• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG v2.0 w/DNSBL

Scheduled Pinned Locked Moved
pfBlockerNG
192
1.1k
1.5m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • R
    RonpfS
    last edited by Dec 29, 2015, 6:33 PM

    DNSBL create a NAT port forward to 127.0.0.1

    ![DSNBL NAT 3.jpg](/public/imported_attachments/1/DSNBL NAT 3.jpg)
    ![DSNBL NAT 3.jpg_thumb](/public/imported_attachments/1/DSNBL NAT 3.jpg_thumb)

    2.4.5-RELEASE-p1 (amd64)
    Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
    Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

    1 Reply Last reply Reply Quote 0
    • W
      wiz561
      last edited by Dec 30, 2015, 1:12 AM

      @RonpfS:

      DNSBL create a NAT port forward to 127.0.0.1

      Makes sense.  Thank  You!

      1 Reply Last reply Reply Quote 0
      • C
        chain
        last edited by Dec 30, 2015, 1:40 AM

        @RonpfS:

        DNSBL create a NAT port forward to 127.0.0.1

        Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

        I see alot of DNSBL alert, but no permit or match? is this working correctly?

        1 Reply Last reply Reply Quote 0
        • B
          BBcan177 Moderator
          last edited by Dec 30, 2015, 3:29 AM

          @chain:

          @RonpfS:

          DNSBL create a NAT port forward to 127.0.0.1

          Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

          I see alot of DNSBL alert, but no permit or match? is this working correctly?

          No you do not need to create any additional NAT rules.. However, in the general tab, you can click the checkbox to create a 'Floating permit rule' for other LAN subnets (WIFI, Guest etc…) to access the DNSBL VIP address. Also ensure that you do not have any other restrictive rules (as wiz561 posted above).

          Not sure what you mean by "Permit and Match" as that only refers to IP rules, and not DNSBL?

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • E
            Exolon
            last edited by Dec 30, 2015, 10:08 PM

            @BBcan17,

            The wrench/spanner/settings icon for the pfBlocker widget doesn't work with pfSense 2.3/ pfBlockerNG 2.0.6,

            Appears you just need to an ID statement to the DIV tag to the pfblockerng.widget.php (line 500 approx.):

            
            Not really worth me putting a pull request just for this, but maybe something for your next pull request?
            
            
            1 Reply Last reply Reply Quote 0
            • B
              BBcan177 Moderator
              last edited by Dec 31, 2015, 3:13 AM

              @Exolon:

              Not really worth me putting a pull request just for this, but maybe something for your next pull request?

              Thanks Exolon, I guess one of the latest pfSense commits broke that ;) I have tested the change at line 500 and it seems to correct the issue…

              Thanks!

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • C
                chain
                last edited by Jan 1, 2016, 10:26 PM

                When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                http://kregjig.ning.com/

                image.PNG
                image.PNG_thumb

                1 Reply Last reply Reply Quote 0
                • B
                  BBcan177 Moderator
                  last edited by Jan 3, 2016, 3:56 PM

                  @chain:

                  When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                  http://kregjig.ning.com/

                  Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • C
                    chain
                    last edited by Jan 5, 2016, 12:15 AM

                    @BBcan177:

                    @chain:

                    When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

                    http://kregjig.ning.com/

                    Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

                    OK, that's perfect I'll try to getting it working

                    1 Reply Last reply Reply Quote 0
                    • C
                      chain
                      last edited by Jan 6, 2016, 10:55 PM

                      I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

                      1 Reply Last reply Reply Quote 0
                      • B
                        BBcan177 Moderator
                        last edited by Jan 8, 2016, 10:19 PM

                        @chain:

                        I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

                        Since DNSBL uses deduplication and as Easylists are the last to download, the most popular ADvert servers are being blocked by other Feeds… You can view the Easylist Domain list in the pfBNG Log tab and try to browse to any of those as a test.

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • S
                          shull
                          last edited by Jan 9, 2016, 9:39 PM

                          Please excuse the noob question, but how do you enable EasyLists?  Specifically, what do you put in the Header field?  Thanks!

