PfBlockerNG v2.0 w/DNSBL

Rinzwind

Yup loggin is enabled. Also as test enabled "Global Enable Logging" on general tab. Still nothing. DNSBL blocks should show up on the Alerts tab right?

I also don't see any result of settings DNSBL Firewall Rule. No floathing rules are created.

So yeah a good informational best practice setup tutorial would be very welcome.

BBcan177

If your Lan is 10.10.10.x, what did you set the DNSBL VIP to? It has to be set to any other RFC1918 range for it to work.

In the general tab, the 'global logging' is only specific to IPv4/6 firewall rules. The DNSBL IP logging is only used when a DNSBL list posts IP addresses and these addresses are collected and put into an alias and a firewall rule added. It doesn't log domain based alerts..

I suggest you check your VIP and execute a 'force reload'. You should be able to ping and browse the VIP address from any LAN device. If not, then either the DNSBL service is not running or there is something preventing access to the VIP address. If you have multi-segment LAN addresses, enable the option in the DNSBL tab to create a floating firewall rule to pass the traffic from other Lan subnets.

If your still having trouble, post screenshots of the general and DNSBL tabs.

fraglord

@bbcan177: I still have the issue that after pfsense has been rebooted with DNSBL enabled I manually have to start or restart the unbound service to get the DNS working. Any clue what cause this?

BBcan177

Hi fraglord, do you have either of the DHCP check boxes enabled in the Unbound Resolver settings tab? There seems to be some issues with those options. You can also review the pfSense System and Resolver logs for more clues.

fraglord

Thanks for the quick reply :D I habe none of these options enabled because pfsense is not doing DHCP.
But there is something suspicious in the system logs

php-fpm[49122]: /rc.newwanip: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1456266101] unbound[78664:0] error: bind: address already in use [1456266101] unbound[78664:0] fatal error: could not open ports'

BBcan177

It's not a DNSBL issue. Check your Unbound settings. Maybe an interface settings issue? If you don't resolve it, post in the DNS forum and see if anyone has other advice for you.

XmickS

Im having troubles loading links in .txt format. with both easylist and blocklists such as: https://www.spamhaus.org/drop/drop.txt

this is the log created when updating:

[ Spamhaus_drop ] Downloading update .. 403 Forbidden

[ pfB_spamhaus - Spamhaus_drop ] Download FAIL [ 02/24/16 2:07:43 ]
Firewall and/or IDS are not blocking download.

The Following list has been REMOVED [ Spamhaus_drop ]

…
...

[ https://easylist-downloads.adblockplus.org/antiadblockfilters.txt ] Downloading update .

[ DNSBL_EasyList - https://easylist-downloads.adblockplus.org/antiadblockfilters.txt ] Download FAIL
Firewall and/or IDS are not blocking download.

I cant figure out what is going wrong in my settings. can somebody help me?

Thanks

BBcan177

When you see "403 Forbidden", the site that your trying to download from is either blocking your IP or rate limiting you. Disable the snort list for 24 hours and re-enable to get around that issue.

You can't use other EasyList feeds. Currently only two feeds for EasyList are hardcoded in the EasyList tab. There is also a note about this in the DNSBL tab.

fraglord

@BBcan177:

It's not a DNSBL issue. Check your Unbound settings. Maybe an interface settings issue? If you don't resolve it, post in the DNS forum and see if anyone has other advice for you.

Not sure if this is the cause of the problem - I am still investigating. At least I can confirm that with DNSBL disabled this problem does not occur.

BBcan177

@fraglord:

@BBcan177:

It's not a DNSBL issue. Check your Unbound settings. Maybe an interface settings issue? If you don't resolve it, post in the DNS forum and see if anyone has other advice for you.

Not sure if this is the cause of the problem - I am still investigating. At least I can confirm that with DNSBL disabled this problem does not occur.

How many domains are you blocking? You can see the total in the widget? Your footnote shows 1Gb of ram, maybe with DNSBL, it's taking longer for Unbound to start and newwanip is attempting to restart a second time?‎ Can you increase the RAM size?
‎

RonpfS

@BBcan177:

How many domains are you blocking? You can see the total in the widget? Your footnote shows 1Gb of ram, maybe with DNSBL, it's taking longer for Unbound to start and newwanip is attempting to restart a second time?‎ Can you increase the RAM size?

