• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG v2.0 w/DNSBL

pfBlockerNG
192
1.1k
1.6m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B
    bluepr0
    last edited by Apr 21, 2016, 5:09 PM

    @BBcan177:

    @bluepr0:

    Hello! I just noticed today that pfBlocker is not "working" anymore. It's actually enabled and it was working fine blocking ads, now it seems nothing changed (I'm sure I haven't changed any settings) but I'm not getting ads blocked

    Ensure that the LAN devices have only pfSense set as their DNS server. Can you ping the DNSBL VIP address? Can you browse to the DNSBL VIP address?

    Hello BBcan177,

    I can ping the IP without problems, and all my devices are using my pfsense IP as DNS (as before) so it shouldn't be a problem there. However, if by "browse the DNSBL IP" you mean that I should get a reply when trying to open it from a browser then no, I get an error

    But as I said, I get ping

    1 Reply Last reply Reply Quote 0
    • B
      BBcan177 Moderator
      last edited by Apr 21, 2016, 5:12 PM

      @bluepr0:

      I can ping the IP without problems, and all my devices are using my pfsense IP as DNS (as before) so it shouldn't be a problem there. However, if by "browse the DNSBL IP" you mean that I should get a reply when trying to open it from a browser then no, I get an error

      Do you have a multi-segmented LAN? ie -vlans etc… If so, there is an option in the DNSBL Tab, to create a Floating Permit rule. Select all the Lan segments that need access to the VIP...

      When you browse to the VIP, it should return the 1x1... Have you tried a different browser? or other LAN device?

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • B
        bluepr0
        last edited by Apr 21, 2016, 5:19 PM

        @BBcan177:

        @bluepr0:

        I can ping the IP without problems, and all my devices are using my pfsense IP as DNS (as before) so it shouldn't be a problem there. However, if by "browse the DNSBL IP" you mean that I should get a reply when trying to open it from a browser then no, I get an error

        Do you have a multi-segmented LAN? ie -vlans etc… If so, there is an option in the DNSBL Tab, to create a Floating Permit rule. Select all the Lan segments that need access to the VIP...

        When you browse to the VIP, it should return the 1x1... Have you tried a different browser? or other LAN device?

        Nop, I don't have VLANs.

        Tried with Chrome but I'm getting same result

        But I can still ping the IP. It seems a bit weird that I'm getting 265ms though, it's just a small LAN with a 8 port switch

        Thanks again!

        1 Reply Last reply Reply Quote 0
        • B
          BBcan177 Moderator
          last edited by Apr 21, 2016, 5:21 PM

          Are you using Squid (See posts above)?

          If you can't browse to the DNSBL VIP, then it will always be slow, and you will not get any Alert logging…

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • B
            BBcan177 Moderator
            last edited by Apr 21, 2016, 5:26 PM

            There is a new version of pfBlockerNG v2.0.11 for pfSense 2.3, which was merged today. Pull Request #114 here.

            Changelog:

            • Fix issues with de-installation (Not sure why anyone would de-install anyways :) )

            • Fix an issue with 'States Removal', so that it only acts on 'Block|Reject' rules.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • B
              bluepr0
              last edited by Apr 21, 2016, 5:39 PM

              @BBcan177:

              Are you using Squid (See posts above)?

              If you can't browse to the DNSBL VIP, then it will always be slow, and you will not get any Alert logging…

              Yep, I'm using Squid. I will try to setup this wpad thing, is this guide still valid? https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

              1 Reply Last reply Reply Quote 0
              • B
                BBcan177 Moderator
                last edited by Apr 21, 2016, 5:40 PM

                @bluepr0:

                @BBcan177:

                Are you using Squid (See posts above)?

                If you can't browse to the DNSBL VIP, then it will always be slow, and you will not get any Alert logging…

                Yep, I'm using Squid. I will try to setup this wpad thing, is this guide still valid? https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

                I don't use Squid… Try changing wpad as suggested above by user "Merchant"

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • B
                  bluepr0
                  last edited by Apr 21, 2016, 5:42 PM

                  @BBcan177:

                  @bluepr0:

                  @BBcan177:

                  Are you using Squid (See posts above)?

