PfBlockerNG v2.0 w/DNSBL
-
When creating the Alias are you add them into a larger group or are you leaving them as they are individual items? Is there a limitation on amount of alias you can add to a group?
Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)- Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"
hpHosts
http://hosts-file.net/download/hosts.zipSWC
http://someonewhocares.org/hosts/hostsspam404
https://spam404bl.com/blacklist.txtmalc0de
https://malc0de.com/bl/BOOTMDS (use 'Flex' state)
https://mirror1.malwaredomains.com/files/justdomainsMVPS
http://winhelp2002.mvps.org/hosts.txtMDL
http://www.malwaredomainlist.com/hostslist/hosts.txtGJTech
http://adblock.gjtech.net/?format=unix-hostsdShield_SD (They also have a conservative list available)
https://www.dshield.org/feeds/suspiciousdomains_High.txtZeus
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist- These two feeds post full URLs, so there can be some more false positives.
Create a new Alias, and use Alexa as a recommendation.
PhishTank
https://data.phishtank.com/data/online-valid.csv.bz2OpenPhish
https://www.openphish.com/feed.txtMPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
https://lists.malwarepatrol.net-
This is a feed that I manage (as time permits)
MS_2
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw -
Use this in its own Alias:
BBC_DGA (This is a large feed of DGA for the likes of Cryptolocker et al…)
http://osint.bambenekconsulting.com/feeds/dga-feed.gzBBC_C2
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt- Use this feed in its own alias as it is updated more frequently.
So you can update it more often than once per day.
hpHosts_partial
http://hosts-file.net/hphosts-partial.aspIf users find other feeds, please post back so that others may benefit also.
Its also important to donate to the feeds provider (IP and/or Domain) as they all need support. - Create a new alias for these.
-
Did you create a group per each item that is shown below?
Few things I found out while beta testing V2
- First rule is take your time and be patient. Adding to may rules at once will casue alot of blocks you may or may not way. Wildcards are not supported, or wanted in most cases. For example adding google.com does not filter all the hosts for the domain, need to add each host that is being blocked to the filter lists
- Make sure to double check ASN's, especially for large companies that have acquired other companies, more than one ASN might exist
*** Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed, em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload. They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly. - Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum. I added all my hosts host to unbound statically as a work around
- I wanted to have my allow rules > pfb block rules > my block rules > my per interface rules. Did this by enabling "Floating Rules" and using "pfb_pass/match | pfsense pass/match | pfb_block/reject"
- If you have WIFI make sure to enable "DNSBL Firewall Rule" and select both LAN and WIFI or the NAT: Port Forward rule for 10.10.10.1 is not setup correctly. If you don't change this setting things still work but everything runs slow over wifi.
- Make sure to whitelist all the DNSBL sites FQDN via an allow aliases, some IPv4 block-lists include the IP space the DNSBL are found in
- DBSBL is basicly a man in the middle for DNS so any site that is block but running https will create warrnings. Depending on how the brower is setup it might just ignore or not display the error. CTRL+SHIFT+I on both Chrome and Firebox will bring up dev panel where you can see which pages are not loading. Chrome will show an error, Firefox will show a red slash throught the lock icon.
- Noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter. To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
popcash.net www.popcash.net cdn.popcash.net outbrain.com www.outbrain.com onclickads.net www.onclickads.net googleadservices.com www.googleadservices.com adcash.com www.adcash.com popads.net www.popads.net popmyads.com www.popmyads.com- List of domains added to DNSBL Custom Domain Suppression to stop them from being blocked
goo.gl google.com www.google.com mail.google.com docs.google.com sites.google.com fonts.googleapis.com cache.google.com clients.google.com clients0.google.com clients1.google.com clients2.google.com clients3.google.com clients4.google.com clients5.google.com clients6.google.com clients7.google.com clients8.google.com clients9.google.com www.maxmind.com s3.amazonaws.com fls-na.amazon.com login.live.com redis.io pgl.yoyo.org someonewhocares.org www.thingamajob.com winhelp2002.mvps.org hosts-file.net www.hosts-file.net adaway.org sysctl.org adblock.gjtech.net www.dshield.org malwaredomainlist.com malwaredomains.com bambenekconsulting.com malwarepatrol.net zeustracker.abuse.ch malc0de.com curl.haxx.se dl.dropboxusercontent.com whois.cymru.com github.com collector-cdn.github.com pivotal.github.com cloud.github.com raw.githubusercontent.com raw.github.com stopforumspam.com www.stopforumspam.com sourceforge.net www.sourceforge.net iweb.dl.sourceforge.net chase.com www.chase.com mint.com www.mint.com americanexpress.com www.americanexpress.com online.americanexpress.com linuxquestions.org www.linuxquestions.org optimizely.com www.optimizely.com api.optimizely.com cdn.optimizely.com cdn2.optimizely.com cdn3.optimizely.com slashdot.org www.slashdot.org ebay.com www.ebay.com rover.ebay.com srx.main.ebayrtm.com openbl.org www.openbl.org www.us.openbl.org delta.com www.delta.com aa.com www.aa.com cruisesonly.com www.cruisesonly.com ripe.net www.ripe.net weather.com www.weather.com lacnic.net www.lacnic.net tvrage.com services.tvrage.com www.tvrage.com publicbt.com device.maxmind.com www.boingo.com xda-developers.com www.xda-developers.com forum.xda-developers.com opengapps.org download.mono-project.com-
Ads DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: NOT Enabled
-
Add Custom Block List noted above
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintextoup yoyo http://hosts-file.net/ad_servers.txt hphosts_ats https://adaway.org/hosts.txt adaway http://sysctl.org/cameleon/hosts syctrl http://adblock.gjtech.net/?format=unix-hosts gjtech-
Privacy Fraud DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt disconnect_basic http://hosts-file.net/fsa.txt hphost_fsa http://hosts-file.net/hjk.txt hphost_hjk http://hosts-file.net/pha.txt hphost_psh https://www.dshield.org/feeds/suspiciousdomains_High.txt dshield_sdh-
Malware Exploit DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt disconnect_malvertising http://www.malwaredomainlist.com/hostslist/hosts.txt malwaredomainlist http://mirror1.malwaredomains.com/files/justdomains malwaredomains https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt disconnect_malware http://hosts-file.net/emd.txt hphosts_emd http://hosts-file.net/exp.txt hphosts_exp http://hosts-file.net/mmt.txt hphosts_mmt https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian malwarepatrol https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist zeustracker https://malc0de.com/bl/BOOT malc0de-
SPAM DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
http://hosts-file.net/grm.txt hphost_grm http://hosts-file.net/hfs.txt hphost_hfs https://spam404bl.com/blacklist.txt spam_404-
Malicious DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
http://hosts-file.net/hphosts-partial.txt hphost_partial http://winhelp2002.mvps.org/hosts.txt mvps_hosts http://someonewhocares.org/hosts/hosts SomeoneWhoCares https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw BBcan177-
BambenekConsulting DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
http://osint.bambenekconsulting.com/feeds/dga-feed.gz bambenek_dga http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt bambenek_c2Thanks
Tony M.** -
When creating the Alias are you add them into a larger group or are you leaving them as they are individual items? Is there a limitation on amount of alias you can add to a group?
That is personal preference… There is no limit to either method...
I prefer to create an "ADs" alias, "Malicious" Alias etc instead of making an Alias with a single feed in it.... The other post that you linked has the "DNS Group Name" listed also for your reference...
-
Getting error when rebooting with latest PFblockerng not certain what the error is. Any help on how to fix would be appreciated.
Thanks
12-26-15 11:48:19 [ PF was wedged/busy and has been reset.]
12-26-15 11:48:40 [ There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]: ]
12-26-15 11:49:15 [ Unresolvable source alias pfB_Top_v4 for rule pfB_Top_v4 auto rule]
12-26-15 11:49:17 [ Unresolvable source alias pfB_Top_v6 for rule pfB_Top_v6 auto rule]
12-26-15 11:49:19 [ Unresolvable destination alias pfB_Top_v4 for rule pfB_Top_v4 auto rule]
12-26-15 11:49:21 [ Unresolvable destination alias pfB_Top_v6 for rule pfB_Top_v6 auto rule] -
That error is normal. It's because when you reboot pfsense, pfblock needs some time to make the alias and the firewall complains about it.
