PfBlockerNG
-
I have been playing around with pfblockerng and so far I love it. I have found one problem though. I use some blacklists from squidblacklist.org and they work great except if you put www in front of the domain. For example, playboy.com is blocked but www,playboy.com is not. Anyway to fix this?
Did you manually add the www. domain to a customlist? If so, make sure to select "Update custom list' at the bottom of the page before running a "Force Update"
No, I used the porn block list from squidblacklist.org.
The issue there is that DNSBL (unbound) will need to add an extra line for each domain (in bold)
local-zone: "doubleclick.net" redirect
local-data: "doubleclick.net A 10.0.0.111"It can cause some false positives depending on the domain name… Some ADvert servers like:
ads.example.com
You want to block just the ads.example.com and not example.com...
I will see if I can come up with a workaround for that... In the short term, you can add any additional domains to a custom list and block them that way.
I was scared you would say that. There are around 1 million domains on the list and it would take a very long time to make a custom list.
-
Here is a temporary workaround. Edit the file /usr/local/pkg/pfblockerng/pfblockerng.inc
And add this code after Line 2758
if (substr($line, 0, 4) != 'www.') { $domain_data .= "local-data: \"www." . $line . " 60 IN A {$pfb['dnsbl_vip']}\"\n"; }https://github.com/pfsense/pfsense-packages/blob/master/config/pfblockerng/pfblockerng.inc#L2758
So it will look like this:
// Remove suppressed domain names if (!in_array($line, $pfb_dnssupp)) { $domain_data .= "local-data: \"" . $line . " 60 IN A {$pfb['dnsbl_vip']}\"\n"; if (substr($line, 0, 4) != 'www.') { $domain_data .= "local-data: \"www." . $line . " 60 IN A {$pfb['dnsbl_vip']}\"\n"; } }Then execute a "Force Reload" for DNSBL.
-
Thank you BBcan177. That works.
-
@BBcan177 what do you think about adding a format so that we can import "host" file formats and it can parse out the domain name to lookup the IP?
So basically I believe like the "whois" works but it just knows that the first part of the line is an IP that doesn't matter.
0.0.0.0 facebook.com 127.0.0.1 google.comLike that.
There are a lot of good, free lists out there that are in this format.
Thoughts?
-
If your talking about DNSBL, the parser is already there to parse for the domain name in a host feed… Try it and if there are issues with the parser, send me the URL if it doesn't work.
Have you seen this thread:
https://forum.pfsense.org/index.php?topic=102470.0 -
@BBcan177 man, that's perfect. I cannot tell you how much your work helps me out. Thank you so much for all that you do. pfBlocker is amazing. :)
-
i get this error when saving pfblockerng
Fatal error: Cannot unset string offsets in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 3921
I have setup that iblock_level3 url, that block ip address, how do I excluded a set of IP address from being blocked?
-
Are some way to merge both lists? When I try to create one new alias with both alias on, I receive one error that it's not possible because the to aliases are from different types.
Please see the following links:
https://forum.pfsense.org/index.php?topic=102071.0
https://forum.pfsense.org/index.php?topic=86212.msg548324#msg548324
https://forum.pfsense.org/index.php?topic=86212.msg553921#msg553921Hi, Thanks a lot.
Happy new year!!! -
I have a fresh install of a pfsense 2.2.6 on a watchguard.
Now, I am having some issues with the installation of several packages, one of which is pfBlockerNG.
The package seems to install properly, no error during the installation, but it doesn't appear anywhere in the console.
I had it installed before, on the 2.2.2 variant, and it worked as expected.I thought it was just an interface glitch, and tried to reinstall the package.
Still not luck, so I used the "reinstall gui" option.
Still no luck, so I tried manually addressing>
https://192.168.1.1/pfblockerng/pfblockerng_alerts.php (which I had cached in my browser).This also didn't work.
PS: between the reinstalls I have also rebooted the appliance.
-
I'm trying to whitelist access to a website behind my firewall to my own country only.
When I create a Country list action as an 'alias permit' then use the resulting alias as the Source for the existing website NAT rule, it breaks my internal network access to the site. NAT Refelction is set to Enable (NAT + Proxy), what am i missing here?
-
I am starting to get errors. I guess the lists i am using are old. Where do i get the new list?
pfblockerng.log
[ Abuse_SSLBL ] Downloading update [ 01/02/16 6:01:12 ] .. 200 OK. completed .. [ dShield_Block ] Downloading update [ 01/02/16 6:01:13 ] . cURL Error: 51 SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds... . cURL Error: 51 SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds... . cURL Error: 51 SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds... .. unknown http status code [ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/02/16 6:01:29 ] Firewall and/or IDS are not blocking download. The Following list has been REMOVED [ dShield_Block ] [ Snort_BL ] Downloading update [ 01/02/16 6:01:30 ] . cURL Error: 60 SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds... . cURL Error: 60 SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds... . cURL Error: 60 SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds... .. unknown http status code [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/02/16 6:01:46 ] Firewall and/or IDS are not blocking download. The Following list has been REMOVED [ Snort_BL ] [ BBC_Goz ] exists. [ Alienvault ] Downloading update .. 200 OK.. completed ..error.log
[ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/03/16 20:11:11 ] Firewall and/or IDS are not blocking download. . unknown http status code [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/03/16 20:11:28 ] Firewall and/or IDS are not blocking download. . unknown http status code [ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:11:47 ] [ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ] . unknown http status code [ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:12:04 ] [ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ] . unknown http status code [ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/03/16 20:13:12 ] Firewall and/or IDS are not blocking download. . unknown http status code [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/03/16 20:13:29 ] Firewall and/or IDS are not blocking download. . unknown http status code [ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:13:46 ] [ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ] . unknown http status code [ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:14:08 ] [ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ] -
You can change the Lists state to FLEX for those lists and see if this help.
