PfBlockerNG v2.0 w/DNSBL

BBcan177

Can anyone help me figure out how to get rid of this?

I got pfblocker running and all setup. But when it blocks stuff I get this big error image.

I get that 1x1 image. Why isn't it applying it to the page?

DNSBL pushes a 1x1 pixel image for any blocked domain. So if your viewing a page with ADverts, the Blocked AD is replaced with a hidden 1x1 image so that you don't see a big blocked image. But if the whole site your visiting is blocked completely by DNSBL, you will see the image that you show. Its a normal behavior.

vomcliff

@BBcan177:

@vomcliff:

I went back and did what you said. LAN devices point to the windows server and the MS DNS forwarder was set to the pfsense LAN interface IP. DNSBL did not filter. I troubleshot it and got it to work by using the pfsense WAN interface IP. While everything is working now with DNSBL filtering traffic, I can't ping the LAN interface IP or access the webgui when on the LAN subnet.

I would start by disabling DNSBL and fixing one issue at a time. You should be able to ping and browse to the pfSense LAN IP from any LAN device first before attempting to use any package. Always best to troubleshoot with less obstacles. Then once the basic connectivity is working, you can add additional features. Using the pfSense WAN IP in a local Windows Server DNS Forwarder, doesn't look to be a solution.

Thanks! I stripped down everything to just a basic install and one by one added the necessary settings. Now it is working properly. Workstations point to the windows server, and the MS DNS forwarder points to the LAN IP of my pfsense box. It's all working properly for this remote office now.

Nachtfalke

Hi everybody,

I need some help with pfBlockerNG and squid on the same pfsense machine. (Additional packages snort)

I installed and configured the pfblockerng package, downloaded som DNSBL. Then for testing I pasted some of the URLs into my browser to test and then it redirects me to the pfsense WebUI but not to the 1x1 pixel web page. Further I do not get any Alert in the pfblocker alers tab.

I am not sure if it is relevant but I am running squid (http + https) on the same pfsense machine with Auto Proxy configuration configured on my client.

In pfblockerng I added 10.123.123.123 als the virtual IP. I do not use this IP or subnet somewhere on my network. When I enter 10.123.123.123 in my browser I am redirected to the pfsense WebUI. When I enter the NATed IP 10.123.123.123:8081 I got the 1x1 pixel picture.

My pfsense has two interfaces - one interface for WAN (192.168.178.0/24) and another interface for LAN (192.168.10.0/24).

So my questions are:
1. Why is it redirecting me to the WebUI when entering a URL / domain which ins in DNSBL instead of redirecting me to the NAted IP address with 1x1 pixel
2. When I use https://10.123.123.123:443 the connection times out, when I try to access https://10.123.123.123.8443 the proxy tells my "access denied".
3. No matter what I access I can see any alerts.

I really appreciate any help and/or suggestions

BBcan177

@Nachtfalke:

Hi everybody,
I need some help with pfBlockerNG and squid on the same pfsense machine. (Additional packages snort)

DNSBL adds two NAT rules to push the VIP 10.123.123.123 to 127.0.0.1 on what ever port you selected for DNSBL http/https.

I suspect that Squid is listening on localhost and interfering with DNSBL. I don't use Squid, so maybe some others will chime in on their setup…

Nachtfalke

Thanks,

but squid is listening on different port 3128 so there should be no problem - I think.

I am not sure if squid respects the NAT rules because my WebUI is listening on port 80 an when I try to access 10.123.123.123 I get the WebUI but no NAT/redirect to :8081

So I would be interested if there is someone who is using squid and DNSBL.

BBcan177

FYI, the DNSBL Feed "Spam404" has moved to Github. Please update your link if you use this feed.

~~https://spam404bl.com/blacklist.txt~~ Discontinued
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt NEW

whitexp

strange bug ..

i disable pfblockerng , but it not disable dnsbl ..

still blocking pages …

this is expected?

pfsense 2.3 .

BBcan177

@whitexp:

i disable pfblockerng , but it not disable dnsbl ..

Thanks for the report… I will fix that in the next release.

goto the DNSBL tab and uncheck the "Enable" checkbox for now.

Abhishek

Is there a way to make DNSBL work with PFsense DNS forwarder ( instead of resolver ) because if i am using resolver for resolving name like every few Hours it stops resolving Names and squid gives error ( i saw someone posted similar issue with DNS Resolver

so any alternate way to make pfblockerNG DNSBLC works with DNS Forwarder

shopro

I have a failover gateway group defined, is there a way to use that in pfBlockerNG? I can't seem to find the correct spot. Now it works with the main gateway but not the failover.

BBcan177

@Merchant:

Is there a way to make DNSBL work with PFsense DNS forwarder ( instead of resolver ) because if i am using resolver for resolving name like every few Hours it stops resolving Names and squid gives error ( i saw someone posted similar issue with DNS Resolver

so any alternate way to make pfblockerNG DNSBLC works with DNS Forwarder

The Forwarder can be used, but DNSBL is not configured for that currently… No real plans to do that at this time... The other issue posted for Squid is for something different than your issue. The Resolver is more secure than the Forwarder. Maybe post in the Squid or DNS threads for help with your particular issue?

BBcan177

@shopro:

I have a failover gateway group defined, is there a way to use that in pfBlockerNG? I can't seem to find the correct spot. Now it works with the main gateway but not the failover.

Do those interfaces show in the pfBNG: General Tab: Interface Options?

azzaron

Thank you for this amazing package! :D

We are experiencing unusual behavior in HTTPS redirects with DNSBL turned on…hoping someone has some ideas on this...