-
Getting error when rebooting with latest PFblockerng
12-26-15 11:48:19 [ PF was wedged/busy and has been reset.]
12-26-15 11:48:40 [ There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]: ]The error "PF was wedged/busy and has been reset" is an issue… When using "Alias type" rules, you can sometimes get an error when re-installing the package, or rebooting if you have a nanobsd or ramdisk installation; however, this error is indicating an error in loading the rules. Not enough information to help you diagnose it... If it persists, maybe try to uncheck "Keep Settings", and disable pfBlockerNG, then "Save". Following that re-check "Keep Settings", and re-enable, followed by a "Force Reload"... There can also be an issue with a non-pfBNG rule that is causing this issue.
-
Why is it that my whitelist keeps getting pushed to the bottom of my floating firewall rules when it is at the top in the IPv4 lists? It was added after the blocklists, but as stated, its been moved to the top in the IPv4 tab in pfBlockerNG? I have to manually move it to the top of the floating firewall rules every reload.
-
Select the "Rule Order" setting that is appropriate for your setup in the General Tab.
-
Thank You.
-
Few things I found out while beta testing V2
-
Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed, em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload. They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.
-
Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum. I added all my hosts host to unbound statically as a work around
Tony M.
Tony, there are some recent posts from people either trying to get OpenVPN/PIA and pfBlockerNG/DNSBL working together or like me, looking to head that direction after I get some other fine tuning in place. Can you please elaborate or cookbook your setup if it is indeed working correctly.
For the 5 folks who asked me privately to keep you informed if I get any info on this… I'll be asking these questions publicly. If someone does respond privately I'll forward responses only if the OP approves. Really, no one here bites (well, maybe Dok - grin)
Rick
-
-
I am trying to setup the DNSBL portion of pfblocker and ran into a strange problem. I have a pretty restrictive firewall setup where it's pretty much default deny; allow by exception. When setting up the DNSBL portion, I see that the workstations are just timing out when accessing a known blocked site in the DNSBL. In the firewall logs for pfsense, I see the workstation trying to get to 127.0.0.1:8081. I fixed this timeout by adding the 127.0.0.1:8081 in the firewall and now it works properly.
Why does DNSBL try doing a localhost instead of the 10.10.10.1?
Thanks!
-
DNSBL create a NAT port forward to 127.0.0.1
 -
-
DNSBL create a NAT port forward to 127.0.0.1
Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?
I see alot of DNSBL alert, but no permit or match? is this working correctly?
-
DNSBL create a NAT port forward to 127.0.0.1
Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?
I see alot of DNSBL alert, but no permit or match? is this working correctly?
No you do not need to create any additional NAT rules.. However, in the general tab, you can click the checkbox to create a 'Floating permit rule' for other LAN subnets (WIFI, Guest etc…) to access the DNSBL VIP address. Also ensure that you do not have any other restrictive rules (as wiz561 posted above).
Not sure what you mean by "Permit and Match" as that only refers to IP rules, and not DNSBL?
-
@BBcan17,
The wrench/spanner/settings icon for the pfBlocker widget doesn't work with pfSense 2.3/ pfBlockerNG 2.0.6,
Appears you just need to an ID statement to the DIV tag to the pfblockerng.widget.php (line 500 approx.):
Not really worth me putting a pull request just for this, but maybe something for your next pull request? -
Not really worth me putting a pull request just for this, but maybe something for your next pull request?
Thanks Exolon, I guess one of the latest pfSense commits broke that ;) I have tested the change at line 500 and it seems to correct the issue…
Thanks!
-
When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images
http://kregjig.ning.com/
-
When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images
http://kregjig.ning.com/
Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.
-
When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images
http://kregjig.ning.com/
Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.
OK, that's perfect I'll try to getting it working