                  If you can't browse to the DNSBL VIP, then it will always be slow, and you will not get any Alert logging…

                  Yep, I'm using Squid. I will try to setup this wpad thing, is this guide still valid? https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid

                  I don't use Squid… Try changing wpad as suggested above by user "Merchant"

                  Umm but I'm a bit lost about changing WPAD, I couldn't find anything related to pfsense and WPAD other than the guide I pasted above (https://doc.pfsense.org/index.php/WPAD_Autoconfigure_for_Squid) or is there an option in pfBlocker for WPAD?

                  1 Reply Last reply Reply Quote 0
                  • A
                    Abhishek
                    last edited by Apr 21, 2016, 5:48 PM

                    @bluepr0:

                    @BBcan177:

                    @bluepr0:

                    I can ping the IP without problems, and all my devices are using my pfsense IP as DNS (as before) so it shouldn't be a problem there. However, if by "browse the DNSBL IP" you mean that I should get a reply when trying to open it from a browser then no, I get an error

                    Do you have a multi-segmented LAN? ie -vlans etc… If so, there is an option in the DNSBL Tab, to create a Floating Permit rule. Select all the Lan segments that need access to the VIP...

                    When you browse to the VIP, it should return the 1x1... Have you tried a different browser? or other LAN device?

                    Nop, I don't have VLANs.

                    Tried with Chrome but I'm getting same result

                    But I can still ping the IP. It seems a bit weird that I'm getting 265ms though, it's just a small LAN with a 8 port switch

                    Thanks again!

                    pic shows you opened as http

                    can u try opening https://10.10.10.1 ?

                    2.3-RC (amd64)
                    built on Mon Apr 04 17:09:32 CDT 2016
                    FreeBSD 10.3-RELEASE
                    Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                    darkstat 3.1.2_1
                    Lightsquid 3.0.3_1
                    mailreport 3.0_1
                    pfBlockerNG 2.0.9_1  
                    RRD_Summary 1.3.1_2
                    snort 3.2.9.1_9  
                    squid 0.4.16_1  
                    squidGuard 1.14_1
                    syslog-ng 1.1.2_2

                    1 Reply Last reply Reply Quote 0
                    • B
                      bluepr0
                      last edited by Apr 21, 2016, 5:50 PM

                      @Merchant:

                      @bluepr0:

                      @BBcan177:

                      @bluepr0:

                      I can ping the IP without problems, and all my devices are using my pfsense IP as DNS (as before) so it shouldn't be a problem there. However, if by "browse the DNSBL IP" you mean that I should get a reply when trying to open it from a browser then no, I get an error

                      Do you have a multi-segmented LAN? ie -vlans etc… If so, there is an option in the DNSBL Tab, to create a Floating Permit rule. Select all the Lan segments that need access to the VIP...

                      When you browse to the VIP, it should return the 1x1... Have you tried a different browser? or other LAN device?

                      Nop, I don't have VLANs.

                      Tried with Chrome but I'm getting same result

                      But I can still ping the IP. It seems a bit weird that I'm getting 265ms though, it's just a small LAN with a 8 port switch

                      Thanks again!

                      pic shows you opened as http

                      can u try opening https://10.10.10.1 ?

                      same result, sadly!

                      There's one thing I don't get, though! This was working flawlessly, Squid + pfBlocker (even on 2.3) as I upgraded a week ago… why it stopped working now without touching anything? o.O

                      Edit to add screenshot

                      1 Reply Last reply Reply Quote 0
                      • A
                        Abhishek
                        last edited by Apr 24, 2016, 9:29 AM Apr 21, 2016, 5:57 PM

                        can u click details ?  see if there is option to add exception

                        
                        https://www.websense.com/content/support/library/web/v76/pac_file_best_practices/PAC_best_pract.aspx
                        

                        2.3-RC (amd64)
                        built on Mon Apr 04 17:09:32 CDT 2016
                        FreeBSD 10.3-RELEASE
                        Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                        darkstat 3.1.2_1
                        Lightsquid 3.0.3_1
                        mailreport 3.0_1
                        pfBlockerNG 2.0.9_1  
                        RRD_Summary 1.3.1_2
                        snort 3.2.9.1_9  
                        squid 0.4.16_1  
                        squidGuard 1.14_1
                        syslog-ng 1.1.2_2

                        1 Reply Last reply Reply Quote 0
                        • B
                          bluepr0
                          last edited by Apr 21, 2016, 6:02 PM

                          @Merchant:

                          can u click details ?  see if there is option to add exception

                          nop :(

                          1 Reply Last reply Reply Quote 0
                          • P
                            pdrass
                            last edited by Apr 22, 2016, 1:16 AM

                            It seems like this is one massive question board for the one plugin so I'm going to ask:

                            I have 2.2.6-RELEASE (amd64)  > in the "alerts" area of pfblockerng I don't see anything logged in the dnsbl area
                            I have 2.2.5-RELEASE (amd64)  > in the "alerts" area of pfblockerng I see everything including https notifications of limited info but ads are still blocked

                            …so, is there a bug in the 2.2.6 release with respect to logging somehow?

                            They're 2 separate FW's but I went through the settings and they match perfectly.  I also made sure the Windows server was in fact querying for DNS to the firewall and not anything else by blocking the server's IP > it then couldn't resolve external DNS hosts like google.com, yahoo.com but I could ping IP's (so not using DNS).  Once I unblocked it form the firewall, DNS worked again so I KNOW it's "working" like:

                            hosts > query >> server >>> query firewall >>>> query public DNS + root servers

                            • I also turned on unbound logging up to 5 or whatever the highest debug level and nothing jumped out at me...it's all "working" except for the alerts tab not showing what's blocked.  I also compared a known ad site (an online newspaper) from the 2 different sites and both pages are exactly the same in IE so I think what's happening is that it's dnsbl'ing the ads just not showing them in the alerts tab.

                            Let me know if you find anything.

                            Thanks!

                            1 Reply Last reply Reply Quote 0
                            • B
                              BBcan177 Moderator
                              last edited by Apr 22, 2016, 1:17 AM

                              There is a redmine issue for pfBlockerNG, and I'm hoping someone listening in this thread will PM me if they are experiencing this issue. I haven't been able to replicate this issue, so am reaching out to get some more specific details…

                              implode(): Invalid arguments passed in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 4638

                              https://redmine.pfsense.org/issues/6229

                              Thanks!

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • B
                                BBcan177 Moderator
                                last edited by Apr 22, 2016, 1:20 AM

                                @pdrass:

                                …so, is there a bug in the 2.2.6 release with respect to logging somehow?

                                Do you have squid at this location? Is it a multi-segmented Lan? Can you ping and browse to the DNSBL VIP address? I posted above for a similar issue…

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • K
                                  killmasta93
                                  last edited by Apr 23, 2016, 5:23 PM Apr 23, 2016, 5:20 PM

                                  I also had issue with squid with wpad initially and  with BBcan177 help i resolved the issue with my setup

                                  i updated my wpad.pac file to make direct connected to 10.10.10.1

                                  So I have this on wpad.da, wpad.dat and proxy.pac

                                  function FindProxyForURL(url,host)
                                   {
                                  
                                      if (isInNet( host, "192.168.3.0", "255.255.255.0" )) 
                                          { return "DIRECT"; }
                                  	 if (isInNet( host, "10.10.10.1", "255.255.255.0" )) 
                                          { return "DIRECT"; }	
                                  	return "PROXY 192.168.3.254:3128";
                                  

                                  Yes it works the GIF BUT does not show on alert on pfBlockerNG 2.0.5 odd? Also in theory if the GIF shows should start blocking ads? I also stoped Squidguard to see if it was blocking but no go :(

                                  on a side note, the line of code is saying to ignore 10.10.10.1 and go though? I have been trying with OpenVPN no luck for WPAD to ignore the OpenVPN server of another pfSense box.

                                  Also my previous wpad.da, wpad.dat and proxy.pac
                                  What is the difference from the above vs this one?

                                  function FindProxyForURL(url, host) 
                                  { 
                                      if (isPlainHostName(host) ||
                                          shExpMatch(host, "*.local") ||
                                          isInNet(dnsResolve(host), "192.168.3.0",  "255.255.255.0"))
                                          return "DIRECT";
                                  
                                      return "PROXY 192.168.3.254:3128";
                                  }
                                  
                                  

                                  Tutorials:

                                  https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    Abhishek
                                    last edited by Apr 24, 2016, 9:26 AM

                                    
                                    on a side note, the line of code is saying to ignore 10.10.10.1 and go though? I have been trying with OpenVPN no luck for WPAD to ignore the OpenVPN server of another pfSense box.
                                    