DNSBL works flawlessly with our blacklists to block malicious and inappropriate content for all normal browsing. However, when a user tries to download a file from an alternative domain, the filter chokes.

Here's the symptom:
A user clicks on a link in a valid (non-blacklisted, let's say abcd.tld) site to an HTTPS file located cross-domain (let's say subdomain.subdomain.dcba.tld, also not blacklisted). The page comes up with an HTTP Time Out.

We have observed this behavior in links in common apps like GMAIL and not-so-common ones hosted on Amazon AWS. It appears (although we can't confirm 100%) to only occur on redirects using an alias DNS entry (i.e. abcd.tld/file.ext = subdomain.subdomain.dcba.tld/file.ext) and it only happens in HTTPS.

Here are the steps in troubleshooting:

Turn off DNSBL (but leave pfB on) fixes the issue instantly after a Reload.
Turn on DNSBL but turn off the specific blacklists (basically no filtering active), issue still occurs (also tried with Alexa on/off).
Add redirected FQDN's to suppression list, issue still occurs.
No waiting or flushdns command needed (so it does not appear to be DNS Resolver related).

The VIP and DNSBL ports are all defaults and there are no conflicts we can detect. We have multiple LAN segments, so the Firewall Rule is selected across all segments correctly. No Advanced Inbound Firewall Rules are configured.

We are running pfBlockerNG 2.0.4 on pfSense 2.2.6. There are no conflicting installed packages (only Cron, File Manager, LCDproc-dev, and suricata are installed; suricata is not enabled).

Any thoughts are much appreciated. I cannot find a previous posting reporting this behavior.

BBcan177

Hi azzaron,

Are you getting DNSBL alerts when this occurs? Maybe run a wireshark capture and see if you can figure out the issue. Have you tried hitting "F12" in the browser and loading DEV mode? Goto "console" and see if you can get some additional clues…

shopro

@BBcan177:

@shopro:

I have a failover gateway group defined, is there a way to use that in pfBlockerNG? I can't seem to find the correct spot. Now it works with the main gateway but not the failover.

Do those interfaces show in the pfBNG: General Tab: Interface Options?

If you meant the "Inbound Firewall Rules"/"Outbound Firewall Rules" then no, the gateway group does not appear there.

azzaron

Here is an example of the log (from various times to show what's occurring):

DNSBL Reject HTTPS,Mar 04 11:00:38,s2.googleusercontent.com
DNSBL Reject HTTPS,Mar 04 11:00:38,s2.googleusercontent.com
DNSBL Reject HTTPS,Mar 04 11:01:00,lh4.googleusercontent.com
DNSBL Reject HTTPS,Mar 04 11:01:00,lh4.googleusercontent.com
DNSBL Reject,Mar 04 11:02:04,daisybill-production.s3.amazonaws.com,10.50.5.9,https://go.daisybill.com/reports/business_accounts/331/billing_providers/683/bill_exports | /exports/bills/documents/000/013/937/original/bill_exports_requested_by_(name removed)_2016-03-04-09-59-21.csv?AWSAccessKeyId=(key removed)&Expires=1457114534&Signature=(signature removed) | Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/48.0.2564.116 Safari/537.36
DNSBL Reject HTTPS,Mar 04 11:02:04,daisybill-production.s3.amazonaws.com
DNSBL Reject HTTPS,Mar 04 11:02:04,daisybill-production.s3.amazonaws.com
DNSBL Reject HTTPS,Mar 04 11:02:04,daisybill-production.s3.amazonaws.com
DNSBL Reject HTTPS,Mar 08 9:34:13,r20swj13mr.microsoft.com
DNSBL Reject HTTPS,Mar 08 9:34:13,iecvlist.microsoft.com
DNSBL Reject HTTPS,Mar 08 9:34:14,iecvlist.microsoft.com

Not only do none of those domains appear on the list we use, this behavior occurs when no lists are active (only DNSBL is turned on). We are collecting additional browser information, but the blockage seems to be happening at the pfB level according to these logs.

The specific browser error these users get is: NET::ERR_CERT_AUTHORITY_INVALID. And then browsing to that link is dead until DNSBL is turned off.

Under the Alerts tab in pfB, for example, lh3.googleusercontent.com is listed but with "no match" in the List column. Clicking the + icon next to the name results in "Domain [lh3.googleusercontent.com] does not exist in the Unbound Resolver DNSBL."

Could it be that pfB cannot detect obfuscated domains when aliases/links occur in HTTPS?

BBcan177

Did you check the pfB IP block alerts, or Snort/Suricata (if you use an IDS)?

You can try to grep from the commandline to search for domains IE:
grep "s3.amazonaws.com" /var/unbound/pfb_dnsbl.conf

There has to be a domain that is blocked that is causing your issue… You just need to isolate it.

beatstick

I have the following problems:
The list: http://hosts-file.net/download/hosts.zip blocks some website I frequent and I can't suppress it via alerts and clicking +.
Suppression works for blocks by other lists, though.
Also after setting upd pfblockerng windows 7 sometimes seems to think I need to logon to the network via web browser and shows the network not connected symbol in the task bar. The connections works fine, though.
What seems to be the problem here?

BBcan177

Grep for the domain that you can't suppress and see if you can find some other derivatives of that domain that might be blocked… See the other recommendations that I posted above...

azzaron

We did search for that domain and the others and it does not exist (sorry, should have put that in previous troubleshooting steps, but was trying to be succinct).

However, to be clear on the matter, the behavior occurs even when the pfb_dnsbl.conf is empty. Only DNSBL has to be turned on to cause the symptoms described with HTTPS.