Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      @Nachtfalke:

      function FindProxyForURL(url, host) {

      // Normalize the URL for pattern macthing
          url = url.toLowerCase();
          host = host.toLowerCase();

      // diese Ziel-IPs, Domains oder Hosts gehen DIRECT
          if (shExpMatch(host, "192.168..") ||
              shExpMatch(host, ".microsoft.com") ||
              shExpMatch(host, "
      .windowsupdates.com") ||
              shExpMatch(host, "127.0.0.1") ||
              shExpMatch(host, "ap.bundesbank.de") ||
              shExpMatch(host, "10...*") ||
              shExpMatch(host, "10.123.123.123") ||
              shExpMatch(host, "localhost"))
          {
          return "DIRECT";
          }

      if (isInNet( host, "10.123.123.0", "255.255.255.0" ))
              { return "DIRECT"; }

      // diese URLs gehen DIRECT ohne Proxy.
          // if (shExpMatch(url, "https://www.vrbank-mkb.de/") ||
          //    shExpMatch(url, "https://www.cortalconsors.de/
      ") ||
          //    shExpMatch(url, "https://www.consorsbank.de/*"))
          // {
          // return "DIRECT";
          // }

      // Fuer alle anderen Requests den Proxy zurueckgeben
      return "PROXY 192.168.10.1:3128";
      }

      My DNSBL VIP is on 10.123.123.123

      Hi Nachtfalke,

      I don't use Squid, but a quick google search, do you think that "host" should be changed to "url" instead in this line below?

      shExpMatch(host, "10.123.123.123") ||

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @JasonJoel:

        Anyone else experience that pfBlockerNG doesn't work on 2.3 if using floating rules?

        Hi Jason,

        Do you have any Floating rules above the pfBNG floating rules? Maybe send a screenshot? also edit one of those rules and send a screenshot…

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          @cmaxwell04:

          Help please,

          I'm having a strage problem in pfsense 2.3. Whenever I enable pfBlockerNG DNSBL it stops DNS Resolver, and I have to start it manually. when I rebot pfsense 2.3 I have to manualy start DNS Resolver. if I desable DNSBL, DNS Resolver will always run automaticaly.

          thanks

          Hi cmaxwell04,

          Can you review the pfblockerng.log and see if there are any error messages in regards to DNSBL. Try to Re-Enable DNSBL, and try to send any relevant error messages… Do you see any errors in the resolver.log or system.log?

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • N
            Nachtfalke
            last edited by

            @BBcan177:

            @Nachtfalke:

            function FindProxyForURL(url, host) {

            // Normalize the URL for pattern macthing
                url = url.toLowerCase();
                host = host.toLowerCase();

            // diese Ziel-IPs, Domains oder Hosts gehen DIRECT
                if (shExpMatch(host, "192.168..") ||
                    shExpMatch(host, ".microsoft.com") ||
                    shExpMatch(host, "
            .windowsupdates.com") ||
                    shExpMatch(host, "127.0.0.1") ||
                    shExpMatch(host, "ap.bundesbank.de") ||
                    shExpMatch(host, "10...*") ||
                    shExpMatch(host, "10.123.123.123") ||
                    shExpMatch(host, "localhost"))
                {
                return "DIRECT";
                }

            if (isInNet( host, "10.123.123.0", "255.255.255.0" ))
                    { return "DIRECT"; }

            // diese URLs gehen DIRECT ohne Proxy.
                // if (shExpMatch(url, "https://www.vrbank-mkb.de/") ||
                //    shExpMatch(url, "https://www.cortalconsors.de/
            ") ||
                //    shExpMatch(url, "https://www.consorsbank.de/*"))
                // {
                // return "DIRECT";
                // }

            // Fuer alle anderen Requests den Proxy zurueckgeben
            return "PROXY 192.168.10.1:3128";
            }

            My DNSBL VIP is on 10.123.123.123

            Hi Nachtfalke,

            I don't use Squid, but a quick google search, do you think that "host" should be changed to "url" instead in this line below?

            shExpMatch(host, "10.123.123.123") ||

            Nothing changed. I deleted these file because I added the part Merchant posted in this thread:

            
            function FindProxyForURL(url, host) {
            
                // Normalize the URL for pattern macthing
                url = url.toLowerCase();
                host = host.toLowerCase();
            
                // diese Ziel-IPs, Domains oder Hosts gehen DIRECT
                if (shExpMatch(host, "192.168.*.*") ||
                    shExpMatch(host, "*.microsoft.com") ||
                    shExpMatch(host, "*.windowsupdates.com") ||
                    shExpMatch(host, "ap.bundesbank.de") ||
                    shExpMatch(host, "localhost"))
                {
                return "DIRECT";
                }
            
                if (isInNet( host, "10.123.123.0", "255.255.255.0" ))
                    { return "DIRECT"; }
            