                          pfSenseHeader.JPG
                          pfSenseHeader.JPG_thumb

                          1 Reply Last reply Reply Quote 0
                          • B
                            BBcan177 Moderator
                            last edited by Jan 9, 2016, 9:55 PM

                            The header is just a label for the feed… So it needs to be unique...

                            ie:

                            EasyList
                            EasyPrivacy

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • C
                              chain
                              last edited by Jan 10, 2016, 4:53 PM

                              here is additional list that can be add to DNSBL

                              http://www.securemecca.com/Downloads/hosts.txt

                              1 Reply Last reply Reply Quote 0
                              • T
                                todolist
                                last edited by Jan 16, 2016, 9:29 PM

                                Thanks for pfBlockerNG. I make heavy use of it! I have recently enabled DNSBL and am having a strange issue: When I try to access the pfSense web GUI via hostname, I am redirected to the DNSBL VIP (10.10.10.1). When I "dig firewall.domain" the pfSense box (DNS server) returns the VIP first, and then the proper IP: 10.100.0.1.

                                I have Unbound set to disable forwarding and enable DHCP registrations and I have a host override for "firewall.domain" pointing to it's proper IP 10.100.0.1. DNSBL "Alerts" tab shows the following:

                                IF: Unknown
                                Source: Unknown
                                Domain/Referer|URI|Agent: firewall.domain Not available for HTTPS alerts
                                List: no match

                                Am I missing something in the Unbound configuration? Or is it a DNSBL setting I'm missing? All other local hosts are resolving without issue, it's just pfSense itself that exhibits this behavior.

                                1 Reply Last reply Reply Quote 0
                                • B
                                  BBcan177 Moderator
                                  last edited by Jan 17, 2016, 4:11 PM

                                  @todolist:

                                  When I try to access the pfSense web GUI via hostname, I am redirected to the DNSBL VIP (10.10.10.1). When I "dig firewall.domain" the pfSense box (DNS server) returns the VIP first, and then the proper IP: 10.100.0.1.

                                  I have Unbound set to disable forwarding and enable DHCP registrations and I have a host override for "firewall.domain" pointing to it's proper IP 10.100.0.1. DNSBL "Alerts" tab shows the following:

                                  IF: Unknown
                                  Source: Unknown
                                  Domain/Referer|URI|Agent: firewall.domain Not available for HTTPS alerts
                                  List: no match

                                  Am I missing something in the Unbound configuration? Or is it a DNSBL setting I'm missing? All other local hosts are resolving without issue, it's just pfSense itself that exhibits this behavior.

                                  Check your NAT and DNS Host overrides… Don't add anything manually that points to the DNSBL VIP, as that is done by the pkg automatically... Also there are some issues with the Unbound DHCP reg checkboxes... Most leave those disabled...

                                  If you still having issues, maybe try to post in the DNS/NAT forum sections, to see if others can offer any other advice.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    todolist
                                    last edited by Jan 17, 2016, 5:05 PM

                                    Thanks BBcan177! What would cause the "IF" and "Source" alerts to be "Unknown" and the "List" entry to read "no match"? Is there a debug option I can enable? I've looked through the pfBlockerNG logs tab but maybe I missed a "verbose" option?

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      BBcan177 Moderator
                                      last edited by Jan 17, 2016, 5:08 PM

                                      Unfortunately for HTTPS requests, the IF/SRC information is not available to log… If you want to see more information run a tcpdump or wireshark... There is some help text in the DNSBL tab...

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        todolist
                                        last edited by Jan 17, 2016, 6:05 PM

                                        @BBcan177:

                                        Unfortunately for HTTPS requests, the IF/SRC information is not available to log… If you want to see more information run a tcpdump or wireshark... There is some help text in the DNSBL tab...

                                        Understood. Thanks again for this package!

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          DLFerguRD
                                          last edited by Jan 18, 2016, 1:58 PM

                                          Thanks for your hard work BBcan177 DNSBL in now working on pfsense 2.3 :)

                                          1 Reply Last reply Reply Quote 0
                                          290 out of 1077
                                          • First post
                                            290/1077
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received