Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.8m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ExolonE
      Exolon
      last edited by

      @BBcan17,

      The wrench/spanner/settings icon for the pfBlocker widget doesn't work with pfSense 2.3/ pfBlockerNG 2.0.6,

      Appears you just need to an ID statement to the DIV tag to the pfblockerng.widget.php (line 500 approx.):

      
Not really worth me putting a pull request just for this, but maybe something for your next pull request?
      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @Exolon:

        Not really worth me putting a pull request just for this, but maybe something for your next pull request?

        Thanks Exolon, I guess one of the latest pfSense commits broke that ;) I have tested the change at line 500 and it seems to correct the issue…

        Thanks!

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • C
          chain
          last edited by

          When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

          http://kregjig.ning.com/

          image.PNG
          image.PNG_thumb

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @chain:

            When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

            http://kregjig.ning.com/

            Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • C
              chain
              last edited by

              @BBcan177:

              @chain:

              When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

              http://kregjig.ning.com/

              Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

              OK, that's perfect I'll try to getting it working

              1 Reply Last reply Reply Quote 0
              • C
                chain
                last edited by

                I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  @chain:

                  I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

                  Since DNSBL uses deduplication and as Easylists are the last to download, the most popular ADvert servers are being blocked by other Feeds… You can view the Easylist Domain list in the pfBNG Log tab and try to browse to any of those as a test.

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • S
                    shull
                    last edited by

                    Please excuse the noob question, but how do you enable EasyLists?  Specifically, what do you put in the Header field?  Thanks!

                    pfSenseHeader.JPG
                    pfSenseHeader.JPG_thumb

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      The header is just a label for the feed… So it needs to be unique...

                      ie:

                      EasyList
                      EasyPrivacy

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • C
                        chain
                        last edited by

                        here is additional list that can be add to DNSBL

                        http://www.securemecca.com/Downloads/hosts.txt

                        1 Reply Last reply Reply Quote 0
                        • T
                          todolist
                          last edited by

                          Thanks for pfBlockerNG. I make heavy use of it! I have recently enabled DNSBL and am having a strange issue: When I try to access the pfSense web GUI via hostname, I am redirected to the DNSBL VIP (10.10.10.1). When I "dig firewall.domain" the pfSense box (DNS server) returns the VIP first, and then the proper IP: 10.100.0.1.

                          I have Unbound set to disable forwarding and enable DHCP registrations and I have a host override for "firewall.domain" pointing to it's proper IP 10.100.0.1. DNSBL "Alerts" tab shows the following:

                          IF: Unknown
                          Source: Unknown
                          Domain/Referer|URI|Agent: firewall.domain Not available for HTTPS alerts
                          List: no match

                          Am I missing something in the Unbound configuration? Or is it a DNSBL setting I'm missing? All other local hosts are resolving without issue, it's just pfSense itself that exhibits this behavior.

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            @todolist:

                            When I try to access the pfSense web GUI via hostname, I am redirected to the DNSBL VIP (10.10.10.1). When I "dig firewall.domain" the pfSense box (DNS server) returns the VIP first, and then the proper IP: 10.100.0.1.

                            I have Unbound set to disable forwarding and enable DHCP registrations and I have a host override for "firewall.domain" pointing to it's proper IP 10.100.0.1. DNSBL "Alerts" tab shows the following:

                            IF: Unknown
                            Source: Unknown
                            Domain/Referer|URI|Agent: firewall.domain Not available for HTTPS alerts
                            List: no match

                            Am I missing something in the Unbound configuration? Or is it a DNSBL setting I'm missing? All other local hosts are resolving without issue, it's just pfSense itself that exhibits this behavior.

                            Check your NAT and DNS Host overrides… Don't add anything manually that points to the DNSBL VIP, as that is done by the pkg automatically... Also there are some issues with the Unbound DHCP reg checkboxes... Most leave those disabled...

                            If you still having issues, maybe try to post in the DNS/NAT forum sections, to see if others can offer any other advice.

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • T
                              todolist
                              last edited by

                              Thanks BBcan177! What would cause the "IF" and "Source" alerts to be "Unknown" and the "List" entry to read "no match"? Is there a debug option I can enable? I've looked through the pfBlockerNG logs tab but maybe I missed a "verbose" option?

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                Unfortunately for HTTPS requests, the IF/SRC information is not available to log… If you want to see more information run a tcpdump or wireshark... There is some help text in the DNSBL tab...

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • T
                                  todolist
                                  last edited by

                                  @BBcan177:

                                  Unfortunately for HTTPS requests, the IF/SRC information is not available to log… If you want to see more information run a tcpdump or wireshark... There is some help text in the DNSBL tab...

                                  Understood. Thanks again for this package!

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    DLFerguRD
                                    last edited by

                                    Thanks for your hard work BBcan177 DNSBL in now working on pfsense 2.3 :)

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      cwilkinson
                                      last edited by

                                      Hello,

                                      I have just installed this package on a fresh install of pfSense 2.2.6, NanoBSD 4GB.

                                      I followed your basic instructions and everything works, but after a reboot of the box the DNS Resolver Service fails to start with DNSBL enabled.

                                      I do not have the log info at the moment, but I remember it was looking for a config file on /var that was no longer there.

                                      Please Advise,

                                      Thanks

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        hda
                                        last edited by

                                        Services-DNS Resolver Advanced: delete config entry (that file has been lost). Save. Start Resolver.
                                        pfBlockerNG-Update: Force Update.

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          cwilkinson
                                          last edited by

                                          I already know how to fix it like that but that requires manual intervention, after a reboot that's not very useful.

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            cipherson
                                            last edited by

                                            Hey Guys,

                                            The latest version of pfsense/pfBlockerNG seems to have issues with the "ET IQRisk" list

                                            I just updated my pfsense to the latest 2.2.6-RELEASE built on Mon Dec 21.

                                            I noticed in the pfBlockerNG that my Alias for IQRisk only have an IP count of 1.

                                            I review all the settings and they seemed to be messed up. Following the steps on the Repuation tab it says:
                                            "Select the ET IQRisk' format. The URL should use the .gz File Type. Enter your "ETPRO" code in URL. Further information can be found @ ET IQRisk IP Reputation"
                                            This format type is not longer listed and the help URL is no longer valid.

                                            Any thoughts on how to fix this? Did they remove support for this list?

                                            Also posted via reddit on /r/PFSENSE

                                            https://www.reddit.com/r/PFSENSE/comments/428ehb/latest_pfblockerng_et_iqrisk_format_missing/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.