Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.8m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hugovsky
      last edited by

      That error is normal. It's because when you reboot pfsense, pfblock needs some time to make the alias and the firewall complains about it.

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @cjbujold:

        Getting error when rebooting with latest PFblockerng

        12-26-15 11:48:19 [ PF was wedged/busy and has been reset.]
        12-26-15 11:48:40 [ There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]: ]

        The error "PF was wedged/busy and has been reset" is an issue… When using "Alias type" rules, you can sometimes get an error when re-installing the package, or rebooting if you have a nanobsd or ramdisk installation; however, this error is indicating an error in loading the rules.  Not enough information to help you diagnose it... If it persists, maybe try to uncheck "Keep Settings", and disable pfBlockerNG, then "Save". Following that re-check "Keep Settings", and re-enable, followed by a "Force Reload"... There can also be an issue with a non-pfBNG rule that is causing this issue.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • V
          Venlaw
          last edited by

          Why is it that my whitelist keeps getting pushed to the bottom of my floating firewall rules when it is at the top in the IPv4 lists? It was added after the blocklists, but as stated, its been moved to the top in the IPv4 tab in pfBlockerNG? I have to manually move it to the top of the floating firewall rules every reload.

          CPU: Celeron G1610 MB: Intel DQ77KB RAM: 4GB Corsair Vengeance Storage: 16GB SanDisk mSATA SSD NIC: Dual Onboard Intel (VLANs) WAN: 50/5mbps

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            Select the "Rule Order" setting that is appropriate for your setup in the General Tab.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • V
              Venlaw
              last edited by

              Thank You.

              CPU: Celeron G1610 MB: Intel DQ77KB RAM: 4GB Corsair Vengeance Storage: 16GB SanDisk mSATA SSD NIC: Dual Onboard Intel (VLANs) WAN: 50/5mbps

              1 Reply Last reply Reply Quote 0
              • R
                Ramosel
                last edited by

                @tonymorella:

                Few things I found out while beta testing V2

                • Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.

                • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around

                Tony M.

                Tony, there are some recent posts from people either trying to get OpenVPN/PIA and pfBlockerNG/DNSBL working together or like me, looking to head that direction after I get some other fine tuning in place.  Can you please elaborate or cookbook your setup if it is indeed working correctly.

                For the 5 folks who asked me privately to keep you informed if I get any info on this…  I'll be asking these questions publicly.    If someone does respond privately I'll forward responses only if the OP approves.  Really, no one here bites (well, maybe Dok - grin)

                Rick

                1 Reply Last reply Reply Quote 0
                • W
                  wiz561
                  last edited by

                  I am trying to setup the DNSBL portion of pfblocker and ran into a strange problem.  I have a pretty restrictive firewall setup where it's pretty much default deny; allow by exception.  When setting up the DNSBL portion, I see that the workstations are just timing out when accessing a known blocked site in the DNSBL.  In the firewall logs for pfsense, I see the workstation trying to get to 127.0.0.1:8081.  I fixed this timeout by adding the 127.0.0.1:8081 in the firewall and now it works properly.

                  Why does DNSBL try doing a localhost instead of the 10.10.10.1?

                  Thanks!

                  1 Reply Last reply Reply Quote 0
                  • RonpfSR
                    RonpfS
                    last edited by

                    DNSBL create a NAT port forward to 127.0.0.1

                    ![DSNBL NAT 3.jpg](/public/imported_attachments/1/DSNBL NAT 3.jpg)
                    ![DSNBL NAT 3.jpg_thumb](/public/imported_attachments/1/DSNBL NAT 3.jpg_thumb)

                    2.4.5-RELEASE-p1 (amd64)
                    Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                    Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                    1 Reply Last reply Reply Quote 0
                    • W
                      wiz561
                      last edited by

                      @RonpfS:

                      DNSBL create a NAT port forward to 127.0.0.1

                      Makes sense.  Thank  You!

                      1 Reply Last reply Reply Quote 0
                      • C
                        chain
                        last edited by

                        @RonpfS:

                        DNSBL create a NAT port forward to 127.0.0.1

                        Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

                        I see alot of DNSBL alert, but no permit or match? is this working correctly?

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          @chain:

                          @RonpfS:

                          DNSBL create a NAT port forward to 127.0.0.1

                          Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

                          I see alot of DNSBL alert, but no permit or match? is this working correctly?

                          No you do not need to create any additional NAT rules.. However, in the general tab, you can click the checkbox to create a 'Floating permit rule' for other LAN subnets (WIFI, Guest etc…) to access the DNSBL VIP address. Also ensure that you do not have any other restrictive rules (as wiz561 posted above).

                          Not sure what you mean by "Permit and Match" as that only refers to IP rules, and not DNSBL?

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • ExolonE
                            Exolon
                            last edited by

                            @BBcan17,

                            The wrench/spanner/settings icon for the pfBlocker widget doesn't work with pfSense 2.3/ pfBlockerNG 2.0.6,

                            Appears you just need to an ID statement to the DIV tag to the pfblockerng.widget.php (line 500 approx.):

                            
                            Not really worth me putting a pull request just for this, but maybe something for your next pull request?
                            
                            
                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              @Exolon:

                              Not really worth me putting a pull request just for this, but maybe something for your next pull request?

                              Thanks Exolon, I guess one of the latest pfSense commits broke that ;) I have tested the change at line 500 and it seems to correct the issue…

                              Thanks!

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • C
                                chain
                                last edited by

                                When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                                http://kregjig.ning.com/

                                image.PNG
                                image.PNG_thumb

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @chain:

                                  When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                                  http://kregjig.ning.com/

                                  Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    chain
                                    last edited by

                                    @BBcan177:

                                    @chain:

                                    When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                                    http://kregjig.ning.com/

                                    Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

                                    OK, that's perfect I'll try to getting it working

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      chain
                                      last edited by

                                      I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        @chain:

                                        I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

                                        Since DNSBL uses deduplication and as Easylists are the last to download, the most popular ADvert servers are being blocked by other Feeds… You can view the Easylist Domain list in the pfBNG Log tab and try to browse to any of those as a test.

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          shull
                                          last edited by

                                          Please excuse the noob question, but how do you enable EasyLists?  Specifically, what do you put in the Header field?  Thanks!

                                          pfSenseHeader.JPG
                                          pfSenseHeader.JPG_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            The header is just a label for the feed… So it needs to be unique...

                                            ie:

                                            EasyList
                                            EasyPrivacy

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.