• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG v2.0 w/DNSBL

pfBlockerNG
192
1.1k
1.6m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B
    BBcan177 Moderator
    last edited by Feb 3, 2016, 12:40 AM

    @dgarsys:

    Not using DNSBL - that's not activated, just the pfblock stuff.

    Once you install pfBlockerNG, the service will show as "Down" since DNSBL is not enabled. If you don't use DNSBL, then you can safely ignore the downed state. I haven't figured out a way to remove the DNSBL service when its not enabled.

    "Experience is something you don't get until just after you need it."

    Website: http://pfBlockerNG.com
    Twitter: @BBcan177  #pfBlockerNG
    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

    1 Reply Last reply Reply Quote 0
    • D
      dgarsys
      last edited by Feb 3, 2016, 1:10 AM

      OK. Thank you BB.

      I WAS missing something.

      Now to verify Squidguard and PFblock are actually working. I can do that tomorrow.

      1 Reply Last reply Reply Quote 0
      • D
        darrenkdean
        last edited by Feb 8, 2016, 1:48 AM

        Is anyone using DNSBL & SquidGuard at the same time?  Would this be considered redundant?

        Having switched from SquidGuard to pfBlocker DNSBL to try it out, I'm struggling to find a configuration/solution for content filtering.  Previously we used Shalla's Black List in SquidGuard to selectively block content by category.  Is something like this possible in DNSBL & perhaps I'm just missing it?

        If not, is there any reason why I would not want to run pfBlocker DNSBL & SquidGuard at the same time?

        Thank you for your thoughts on this!

        Best-

        1 Reply Last reply Reply Quote 0
        • B
          BBcan177 Moderator
          last edited by Feb 8, 2016, 4:40 PM

          @darrenkdean:

          Is anyone using DNSBL & SquidGuard at the same time?  Would this be considered redundant?

          Having switched from SquidGuard to pfBlocker DNSBL to try it out, I'm struggling to find a configuration/solution for content filtering.  Previously we used Shalla's Black List in SquidGuard to selectively block content by category.  Is something like this possible in DNSBL & perhaps I'm just missing it?

          If not, is there any reason why I would not want to run pfBlocker DNSBL & SquidGuard at the same time?

          Hi darrenkdean,

          There is no issue with Squid and DNSBL running at the same time… DNSBL is primarily a lite-weight solution to block 'Malicious Domains' and ADvert servers without adding the issues of running a proxy...

          Currently, DNSBL does not block sub-domains. So if ads.yahoo.com is in a DNSBL blocklist, its not appropriate to block yahoo.com by adding the following, as it will obviously create issues…

          local-zone: "yahoo.com" redirect local-data: "yahoo.com 60 IN A 10.10.10.1"

          Its possible to use a list like Shallalist or dsi.ut-capitole.fr in DNSBL, by downloading the feed into /var/db/pfblockerng and extracting it into a subfolder. You can then manually add each category as a "localfile" in DNSBL.

          The DNSBL blocklist will also require both "example.com" and "www . example.com" to be added. Here is a patch to auto add "www" to each domain.
          https://forum.pfsense.org/index.php?topic=86212.msg581562#msg581562

          Hope that helps!

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • R
            Rinzwind
            last edited by Feb 20, 2016, 5:10 PM

            I don't know exactly what to do with "DNSBL Virtual IP". The LAN network is 10.10.10.x range. Must this VIP be an active IP? Read something about 1x1 image that is served? Does the pfBlockerNG handle this ip? Should it be in another private network range than the one in use? Tutorials and documentation about pfBlockerNG are non existing it seems?

            1 Reply Last reply Reply Quote 0
            • R
              RonpfS
              last edited by Feb 20, 2016, 5:31 PM

              There is plenty of documentation in the pfblockerNG tabs.

              From the pfBlockerNG: DNSBL: Settings

              DNSBL Virtual IP
              Example ( 10.10.10.1 )
              Enter a  single IPv4 VIP address  that is RFC1918 Compliant.

              This address should be in an Isolated Range than what is used in your Network.
              Rejected DNS Requests will be forwarded to this VIP (Virtual IP)
              RFC1918 Compliant - (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)

              Read this Topic and also https://forum.pfsense.org/index.php?topic=86212.0 go get more information.

