PfBlockerNG v2.0 w/DNSBL
-
While I'm relatively new to PFBlockerNG, I've been reading up a lot so I don't ask a question that hasn't already been answered. I hope this is a new question.
I setup PFBlockerNG first at home to test and now I'm implementing it in my office environment (starting with a branch office so I don't disrupt everyone if something gets messed up). The issue I encountered is minor. My home setup utilized PFSense for DHCP and DNS, so the DNS Unbound receiver just worked out of the box once enabled. When testing the config on the Windows Domain network, I had some issues. Windows Server 2012 manages DHCP and DNS. DHCP was configured to set the DNS server as the local DNS server and a remote server (connected over VPN). DNS forwarders were set to point to multiple DNS servers (a few public ones provided by our ISP).
Once I got the settings setup at the office, I noticed no traffic in the PFBlockerNG Alerts. After redoing some settings, I removed all DNS servers from DHCP and set the server running DNS on the local subnet and 10.10.10.1 (set in DNSBL settings) as the other DNS server. Then in DNS I removed all forwarders and replaced it with 10.10.10.1. After completing this, everything was working with PFBlockerNG filtering out ads based on the lists I used from setting it up via this post - (https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943).
Now, everything seems to be working properly, but I noticed that within my local subnet (192.168.2.0/24), I am unable to ping PFsense or access the webgui interface using the internal IP (192.168.2.1). However, I am able to access the webgui using the public WAN IP (all over HTTPS). Also, when I am on the main office subnet (192.168.1.0/24), I can access the PFSense webgui for the remote office with the LAN IP over the VPN at (192.168.2.1) as well as by using the GUI.
I assume this is due to DNS but I am not 100% sure on how to resolve this on the local subnet. It's not a major issue as I can manage it with the WAN IP but if possible I'd like to be able to resolve this problem I've created. Any ideas?
TL;DR -
I configured PFBlockerNG, updated DHCP and DNS settings on my Windows Server 2012 box, and can only access the PFSense web gui via the WAN IP. Any ideas on what setting I am missing or did I mess something up? -
Adblock plus is an extension inside your Browser, so it does filter what your browser is using. It does not filter traffic for other application like Windows Update.
pfBlockerNG is on the firewall and filter traffic from all applications and computers.
But there is no difference in what they filter? Thought maybe pfblocker can't filter everything as well as an adblocker extension.
Sometimes an ad slips through my firewall. Does that mean I don't have everything set as it should?
Which DNSBL Blocklists are you using? There are two posts in this thread for multiple DNSBL lists.
Are you sure that your LAN devices are not using a different DNS server?
Which sites are showing ADs?
-
Then in DNS I removed all forwarders and replaced it with 10.10.10.1.
Point your local LAN devices to your windows Server, and set the MS DNS forwarder to the pfSense IP Address to have DNSBL filter the DNS requests.
-
Then in DNS I removed all forwarders and replaced it with 10.10.10.1.
Point your local LAN devices to your windows Server, and set the MS DNS forwarder to the pfSense IP Address to have DNSBL filter the DNS requests.
I went back and did what you said. LAN devices point to the windows server and the MS DNS forwarder was set to the pfsense LAN interface IP. DNSBL did not filter. I troubleshot it and got it to work by using the pfsense WAN interface IP. While everything is working now with DNSBL filtering traffic, I can't ping the LAN interface IP or access the webgui when on the LAN subnet. I enabled logging on the firewall and tested sending a PING to the pfsense LAN IP and here is what I get:
Act Time If Source Destination Proto
–--------------------------------------------------------------------------------------------------------------------------
pass/100000101 Mar 2 15:58:02 LAN 10.0.0.9 10.0.0.1 ICMP
pass/100000101 Mar 2 16:42:23 LAN 10.0.0.9 10.0.0.1 ICMP
pass/100000101 Mar 2 16:42:25 LAN 10.0.0.9:137 10.0.0.255:137 UDP
pass/100000101 Mar 2 16:42:33 LAN 10.0.0.9:63623 10.10.10.1:53 UDP
pass/100000101 Mar 2 16:42:33 LAN 10.0.0.9:63729 10.10.10.1:53 UDP
pass/100000101 Mar 2 16:42:36 LAN 10.0.0.9:65440 10.10.10.1:53 UDPDid I mess up a setting or is my system in need of a fresh install? Thanks for your help!