-
PfBlockeNG sounds really great, but after reading through about 500 posts I found a few people requesting a shorter tutorial, but no one has responded to those request.
Is there a concise guide to setting up and configuring PfblockerNG 2.0.4? I could eliminate a lot of repetitive questions.
I'd rather learn from the mistakes of others, than stay up to 2am trying figure out what setting I goofed.
Thanks
-
Converting MaxMind Country databases for pfBlockerNG.
This may take a few minutes…I just did fresh a install of pfSense after using the box for other stuff for a while and the converting the database process just hangs. It didn't a few months ago. I was running 2.2.5 the last time I had installed pfB so that and whatever has changed with the addon since a few months is really the only things that have changed in the process.
This is a fast 50+MB connection and an Intel c2758 board so I can't think it's the equipment. Logs aren't showing anything funky. I've removed and reinstalled pfB a few times to see if something would change but the CPU is idle at this point and logs aren't indicating anything's going on at this point of the install. I let it go about 20+ minutes on one attempt and just now let it sit there while I slept 7+ hours.
I can clearly see the lists have downloaded to the box via ssh and I even looked at the github source and downloaded the country lists from the url's via my browser.
edit- just redownloaded the pfSense iso, verified hash, reinstalled pfSense and still get the same hang
-
@BBCan17
I've since reinstalled Firefox and started walking through all of my addons setting them back up how I had them. So far I haven't seen it not install now. Maybe either successfully installing it once from another browser is what fixed it or I haven't checked a setting in my add-ons that was causing the error or maybe something in my browser cache… no idea. Kinda frustrating I haven't pinned it down but at least it wasn't a big deal I guess. If something comes up I'll let you know because that's really odd.Thanks for the help!
Also, I'm thinking of writing a tut at some point but I doubt it'll be concise as some would wish. It's one of those apps I want to gush on about. Besides, after using blockers for 10+ years they're handy but using >10 blocklists seems excessive prefer being conservative.
-
Hi I have just upgrqaded to pfsense 2.3B and am having a problem with the pfBlockerNG webserver service.
The service will not start for some reason. I do get a crash report from pfsense.Crash report begins. Anonymous machine information: amd64 10.2-STABLE FreeBSD 10.2-STABLE #296 d8ff348(devel): Wed Jan 6 08:09:19 CST 2016 root@pfs23-amd64-builder:/usr/home/pfsense/pfsense/tmp/obj/usr/home/pfsense/pfsense/tmp/FreeBSD-src/sys/pfSense Crash report details: PHP Errors: [06-Jan-2016 10:10:32 America/Edmonton] PHP Stack trace: [06-Jan-2016 10:10:32 America/Edmonton] PHP 1\. {main}() /usr/local/www/pfblockerng/pfblockerng.php:0 [06-Jan-2016 10:10:32 America/Edmonton] PHP 2\. sync_package_pfblockerng() /usr/local/www/pfblockerng/pfblockerng.php:101 [06-Jan-2016 10:10:32 America/Edmonton] PHP 3\. pfb_create_dnsbl() /usr/local/pkg/pfblockerng/pfblockerng.inc:3031 [06-Jan-2016 10:10:32 America/Edmonton] PHP 4\. link() /usr/local/pkg/pfblockerng/pfblockerng.inc:693 [06-Jan-2016 10:15:00 America/Edmonton] PHP Stack trace: [06-Jan-2016 10:15:00 America/Edmonton] PHP 1\. {main}() /usr/local/www/pfblockerng/pfblockerng.php:0 [06-Jan-2016 10:15:00 America/Edmonton] PHP 2\. pfblockerng_sync_cron() /usr/local/www/pfblockerng/pfblockerng.php:94 [06-Jan-2016 10:15:00 America/Edmonton] PHP 3\. sync_package_pfblockerng() /usr/local/www/pfblockerng/pfblockerng.php:387 [06-Jan-2016 10:15:00 America/Edmonton] PHP 4\. pfb_create_dnsbl() /usr/local/pkg/pfblockerng/pfblockerng.inc:3031 [06-Jan-2016 10:15:00 America/Edmonton] PHP 5\. link() /usr/local/pkg/pfblockerng/pfblockerng.inc:693I have tried reinstalling, removing the package completely and then installing.
It would be great if you could have a look at this.
BTW Thanks for a great package.Dan
-
pfSense moved from lighttpd to nginx in the beta which broke pfBNG (along with all other packages relying on lighttpd). I believe the author is working on an update.
https://forum.pfsense.org/index.php?topic=104854.0
-
Ok Thank you.
Since the package was available for 2.3 I thought it was already done. -
I'm getting this error in the update log
===[ DNSBL Process ]================================================ Missing DNSBL stats and/or Unbound DNSBL conf file - Rebuilding -
Hi trumee,
Some of those download fails are due to cURL errors. See the messages below. Set those to "Flex".
SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org'
SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds…Also Dangerulez and VMX are being blocked by other Firewall Lists.
[ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:11:47 ]
[ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ][ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:12:04 ]
[ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ]