                                    
                                    Also my previous wpad.da, wpad.dat and proxy.pac
                                    What is the difference from the above vs this one?
                                    
                                    
                                    function FindProxyForURL(url,host)
                                     {
                                    
                                        if (isInNet( host, "192.168.3.0", "255.255.255.0" ))  { return "DIRECT"; }
                                       if (isInNet( host, "10.10.10.1", "255.255.255.0" ))    { return "DIRECT"; }	
                                    	return "PROXY 192.168.3.254:3128";
                                    

                                    both wpad means same , if u r trying to connect to 192.168.3.0 or 10.10.10.1 using http or https it will go directly without forwarding that traffic to proxy server (192.168.3.254:3124) and last line saying all other http/https traffic should b forwarded to 192.168.3.254

                                    2.3-RC (amd64)
                                    built on Mon Apr 04 17:09:32 CDT 2016
                                    FreeBSD 10.3-RELEASE
                                    Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                    darkstat 3.1.2_1
                                    Lightsquid 3.0.3_1
                                    mailreport 3.0_1
                                    pfBlockerNG 2.0.9_1  
                                    RRD_Summary 1.3.1_2
                                    snort 3.2.9.1_9  
                                    squid 0.4.16_1  
                                    squidGuard 1.14_1
                                    syslog-ng 1.1.2_2

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      killmasta93
                                      last edited by Apr 25, 2016, 1:19 AM Apr 24, 2016, 9:24 PM

                                      I guess your right Whats odd it wont work for OpenVPN :( but i guess my issue was that I have my DNS server forwarders with 8.8.8.8 i needed to point to pfSense and pfSense to itself and 8.8.8.8 but Not sure if that takes a tab bit longer to navigate?

                                      EDIT: your right for the OpenVPN it worked i was putting the NET of the VPN server while it was the LAN server on which i want to connect i feel so dumb…

                                      Tutorials:

                                      https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        Abhishek
                                        last edited by Apr 25, 2016, 5:07 AM

                                        PfblockerNG working  but not showing in pfblockerNG Alerts      , i have posted a pic showing firefox dev console header showing  ( Via:"1.1 localhost (squid)" )  also  ping reply to that domain returning 10.10.10.1

                                        ![PFblockerNG (1).PNG](/public/imported_attachments/1/PFblockerNG (1).PNG)
                                        ![PFblockerNG (1).PNG_thumb](/public/imported_attachments/1/PFblockerNG (1).PNG_thumb)
                                        ![PFblockerNG (2).png](/public/imported_attachments/1/PFblockerNG (2).png)
                                        ![PFblockerNG (2).png_thumb](/public/imported_attachments/1/PFblockerNG (2).png_thumb)
                                        ![PFblockerNG (3).PNG](/public/imported_attachments/1/PFblockerNG (3).PNG)
                                        ![PFblockerNG (3).PNG_thumb](/public/imported_attachments/1/PFblockerNG (3).PNG_thumb)

                                        2.3-RC (amd64)
                                        built on Mon Apr 04 17:09:32 CDT 2016
                                        FreeBSD 10.3-RELEASE
                                        Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz

                                        darkstat 3.1.2_1
                                        Lightsquid 3.0.3_1
                                        mailreport 3.0_1
                                        pfBlockerNG 2.0.9_1  
                                        RRD_Summary 1.3.1_2
                                        snort 3.2.9.1_9  
                                        squid 0.4.16_1  
                                        squidGuard 1.14_1
                                        syslog-ng 1.1.2_2

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          killmasta93
                                          last edited by Apr 25, 2016, 2:02 PM

                                          Try this, First go to pfblockerNG then to DNSBL and add a custom block list and add a site just for testing purposes. in my case i added kat.cr save and reload pfblockerNG

                                          Then open putty and login to pfSense and chose option 8 for shell

                                          make sure that kat.cr is on the conf

                                          grep "kat.cr" /var/unbound/pfb_dnsbl.conf
                                          

                                          if it shows that it is then go to step 2

                                          after that you see its on the conf

                                          ping kat.cr you should get reply 10.10.10.1 if you dont then make sure your DNS is pointing to pfSense

                                          Tutorials:

                                          https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                                          1 Reply Last reply Reply Quote 0
                                          509 out of 1077
                                          • First post
                                            509/1077
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.