-
Maybe DNSBL was not filtering because the DNS on your Windows server cached the domain name ip before the switch.
-
I went back and did what you said. LAN devices point to the windows server and the MS DNS forwarder was set to the pfsense LAN interface IP. DNSBL did not filter. I troubleshot it and got it to work by using the pfsense WAN interface IP. While everything is working now with DNSBL filtering traffic, I can't ping the LAN interface IP or access the webgui when on the LAN subnet.
I would start by disabling DNSBL and fixing one issue at a time. You should be able to ping and browse to the pfSense LAN IP from any LAN device first before attempting to use any package. Always best to troubleshoot with less obstacles. Then once the basic connectivity is working, you can add additional features. Using the pfSense WAN IP in a local Windows Server DNS Forwarder, doesn't look to be a solution.
-
Can anyone help me figure out how to get rid of this?
I got pfblocker running and all setup. But when it blocks stuff I get this big error image.
When I try to go to the domain it shows in the alerts I get that 1x1 image. Why isn't it applying it to the page?
-
Can anyone help me figure out how to get rid of this?
I got pfblocker running and all setup. But when it blocks stuff I get this big error image.
I get that 1x1 image. Why isn't it applying it to the page?
DNSBL pushes a 1x1 pixel image for any blocked domain. So if your viewing a page with ADverts, the Blocked AD is replaced with a hidden 1x1 image so that you don't see a big blocked image. But if the whole site your visiting is blocked completely by DNSBL, you will see the image that you show. Its a normal behavior.
-
I went back and did what you said. LAN devices point to the windows server and the MS DNS forwarder was set to the pfsense LAN interface IP. DNSBL did not filter. I troubleshot it and got it to work by using the pfsense WAN interface IP. While everything is working now with DNSBL filtering traffic, I can't ping the LAN interface IP or access the webgui when on the LAN subnet.
I would start by disabling DNSBL and fixing one issue at a time. You should be able to ping and browse to the pfSense LAN IP from any LAN device first before attempting to use any package. Always best to troubleshoot with less obstacles. Then once the basic connectivity is working, you can add additional features. Using the pfSense WAN IP in a local Windows Server DNS Forwarder, doesn't look to be a solution.
Thanks! I stripped down everything to just a basic install and one by one added the necessary settings. Now it is working properly. Workstations point to the windows server, and the MS DNS forwarder points to the LAN IP of my pfsense box. It's all working properly for this remote office now.
-
Hi everybody,
I need some help with pfBlockerNG and squid on the same pfsense machine. (Additional packages snort)
I installed and configured the pfblockerng package, downloaded som DNSBL. Then for testing I pasted some of the URLs into my browser to test and then it redirects me to the pfsense WebUI but not to the 1x1 pixel web page. Further I do not get any Alert in the pfblocker alers tab.
I am not sure if it is relevant but I am running squid (http + https) on the same pfsense machine with Auto Proxy configuration configured on my client.
In pfblockerng I added 10.123.123.123 als the virtual IP. I do not use this IP or subnet somewhere on my network. When I enter 10.123.123.123 in my browser I am redirected to the pfsense WebUI. When I enter the NATed IP 10.123.123.123:8081 I got the 1x1 pixel picture.
My pfsense has two interfaces - one interface for WAN (192.168.178.0/24) and another interface for LAN (192.168.10.0/24).
So my questions are:
1. Why is it redirecting me to the WebUI when entering a URL / domain which ins in DNSBL instead of redirecting me to the NAted IP address with 1x1 pixel
2. When I use https://10.123.123.123:443 the connection times out, when I try to access https://10.123.123.123.8443 the proxy tells my "access denied".
3. No matter what I access I can see any alerts.I really appreciate any help and/or suggestions
-
Hi everybody,
I need some help with pfBlockerNG and squid on the same pfsense machine. (Additional packages snort)DNSBL adds two NAT rules to push the VIP 10.123.123.123 to 127.0.0.1 on what ever port you selected for DNSBL http/https.
