alert, but no permit or match? is this working correctly?

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    @chain:

                                    @RonpfS:

                                    DNSBL create a NAT port forward to 127.0.0.1

                                    Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

                                    I see alot of DNSBL alert, but no permit or match? is this working correctly?

                                    No you do not need to create any additional NAT rules.. However, in the general tab, you can click the checkbox to create a 'Floating permit rule' for other LAN subnets (WIFI, Guest etc…) to access the DNSBL VIP address. Also ensure that you do not have any other restrictive rules (as wiz561 posted above).

                                    Not sure what you mean by "Permit and Match" as that only refers to IP rules, and not DNSBL?

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • ExolonE
                                      Exolon
                                      last edited by

                                      @BBcan17,

                                      The wrench/spanner/settings icon for the pfBlocker widget doesn't work with pfSense 2.3/ pfBlockerNG 2.0.6,

                                      Appears you just need to an ID statement to the DIV tag to the pfblockerng.widget.php (line 500 approx.):

                                      
                                      Not really worth me putting a pull request just for this, but maybe something for your next pull request?
                                      
                                      
                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        @Exolon:

                                        Not really worth me putting a pull request just for this, but maybe something for your next pull request?

                                        Thanks Exolon, I guess one of the latest pfSense commits broke that ;) I have tested the change at line 500 and it seems to correct the issue…

                                        Thanks!

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          chain
                                          last edited by

                                          When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                                          http://kregjig.ning.com/

                                          image.PNG
                                          image.PNG_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            @chain:

                                            When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                                            http://kregjig.ning.com/

                                            Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.