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • R
                Rinzwind
                last edited by Feb 20, 2016, 5:44 PM Feb 20, 2016, 5:40 PM

                I'm sorry.. there is not. A google of pfblockerng setup or tutorial ends up with lots of single posts. Not once consistent story.

                I get this silent error when 'force updating'
                DNSBL enabled FAIL - restoring Unbound conf
                /var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
                fatal flex scanner internal error–end of buffer missed

                Followed the 'tutorial' in this thread about adblocking. Also nothing is seen in Alerts.

                But am I interpreting this correctly? "This address should be in an Isolated Range than what is used in your Network."

                So if my internal lan is 10.10.10.x I should add another private LAN range to pfSense and enter an ip in this new range in the box DNSBL Virtual IP? So a ip in an unused private range?

                1 Reply Last reply Reply Quote 0
                • R
                  RonpfS
                  last edited by Feb 20, 2016, 6:00 PM Feb 20, 2016, 5:55 PM

                  @Rinzwind:

                  I'm sorry.. there is not. A google of pfblockerng setup or tutorial ends up with lots of single posts. Not once consistent story.

                  Well if you read all posts in this topic you should get a good idea on how to setup it up.

                  @Rinzwind:

                  I get this silent error when 'force updating'
                  DNSBL enabled FAIL - restoring Unbound conf
                  /var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
                  fatal flex scanner internal error–end of buffer missed

                  Followed the 'tutorial' in this thread about adblocking. Also nothing is seen in Alerts.

                  When you change something in pfblockerNG, go to the pfBlockerNG: Update tab you have the Live Log Viewer that enable you to see what is happening in the background.

                  You can also see the log files in the pfBlockerNG: Log Browser

                  @Rinzwind:

                  But am I interpreting this correctly? "This address should be in an Isolated Range than what is used in your Network."

                  So if my internal lan is 10.10.10.x I should add another private LAN range to pfSense and enter an ip in this new range in the box DNSBL Virtual IP? So a ip in an unused private range?

                  Select something in the 192.168 or 172.16 network

                  2.4.5-RELEASE-p1 (amd64)
                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                  1 Reply Last reply Reply Quote 0
                  • R
                    Rinzwind
                    last edited by Feb 20, 2016, 6:05 PM

                    This is the log when running a "Force Update":

                    UPDATE PROCESS START [ 02/20/16 19:05:52 ]

                    ===[  DNSBL Process  ]================================================

                    [ yoyo ] exists.
                    [ hpHosts_ads ] exists.
                    [ Adaway ] exists.
                    [ Cameleon ] exists.  Adding Unbound Server:Include line… completed
                    Validating database... completed [ 02/20/16 19:05:53 ]

                    DNSBL enabled FAIL - restoring Unbound conf
                    /var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
                    fatal flex scanner internal error–end of buffer missed

                    ===[  Continent Process  ]============================================

                    ===[  Aliastables / Rules  ]==========================================

                    No changes to Firewall rules, skipping Filter Reload
                    No Changes to Aliases, Skipping pfctl Update

                    UPDATE PROCESS ENDED [ 02/20/16 19:05:54 ]

                    1 Reply Last reply Reply Quote 0
                    • R
                      RonpfS
                      last edited by Feb 20, 2016, 8:11 PM Feb 20, 2016, 6:17 PM

                      Did you select the Virtual IP outside you LAN 10.10.10.x network?
                      You enabled DNSBL ?

                      Looks like you may have an error in one of the list. Enable only one list to see if the update goes thru.

                      2.4.5-RELEASE-p1 (amd64)
                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                      1 Reply Last reply Reply Quote 0
                      • R
                        Rinzwind
                        last edited by Feb 20, 2016, 6:45 PM

                        Thanks. Indeed some entry gave that error… Seems to be working now. Still no alerts visible, but I know its blocking ads...

                        1 Reply Last reply Reply Quote 0
                        • R
                          RonpfS
                          last edited by Feb 20, 2016, 8:11 PM

                          Did you enable logging in DNSBL IP Firewall Rule Settings?

