PfBlockerNG v2.0 w/DNSBL

jarrad · Jan 26, 2016, 1:24 PM

Hi all

I seem to have a misconfiguration with the DNSBL. Specifically when Google tries to throw ads at me from their subsidiary Doubleclick I keep getting invalid certificate errors. Inspecting the certificate shows it looks like a generic certificate with all the default values you would expect from someone just hitting "OK" or something.

I've had a search around and I can't seem to find what's causing it.

Any suggestions?

heliop100 · Jan 26, 2016, 8:41 PM

Hi

Today I have one MX host blocked. E-mail on queue, not ping, not telnet.
The host was smtp.one2one.com.br (192.99.8.87)
I look for it on pfBlockerNG (v2.04) alerts, on system logs/firewall, and on states.
not found.
but when I disable pfBlockerNG I was able to send the messages. (ping, telnet)

Now I enable pfBloquerNG again, and that IP are blocked again.

How can I supress that IP?
Thanks.

RonpfS · Jan 26, 2016, 11:42 PM

Did you enable DNSBL ? Maybe it is the domain that is blocked. You should be able to see it in the pfBlockerNG: Alerts.

If it is the IP that is blocked, you should normally see it in pfBlockerNG: Alerts as well as in the Status: System logs: Firewall

Do you have Suppression enabled in the pfBlockerNG: General Settings? Read the instructions there and update the pfBlockerNGSuppress Alias to include that ip.

heliop100 · Jan 27, 2016, 1:03 PM

@RonpfS:

Did you enable DNSBL ? Maybe it is the domain that is blocked. You should be able to see it in the pfBlockerNG: Alerts.

Hi, no, no DNSBL.

@RonpfS:

If it is the IP that is blocked, you should normally see it in pfBlockerNG: Alerts as well as in the Status: System logs: Firewall

I know that, but the blocked IP are none on ALERTS or System Logs/Firewall

RonpfS · Jan 27, 2016, 5:08 PM

@heliop100:

I know that, but the blocked IP are none on ALERTS or System Logs/Firewall

Did you enable logging in the pfBlockerNG: IPv4 Alias/List Configuration: Edit form for each Alias?

heliop100 · Jan 27, 2016, 6:21 PM

Found the problem
I have one pfB_Mail ipv4 list that block 192.99.0.0/16 and one allow list with the 192.99.8.87 IP
With version 1 it was working, but after v 2.04 update the IP was blocked.
I change the rules order and now are working.
Thanks.

heliop100 · Jan 28, 2016, 9:39 PM

Hi,

Is it possible to use DNSBL and block sites for a IP range (for exemple 192.168.0.100-192.168.0.120)?

Thanks.

BBcan177 · Jan 30, 2016, 7:28 PM

@heliop100:

Hi,

Is it possible to use DNSBL and block sites for a IP range (for exemple 192.168.0.100-192.168.0.120)?

Thanks.

To bypass DNSBL, set those particular LAN devices to use a different DNS Server, or goto the Alerts Tab and suppress the domains that you want to allow.

dgarsys · Feb 2, 2016, 11:53 PM

OK - I'm feeling like an idiot.

I've gone through the thread on this, read posted instructions, un and re-installed pfblocker, made sure pfsense was current, made sure squid and squidguard were current, and even completely wiped to factory and reinstalled and reconfigure the pfsense, and while I can get pfblocker to isntall and configure and download lists without errors, and the auto-generated firewall rules SEEM to be updated with IP addresses, the service persists in showing itself as "down" instead of running.

Am I missing something? I'm not using the DNS features - just the IP block ones and country based block lists.

capedcrsdr · Feb 3, 2016, 12:27 AM

Greetings,

I am new to PFblockerNg, but started running based on a recommendation from a friend. I am using a Supermicro D525 server with PFsense 2.2.6 64-bit.

Issues:
1. The first time I installed and configured PFBlocker, the following issues showed up:
- No entries were added under either the Firewall or Aliases –> URLs.
- On reboot of the firewall, NTPD did not automatically start. (Neither did pfBlockerNG DNSBL Web Server)
2. Uninstalled
3. Reinstalled and reconfigured the package.
4. Issues encountered this time:
- Firewall and Aliases --> URLs rules were added
- NTPD <u>does not automatically</u> startup when firewall is rebooted and must be started manually

Does anyone have any ideas on how to address these issues? My configuration matches the configuration being used on a WatchGuard X700 running pfsense 2.2.4 32-bit.

I am not sure if there are additional logs that I need to provide for troubleshooting purposes?

Thanks!
capedcrsdr

BBcan177 · Feb 3, 2016, 12:29 AM

Hi dgarsys/capedcrsdr,

To use DNSBL make sure that you are using the DNS Resolver (Unbound) as the DNS service. Also ensure that you have defined the DNSBL VIP and ports in the DNSBL Tab.

Also note, that you need to run "Force Update" in the Update tab for the settings to be executed.

dgarsys · Feb 3, 2016, 12:37 AM

Not using DNSBL - that's not activated, just the pfblock stuff.

BBcan177 · Feb 3, 2016, 12:40 AM

@dgarsys:

Not using DNSBL - that's not activated, just the pfblock stuff.