1099450 Domains in my case with 2.5GB

XmickS

@BBcan177:

When you see "403 Forbidden", the site that your trying to download from is either blocking your IP or rate limiting you. Disable the snort list for 24 hours and re-enable to get around that issue.

I can open the link in my browser, so i think they're not blocking me. I dont have the snort package installed on my pfsensebox. Which snortlist should i disable?

Thanks for the help!

BBcan177

Hi XmickS,

Sorry I meant to say disable the spamhaus drop list in pfBlockerNG for 24hrs. Typically a "403" error means the site you are downloading from is blocking you. Is your browser using a different Gateway or DNS server then the pfSense box? Do you use a proxy? If that doesn't help, post a screenshot of the spamhaus alias settings.

krhainos

I'm starting from a fresh install of 2.2.6-RELEASE (amd64) and rebuilding to clear out cruft from multiple past upgrades.

The installation of the pfBlockerNG package has been sitting at "Executing custom_php_resync_config_command()…" for about 45 minutes now. The browser is not showing a loading animation either (shows the pfSense logo favicon).

Is this normal?

I'm on a 30 down/5 up connection. Whatever it's downloading, if it's downloading that is, shouldn't take that long. Diagnostics/System Activity doesn't appear to say a whole lot is happening on the CPU either.

BBcan177

Hi krhainos, can you post the last 20 lines of the pfblockerng.log? You can run this command from the Diagnostics: Command Prompt:

tail -n20 /var/log/pfblockerng/pfblockerng.log

Are there any relevant errors in the pfSense system log?

krhainos

@BBcan177:

Hi krhainos, can you post the last 20 lines of the pfblockerng.log? You can run this command from the Diagnostics: Command Prompt:

tail -n20 /var/log/pfblockerng/pfblockerng.log

Are there any relevant errors in the pfSense system log?

I'm actually on the way to figuring it out!

Something about one of my rules is tripping up the pfBlockerNG installation.

I've been keeping configuration backups after every piece I configure. I've only done restores from my old config on my alises list, and my rules. It seems the installation hangs after I restore my rules. I'll update once I figure out what exactly it dislikes about my rules.

Update: I found it. After going through the filter section in my config, I found a line between two rules that read "<rule>". It looked out of place, so I removed it. pfBlockerNG is happy now! It downloads, updates, crons and everything. I don't know how it got in there, and going through old backups, it's been there for a while.

I've attached a screenshot in case a visual helps.

youruineverything.png_thumb </rule>

XmickS

@BBcan177:

Hi XmickS,

Sorry I meant to say disable the spamhaus drop list in pfBlockerNG for 24hrs. Typically a "403" error means the site you are downloading from is blocking you. Is your browser using a different Gateway or DNS server then the pfSense box? Do you use a proxy? If that doesn't help, post a screenshot of the spamhaus alias settings.

Found the problem. I was using vpn client and the ip i was using was being blocked by spamhaus. when i switched to another ip i was able to download the list. now everything is working as (i think) it should. thanks for the help!

XmickS

maybe a newbie question, but im curious. what is the difference with pfblockerng and adblock plus (or ghostery)? when these extensions are saying that they're blocking stuff, does that mean that my pfsense box is not blocking everything, or are they blocking the same stuff?

RonpfS

Adblock plus is an extension inside your Browser, so it does filter what your browser is using. It does not filter traffic for other application like Windows Update.

pfBlockerNG is on the firewall and filter traffic from all applications and computers.

XmickS

@RonpfS:

Adblock plus is an extension inside your Browser, so it does filter what your browser is using. It does not filter traffic for other application like Windows Update.

pfBlockerNG is on the firewall and filter traffic from all applications and computers.

But there is no difference in what they filter? Thought maybe pfblocker can't filter everything as well as an adblocker extension.

Sometimes an ad slips through my firewall. Does that mean I don't have everything set as it should?