                          2.4.5-RELEASE-p1 (amd64)
                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                          1 Reply Last reply Reply Quote 0
                          • R
                            Rinzwind
                            last edited by Feb 21, 2016, 10:49 AM

                            Yup loggin is enabled. Also as test enabled "Global Enable Logging"  on general tab. Still nothing. DNSBL blocks should show up on the Alerts tab right?

                            I also don't see any result of settings DNSBL Firewall Rule. No floathing rules are created.

                            So yeah a good informational best practice setup tutorial would be very welcome.

                            1 Reply Last reply Reply Quote 0
                            • B
                              BBcan177 Moderator
                              last edited by Feb 21, 2016, 3:25 PM

                              If your Lan is 10.10.10.x, what did you set the DNSBL VIP to? It has to be set to any other RFC1918 range for it to work.

                              In the general tab, the 'global logging' is only specific to IPv4/6 firewall rules. The DNSBL IP logging is only used when a DNSBL list posts IP addresses and these addresses are collected and put into an alias and a firewall rule added. It doesn't log domain based alerts..

                              I suggest you check your VIP and execute a 'force reload'. You should be able to ping and browse the VIP address from any LAN device. If not, then either the DNSBL service is not running or there is something preventing access to the VIP address. If you have multi-segment LAN addresses, enable the option in the DNSBL tab to create a floating firewall rule to pass the traffic from other Lan subnets.

                              If your still having trouble, post screenshots of the general and DNSBL tabs.

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • F
                                fraglord
                                last edited by Feb 23, 2016, 10:27 PM

                                @bbcan177: I still have the issue that after pfsense has been rebooted with DNSBL enabled I manually have to start or restart the unbound service to get the DNS working. Any clue what cause this?

                                pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

                                1 Reply Last reply Reply Quote 0
                                • B
                                  BBcan177 Moderator
                                  last edited by Feb 23, 2016, 10:37 PM

                                  Hi fraglord, do you have either of the DHCP check boxes enabled in the Unbound Resolver settings tab? There seems to be some issues with those options. You can also review the pfSense System and Resolver logs for more clues.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    fraglord
                                    last edited by Feb 23, 2016, 11:13 PM

                                    Thanks for the quick reply  :D I habe none of these options enabled because pfsense is not doing DHCP.
                                    But there is something suspicious in the system logs

                                    php-fpm[49122]: /rc.newwanip: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1456266101] unbound[78664:0] error: bind: address already in use [1456266101] unbound[78664:0] fatal error: could not open ports'
                                    

                                    pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      BBcan177 Moderator
                                      last edited by Feb 23, 2016, 11:27 PM

                                      It's not a DNSBL issue. Check your Unbound settings. Maybe an interface settings issue? If you don't resolve it, post in the DNS forum and see if anyone has other advice for you.

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • X
                                        XmickS
                                        last edited by Feb 24, 2016, 1:19 AM

                                        Im having troubles loading links in .txt format. with both easylist and blocklists such as: https://www.spamhaus.org/drop/drop.txt

                                        this is the log created when updating:

                                        [ Spamhaus_drop ] Downloading update  .. 403 Forbidden

                                        [ pfB_spamhaus - Spamhaus_drop ] Download FAIL [ 02/24/16 2:07:43 ]
                                          Firewall and/or IDS are not blocking download.

                                        The Following list has been REMOVED [ Spamhaus_drop ]

                                        …
                                        ...

                                        [ https://easylist-downloads.adblockplus.org/antiadblockfilters.txt ] Downloading update  .

                                        [ DNSBL_EasyList - https://easylist-downloads.adblockplus.org/antiadblockfilters.txt ] Download FAIL
                                          Firewall and/or IDS are not blocking download.

                                        I cant figure out what is going wrong in my settings. can somebody help me?

                                        Thanks

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          BBcan177 Moderator
                                          last edited by Feb 24, 2016, 1:51 AM

                                          When you see "403 Forbidden", the site that your trying to download from is either blocking your IP or rate limiting you. Disable the snort list for 24 hours and re-enable to get around that issue.

                                          You can't use other EasyList feeds. Currently only two feeds for EasyList are hardcoded in the EasyList tab. There is also a note about this in the DNSBL tab.

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.