Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      chain
      last edited by

      Is there a way to add this to pfBlockerNG or Aliases, this list of domains

      050GLwG8.txt

      1 Reply Last reply Reply Quote 0
      • A
        AspiringNSATroglodyte
        last edited by

        On a fresh install of 2.3.1-RELEASE-p1:

        install pfblockerng package from within pfsense

        Enable Floating rules.

        Enable DNS Blocklist

        Select "unbound"

        Run Cron

        No Floating rule in firewall rules.

        Please help me find the reason.

        It used to work just fine before.

        1 Reply Last reply Reply Quote 0
        • RonpfSR
          RonpfS
          last edited by

          Did you enabled pfBlockerNG ? Is dnsbl service up and running ?
          Did you run a Force Upload ? a Force Reload?
          Did you look at the pfBlockerNG.log?

          2.4.5-RELEASE-p1 (amd64)
          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

          1 Reply Last reply Reply Quote 0
          • A
            AspiringNSATroglodyte
            last edited by

            Did you enabled pfBlockerNG ? Is dnsbl service up and running ? YES; General > Enable pfBlockerNG > Check
            Did you run a Force Upload ? a Force Reload? Firewall > pfBlockerNG > Update: Update, Cron, Reload – no Force option available. Ran CRON
            Did you look at the pfBlockerNG.log? Yes, I don't see any errors.

            I'm stumped; Never had a problem with pfb

            1 Reply Last reply Reply Quote 0
            • RonpfSR
              RonpfS
              last edited by

              Well I am still on 2.2.6 and I see in pfBlockerNG: Update

              Force Update will download any new Alias/Lists.
              Force Cron will download any Alias/Lists that are within the Frequency Setting (due for Update).
              Force Reload will reload all Lists using the existing Downloaded files. This is useful when Lists are out of 'sync' or Reputation changes were made.

              But if there are no IP in you DSNBL table, then there will be no need for floating rules.

              Configure settings for Firewall Rules when any DNSBL Feed contain IP Addresses

              @BBcan177:

              Actually as soon as you enable "DNSBL IP" it will add "1.1.1.1" to make sure its not empty… So the Floating rule should show if that option was enabled..

              Do you have any IPV4 alias defined ?

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • A
                AspiringNSATroglodyte
                last edited by

                @RonpfS:

                Well I am still on 2.2.6 and I see in pfBlockerNG: Update

                Force Update will download any new Alias/Lists.
                Force Cron will download any Alias/Lists that are within the Frequency Setting (due for Update).
                Force Reload will reload all Lists using the existing Downloaded files. This is useful when Lists are out of 'sync' or Reputation changes were made.

                But if there are no IP in you DSNBL table, then there will be no need for floating rules.

                Configure settings for Firewall Rules when any DNSBL Feed contain IP Addresses

                @BBcan177:

                Actually as soon as you enable "DNSBL IP" it will add "1.1.1.1" to make sure its not empty… So the Floating rule should show if that option was enabled..

                Do you have any IPV4 alias defined ?

                I have no IP aliases defined

                I can ping 10.10.10.1 but there is no rule displayed in the gui.

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  @chain:

                  Is there a way to add this to pfBlockerNG or Aliases, this list of domains

                  Hi Chain, that list can be parsed without issues… If that was from a URL, just add the URL to a DNSBL alias ... You could also paste that into a custom list and the package will parse it...

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @AspiringNSATroglodyte:

                    I can ping 10.10.10.1 but there is no rule displayed in the gui.

                    All DNSBL alerts are visible in the pfBlockerNG Alerts tab (DNSBL section)…  You should be able to ping the DNSBL VIP and browse to it also (1x1 pix)...  Not sure exactly what the issue you are having?

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • A
                      AspiringNSATroglodyte
                      last edited by

                      The issue is that I have selected the option that creates a floating rule to the VIP DNSBL IP but there is no floating rule visible in the GUI. In the past this rule was always created.

                      This is on a vanilla pfsense install.

                      According to the service status widget, the DNSBL service is running.

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        Did you select the Interface(s) for the Permit Rule?

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • A
                          AspiringNSATroglodyte
                          last edited by

                          @BBcan177:

                          Did you select the Interface(s) for the Permit Rule?

                          Can you expound on this? Where exactly is this option?

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            @AspiringNSATroglodyte:

                            @BBcan177:

                            Did you select the Interface(s) for the Permit Rule?

                            Can you expound on this? Where exactly is this option?

                            DNSBL Tab: DNSBL Firewall Rule: Interface menu options

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • C
                              chain
                              last edited by

                              @BBcan177:

                              @chain:

                              Is there a way to add this to pfBlockerNG or Aliases, this list of domains

                              Hi Chain, that list can be parsed without issues… If that was from a URL, just add the URL to a DNSBL alias ... You could also paste that into a custom list and the package will parse it...

                              i did that, but I notices that it don't show up in the list of site to block, that the link below for the site

                              http://pastebin.com/050GLwG8

                              Its a good site for block windows 7-10 spying on people

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                @chain:

                                @BBcan177:

                                @chain:

                                Is there a way to add this to pfBlockerNG or Aliases, this list of domains

                                Hi Chain, that list can be parsed without issues… If that was from a URL, just add the URL to a DNSBL alias ... You could also paste that into a custom list and the package will parse it...

                                i did that, but I notices that it don't show up in the list of site to block, that the link below for the site

                                http://pastebin.com/050GLwG8

                                Its a good site for block windows 7-10 spying on people

                                Click the "Raw" button, and you should be able to pull that list with DNSBL, as it removes the HTML formatting…

                                http://pastebin.com/raw/050GLwG8

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @AspiringNSATroglodyte:

                                  I've attached some pictures to hopefully shed some light on the issue. As I've said, I have configured pfblockerng and DNSBL succesfully many times in the past without issue.

                                  Can you run this command and send me the output:

                                  grep -B10 -A12 "pfB_DNSBL_Allow_access_to_VIP" /conf/config.xml
                                  

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    AspiringNSATroglodyte
                                    last edited by

                                    @BBcan177:

                                    @AspiringNSATroglodyte:

                                    I've attached some pictures to hopefully shed some light on the issue. As I've said, I have configured pfblockerng and DNSBL succesfully many times in the past without issue.

                                    Can you run this command and send me the output:

                                    grep -B10 -A12 "pfB_DNSBL_Allow_access_to_VIP" /conf/config.xml
                                    

                                    PM sent

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      Sent you a reply.

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        alex3712
                                        last edited by

                                        Hello BBcan177 thanks for a great package, update for 2.2.6 will or only for 2.3.x?

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          @alex3712:

                                          Hello BBcan177 thanks for a great package, update for 2.2.6 will or only for 2.3.x?

                                          You can upgrade from 2.2.x to 2.3.x and pfBlockerNG will upgrade without issue…

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            Jamerson
                                            last edited by

                                            Thank you for this BBcan177.
                                            I am using it for over a year now everything working really fine.
                                            I want to filter the adult website using this package is this even possible or have to install a proxy ?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.