                // diese URLs gehen DIRECT ohne Proxy.
                // if (shExpMatch(url, "https://www.vrbank-mkb.de/*") ||
                //     shExpMatch(url, "https://www.cortalconsors.de/*") ||
                //     shExpMatch(url, "https://www.consorsbank.de/*"))
                // {
                // return "DIRECT";
                // }
            
            // Fuer alle anderen Requests den Proxy zurueckgeben
            return "PROXY 192.168.10.1:3128";
            }
            
            
            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              @Nachtfalke:

              shExpMatch(host, "10.123.123.123") ||

              Nothing changed. I deleted these file because I added the part Merchant posted in this thread:

              I think you need to change that line from "host" to "url"… I believe that your desktop is the host, and the url is where you want to goto... So the DNSBL VIP is not the host, but the url... As i said, I don't use squid, so just an assumption...

              shExpMatch(url, "10.123.123.123") ||

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • J
                JasonJoel
                last edited by

                @BBcan177:

                @JasonJoel:

                Anyone else experience that pfBlockerNG doesn't work on 2.3 if using floating rules?

                Hi Jason,

                Do you have any Floating rules above the pfBNG floating rules? Maybe send a screenshot? also edit one of those rules and send a screenshot…

                The only other floating rule is the DNSBL rule, and it works I think.

                I block the country China in pfBlocker. With it set to not use floating rules www.edu.cn is blocked as expected. It gets blocked, and the pfB_Top_v4 hit count increases.

                If I go back and enable floating rules, the rules get made (as shown in the attached pictures), and the aliases do have IPs in them. But if I again go to www.edu.cn, it does not get blocked… I really don't get it, as the floating rule looks the same to me as the rule that gets created in the interface when not using floating rules in pfBlocker...

                Pic 1 shows my floating rules when pfBlocker is set to not use floating rules.
                Pic 2 shows that pfB_Top-v4 hit count increases when going to www.edu.cn, as expected
                Pic 3 shows floating rules when floating rules in pfBlocker is enabled
                Pic 4 shows that after trying to go to www.edu.cn again, nothing is blocked
                Pic 5 shows that if I manually make the exact same rule, it DOES work... ????????

                Jason

                ![1-Floating Rules.png](/public/imported_attachments/1/1-Floating Rules.png)
                ![1-Floating Rules.png_thumb](/public/imported_attachments/1/1-Floating Rules.png_thumb)
                ![2-Widget showing pfB_Top_v4 hits.PNG](/public/imported_attachments/1/2-Widget showing pfB_Top_v4 hits.PNG)
                ![2-Widget showing pfB_Top_v4 hits.PNG_thumb](/public/imported_attachments/1/2-Widget showing pfB_Top_v4 hits.PNG_thumb)
                ![3-Floating Rules Enabled on pfBlockerNG.PNG](/public/imported_attachments/1/3-Floating Rules Enabled on pfBlockerNG.PNG)
                ![3-Floating Rules Enabled on pfBlockerNG.PNG_thumb](/public/imported_attachments/1/3-Floating Rules Enabled on pfBlockerNG.PNG_thumb)
                ![4-Widget showing nothing is getting blocked.PNG](/public/imported_attachments/1/4-Widget showing nothing is getting blocked.PNG)
                ![4-Widget showing nothing is getting blocked.PNG_thumb](/public/imported_attachments/1/4-Widget showing nothing is getting blocked.PNG_thumb)
                ![5-Manually created floating rule works.PNG_thumb](/public/imported_attachments/1/5-Manually created floating rule works.PNG_thumb)
                ![5-Manually created floating rule works.PNG](/public/imported_attachments/1/5-Manually created floating rule works.PNG)

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  Hi Jason,

                  When you edit those Floating rules, do your interfaces get added correctly? Looks fine at first glance… I tested it on my machine, and all seems to be working with/without floating rules...

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • J
                    JasonJoel
                    last edited by

                    @BBcan177:

                    Hi Jason,

                    When you edit those Floating rules, do your interfaces get added correctly? Looks fine at first glance… I tested it on my machine, and all seems to be working with/without floating rules...

                    Yes they do.

                    HOWEVER, I discovered the issue!! The rule direction is marked as "OUT" - which is never going to match on traffic initiated internally going to the internet. Shouldn't that be "ANY"? I checked and all of my pfBlocker created floating rules are direction "OUT" for some reason…

                    Screen attached.

                    Jason

                    ![6-Floating rule detail.PNG](/public/imported_attachments/1/6-Floating rule detail.PNG)
                    ![6-Floating rule detail.PNG_thumb](/public/imported_attachments/1/6-Floating rule detail.PNG_thumb)

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @JasonJoel:

                      The rule direction is marked as "OUT". Shouldn't that be "ANY"? I checked and all of my pfBlocker created floating rules are direction "OUT" for some reason…

                      Did you define the "Adv. In/Outbound settings" in each pfBNG Alias settings? Specifically the "Gateway" setting?

                      It should normally be left at "default"; at which time, the Floating Rules "Direction" setting is set to "any".