Once you install pfBlockerNG, the service will show as "Down" since DNSBL is not enabled. If you don't use DNSBL, then you can safely ignore the downed state. I haven't figured out a way to remove the DNSBL service when its not enabled.

dgarsys · Feb 3, 2016, 1:10 AM

OK. Thank you BB.

I WAS missing something.

Now to verify Squidguard and PFblock are actually working. I can do that tomorrow.

darrenkdean · Feb 8, 2016, 1:48 AM

Is anyone using DNSBL & SquidGuard at the same time? Would this be considered redundant?

Having switched from SquidGuard to pfBlocker DNSBL to try it out, I'm struggling to find a configuration/solution for content filtering. Previously we used Shalla's Black List in SquidGuard to selectively block content by category. Is something like this possible in DNSBL & perhaps I'm just missing it?

If not, is there any reason why I would not want to run pfBlocker DNSBL & SquidGuard at the same time?

Thank you for your thoughts on this!

Best-

BBcan177 · Feb 8, 2016, 4:40 PM

@darrenkdean:

Is anyone using DNSBL & SquidGuard at the same time? Would this be considered redundant?

Having switched from SquidGuard to pfBlocker DNSBL to try it out, I'm struggling to find a configuration/solution for content filtering. Previously we used Shalla's Black List in SquidGuard to selectively block content by category. Is something like this possible in DNSBL & perhaps I'm just missing it?

If not, is there any reason why I would not want to run pfBlocker DNSBL & SquidGuard at the same time?

Hi darrenkdean,

There is no issue with Squid and DNSBL running at the same time… DNSBL is primarily a lite-weight solution to block 'Malicious Domains' and ADvert servers without adding the issues of running a proxy...

Currently, DNSBL does not block sub-domains. So if ads.yahoo.com is in a DNSBL blocklist, its not appropriate to block yahoo.com by adding the following, as it will obviously create issues…

local-zone: "yahoo.com" redirect local-data: "yahoo.com 60 IN A 10.10.10.1"

Its possible to use a list like Shallalist or dsi.ut-capitole.fr in DNSBL, by downloading the feed into /var/db/pfblockerng and extracting it into a subfolder. You can then manually add each category as a "localfile" in DNSBL.

The DNSBL blocklist will also require both "example.com" and "www . example.com" to be added. Here is a patch to auto add "www" to each domain.
https://forum.pfsense.org/index.php?topic=86212.msg581562#msg581562

Hope that helps!

Rinzwind · Feb 20, 2016, 5:10 PM

I don't know exactly what to do with "DNSBL Virtual IP". The LAN network is 10.10.10.x range. Must this VIP be an active IP? Read something about 1x1 image that is served? Does the pfBlockerNG handle this ip? Should it be in another private network range than the one in use? Tutorials and documentation about pfBlockerNG are non existing it seems?

RonpfS · Feb 20, 2016, 5:31 PM

There is plenty of documentation in the pfblockerNG tabs.

From the pfBlockerNG: DNSBL: Settings

DNSBL Virtual IP
Example ( 10.10.10.1 )
Enter a single IPv4 VIP address that is RFC1918 Compliant.

This address should be in an Isolated Range than what is used in your Network.
Rejected DNS Requests will be forwarded to this VIP (Virtual IP)
RFC1918 Compliant - (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

Read this Topic and also https://forum.pfsense.org/index.php?topic=86212.0 go get more information.

Rinzwind · Feb 20, 2016, 5:44 PM

I'm sorry.. there is not. A google of pfblockerng setup or tutorial ends up with lots of single posts. Not once consistent story.

I get this silent error when 'force updating'
DNSBL enabled FAIL - restoring Unbound conf
/var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
fatal flex scanner internal error–end of buffer missed

Followed the 'tutorial' in this thread about adblocking. Also nothing is seen in Alerts.

But am I interpreting this correctly? "This address should be in an Isolated Range than what is used in your Network."

So if my internal lan is 10.10.10.x I should add another private LAN range to pfSense and enter an ip in this new range in the box DNSBL Virtual IP? So a ip in an unused private range?

RonpfS · Feb 20, 2016, 6:00 PM

@Rinzwind:

I'm sorry.. there is not. A google of pfblockerng setup or tutorial ends up with lots of single posts. Not once consistent story.

Well if you read all posts in this topic you should get a good idea on how to setup it up.

@Rinzwind:

I get this silent error when 'force updating'
DNSBL enabled FAIL - restoring Unbound conf
/var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
fatal flex scanner internal error–end of buffer missed

Followed the 'tutorial' in this thread about adblocking. Also nothing is seen in Alerts.

When you change something in pfblockerNG, go to the pfBlockerNG: Update tab you have the Live Log Viewer that enable you to see what is happening in the background.

You can also see the log files in the pfBlockerNG: Log Browser

@Rinzwind:

But am I interpreting this correctly? "This address should be in an Isolated Range than what is used in your Network."

So if my internal lan is 10.10.10.x I should add another private LAN range to pfSense and enter an ip in this new range in the box DNSBL Virtual IP? So a ip in an unused private range?

Select something in the 192.168 or 172.16 network