I suspect that Squid is listening on localhost and interfering with DNSBL. I don't use Squid, so maybe some others will chime in on their setup…
-
Thanks,
but squid is listening on different port 3128 so there should be no problem - I think.
I am not sure if squid respects the NAT rules because my WebUI is listening on port 80 an when I try to access 10.123.123.123 I get the WebUI but no NAT/redirect to :8081
So I would be interested if there is someone who is using squid and DNSBL.
-
FYI, the DNSBL Feed "Spam404" has moved to Github. Please update your link if you use this feed.
https://spam404bl.com/blacklist.txtDiscontinued
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt NEW -
strange bug ..
i disable pfblockerng , but it not disable dnsbl ..
still blocking pages …
this is expected?
pfsense 2.3 .
-
i disable pfblockerng , but it not disable dnsbl ..
Thanks for the report… I will fix that in the next release.
goto the DNSBL tab and uncheck the "Enable" checkbox for now.
-
Is there a way to make DNSBL work with PFsense DNS forwarder ( instead of resolver ) because if i am using resolver for resolving name like every few Hours it stops resolving Names and squid gives error ( i saw someone posted similar issue with DNS Resolver
so any alternate way to make pfblockerNG DNSBLC works with DNS Forwarder
-
I have a failover gateway group defined, is there a way to use that in pfBlockerNG? I can't seem to find the correct spot. Now it works with the main gateway but not the failover.
-
@Merchant:
Is there a way to make DNSBL work with PFsense DNS forwarder ( instead of resolver ) because if i am using resolver for resolving name like every few Hours it stops resolving Names and squid gives error ( i saw someone posted similar issue with DNS Resolver
so any alternate way to make pfblockerNG DNSBLC works with DNS Forwarder
The Forwarder can be used, but DNSBL is not configured for that currently… No real plans to do that at this time... The other issue posted for Squid is for something different than your issue. The Resolver is more secure than the Forwarder. Maybe post in the Squid or DNS threads for help with your particular issue?
-
I have a failover gateway group defined, is there a way to use that in pfBlockerNG? I can't seem to find the correct spot. Now it works with the main gateway but not the failover.
Do those interfaces show in the pfBNG: General Tab: Interface Options?
-
Thank you for this amazing package! :D
We are experiencing unusual behavior in HTTPS redirects with DNSBL turned on…hoping someone has some ideas on this...
DNSBL works flawlessly with our blacklists to block malicious and inappropriate content for all normal browsing. However, when a user tries to download a file from an alternative domain, the filter chokes.
Here's the symptom:
A user clicks on a link in a valid (non-blacklisted, let's say abcd.tld) site to an HTTPS file located cross-domain (let's say subdomain.subdomain.dcba.tld, also not blacklisted). The page comes up with an HTTP Time Out.We have observed this behavior in links in common apps like GMAIL and not-so-common ones hosted on Amazon AWS. It appears (although we can't confirm 100%) to only occur on redirects using an alias DNS entry (i.e. abcd.tld/file.ext = subdomain.subdomain.dcba.tld/file.ext) and it only happens in HTTPS.
Here are the steps in troubleshooting:
- Turn off DNSBL (but leave pfB on) fixes the issue instantly after a Reload.
- Turn on DNSBL but turn off the specific blacklists (basically no filtering active), issue still occurs (also tried with Alexa on/off).
- Add redirected FQDN's to suppression list, issue still occurs.
- No waiting or flushdns command needed (so it does not appear to be DNS Resolver related).
The VIP and DNSBL ports are all defaults and there are no conflicts we can detect. We have multiple LAN segments, so the Firewall Rule is selected across all segments correctly. No Advanced Inbound Firewall Rules are configured.
We are running pfBlockerNG 2.0.4 on pfSense 2.2.6. There are no conflicting installed packages (only Cron, File Manager, LCDproc-dev, and suricata are installed; suricata is not enabled).
Any thoughts are much appreciated. I cannot find a previous posting reporting this behavior.