                      You can run this command to find out what the pfBNG aliases gateway settings are defined as:

                      grep "<agateway" conf="" config.xml<="" pre=""></agateway">
                      

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • J
                        JasonJoel
                        last edited by

                        @BBcan177:

                        @JasonJoel:

                        The rule direction is marked as "OUT". Shouldn't that be "ANY"? I checked and all of my pfBlocker created floating rules are direction "OUT" for some reason…

                        Did you define the "Adv. In/Outbound settings"? Specifically the "Gateway" setting?

                        It should normally be left at "default"; at which time, the Floating Rules "Direction" setting is set to "any".

                        I don't think so… Here are the advanced settings on my country Top 20 alias, which gets created as OUT.

                        Jason

                        ![7-Advanced Country Block Settings.PNG](/public/imported_attachments/1/7-Advanced Country Block Settings.PNG)
                        ![7-Advanced Country Block Settings.PNG_thumb](/public/imported_attachments/1/7-Advanced Country Block Settings.PNG_thumb)

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          Can you save each of your pfBlockerNG aliases as I think that tag is missing from your config.

                          Run this command first and send me the output:

                          grep "<agateway" conf="" config.xml<="" pre=""></agateway">
                          

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • J
                            JasonJoel
                            last edited by

                            Where do you run the command? Should I SSH in or can I do it from the GUI?

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              In pfSense:  Diagnostics / Command Prompt / Execute PHP Commands

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • J
                                JasonJoel
                                last edited by

                                Ran this:
                                grep " <agateway" conf="" config.xml<br="">Got this:
                                Parse error: syntax error, unexpected '"</agateway">

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @JasonJoel:

                                  Ran this:
                                  grep " <agateway" conf="" config.xml<br="">Got this:
                                  Parse error: syntax error, unexpected '"<agateway"' (t_constant_encapsed_string)="" in="" tmp="" r6f0tv="" on="" line="" 5<br=""></agateway"'></agateway">

                                  Sorry, use the "Execute Shell Command" box..

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    JasonJoel
                                    last edited by

                                    @BBcan177:

                                    @JasonJoel:

                                    Ran this:
                                    grep " <agateway" conf="" config.xml<br="">Got this:
                                    Parse error: syntax error, unexpected '"<agateway"' (t_constant_encapsed_string)="" in="" tmp="" r6f0tv="" on="" line="" 5<br=""></agateway"'></agateway">

                                    Sorry, use the "Execute Shell Command" box..

                                    First time I ran it, it gave me an error.

                                    After I re-saved all of the alias it gave me:
                                    <agateway_in>default</agateway_in>
                                    <agateway_out>default</agateway_out>
                                    <agateway_in>default</agateway_in>
                                    <agateway_out>default</agateway_out>
                                    <agateway_in>default</agateway_in>
                                    <agateway_out>default</agateway_out>
                                    <agateway_in>default</agateway_in>
                                    <agateway_out>default</agateway_out>
                                    <agateway_in>default</agateway_in>
                                    <agateway_out>default</agateway_out>
                                    <agateway_in>default</agateway_in>
                                    <agateway_out>default</agateway_out>

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      Ok now run a "Force Update" and check your rules to see if "Any" in defined in the direction field… then check the  blocking behavior again... I will get a fix out for this tonight... Thanks for reporting...

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        JasonJoel
                                        last edited by

                                        @BBcan177:

                                        Ok now run a "Force Update" and check your rules to see if "Any" in defined in the direction field… then check the  blocking behavior again... I will get a fix out for this tonight... Thanks for reporting...

                                        After doing a force update the floating rules are now "ANY" and blocking works correctly! Sorry I took so much of your time, but thank you for helping - it does seem like re-saving the alias did the trick.

                                        Jason

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          The following Pull Request #121 for pfBlockerNG v2.0.12 has been Merged for pfSense v2.3 only.

                                          This version contains an URGENT fix for anyone who uses Floating pfBlockerNG Rules!!

                                          PR also contains other improvements (See link above).

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            chris4916
                                            last edited by

                                            @BBcan177:

                                            I don't use Squid, but a quick google search, do you think that "host" should be changed to "url" instead in this line below?

                                            I know this is slightly nitpicking but it has nothing to do with Squid itself but rather the proxy.pac that will help your browser deciding whether access is direct or through proxy  ;)

                                            This said, in proxy.pac (or whatever alias), you may look at different kind of information in order to make the "routing" decision.

                                            If goal is to route through proxy (or not) based on IP address or DNS related information, this should implement directive like:
                                            dnsDomainIs(host,…
                                            isInNet(dnsResolve(host)
                                            localHostOrDomainIs(host...

                                            This involves DNS resolution

                                            if goal is to look at URL pattern (not involving DNS resolution) then syntax to be used is:
                                            shExpMatch(url,
                                            url.substring

                                            However, shExpMatch(host, does work  too  if you match the fqdn part of URL only 8) (although this is quite confusing, I agree)

                                            Jah Olela Wembo: Les mots se muent en maux quand ils indisposent, agressent ou blessent.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.