PfBlockerNG v2.0 w/DNSBL
-
Okay thanks for the reply!
I added " www.msftncsi.com/" to the DNSBL supression list and did a "Reload All", but that didn't solve the issue. When I browse to "www.msftncsi.com/" it still gets blocked. I also killed firewall states, disabled and enabled pfblocker and DNSBL. That too didn't work. How should I proceed?
I already had one domain listed in the domain supression list, and that also still gets blocked. Maybe I have some setting wrong?
-
Okay thanks for the reply!
I added " www.msftncsi.com/" to the DNSBL supression list and did a "Reload All", but that didn't solve the issue. When I browse to "www.msftncsi.com/" it still gets blocked. I also killed firewall states, disabled and enabled pfblocker and DNSBL. That too didn't work. How should I proceed?
I already had one domain listed in the domain supression list, and that also still gets blocked. Maybe I have some setting wrong?
" www.msftncsi.com/" should be "www.msftncsi.com" without the quotes (")
-
I know :), I just added the quotes to make it more clear to see in my reply.
I also rebooted and that also didn't help.
-
Add both to the following to the suppress list and run a "Force Reload - DNSBL"
www.msftncsi.com
msftncsi.comYou can run the following to see if a domain is listed:
grep "msftncsi.com" /var/unbound/pfb_dnsbl.conf grep "msftncsi.com" /var/db/pfblockerng/dnsbl/*.txt grep "msftncsi.com" /var/db/pfblockerng/dnsblorig/* -
is it possible to whitelist with placeholders?
for example whitelist video.domain.com*
or how would i do that correctly?because i have a domain where videos are not playable and it looks like this -> video.domain.com/abc=43 and the id's always change.
Wildcards don't work in DNSBL Suppression. Needs to be an exact match…
-
Add both to the following to the suppress list and run a "Force Reload - DNSBL"
www.msftncsi.com
msftncsi.comYou can run the following to see if a domain is listed:
grep "msftncsi.com" /var/unbound/pfb_dnsbl.conf grep "msftncsi.com" /var/db/pfblockerng/dnsbl/*.txt grep "msftncsi.com" /var/db/pfblockerng/dnsblorig/*Only the last command gave an output:```
/var/db/pfblockerng/dnsblorig/ADs_someone.orig:127.0.0.1 msftncsi.com
/var/db/pfblockerng/dnsblorig/ADs_someone.orig:127.0.0.1 www.msftncsi.com -
maybe you need to clear the DNS cache on windows side
-
Hi Xmicks,
The three commands will show:
First grep cmd: If a domain is listed in the DNSBL Blocklist.
Second grep : This will show which Feed has a Blocked Domain
Thirds grep : These are the original files from the Feed…So you don't have any reference to msftncsi.com in DNSBL....
If its still blocked, clear your browser and OS cache... If you ping it and its still getting the DNSBL IP, then its probably still in your cache....
Can use this to clear the cache from Chrome : chrome://net-internals/#dns
-
Now the domains are surpressed! Don't know why it suddenly worked, because I already had both www.msftncsi.com and msftncsi.com listed. And had forced reload multiple times before.
Nonetheless it workes now :D
-
Now the domains are surpressed! Don't know why it suddenly worked, because I already had both www.msftncsi.com and msftncsi.com listed. And had forced reload multiple times before.
Nonetheless it workes now :D
ok Next time you have some more tools to work with :) Any other issues let me know..
-
Alright, thanks both for the help! :)
Well there is one thing. Everytime I open a webpage on the pfsense forum I get a 403 error(see image). I then have to quickly reload that same webpage again to open it. If I wait to long(+-3 seconds) i get the same 403 error. Is this caused by pfBlockerNG?
pfBlocker is the only package I have installed at the moment. If I remember it correctly it started when I installed pfBlocker, but it might as wel be something else.
 -
I can't find the thread, but others have noticed this also… Don't think it has anything to do with the package, as I have seen it myself on my mobile while away from my home. However, I haven't seen the issue in a few weeks...
-
is it possible to whitelist with placeholders?
for example whitelist video.domain.com*
or how would i do that correctly?because i have a domain where videos are not playable and it looks like this -> video.domain.com/abc=43 and the id's always change.
Wildcards don't work in DNSBL Suppression. Needs to be an exact match…
thanks your your feedback
could this be something to add in a future version of pfBlocker? does it make sense anyway?
-
Hi - I'm having some trouble with pfBlockerNG updates when DNSBL is enabled. The update process spikes my CPU to 100% for more than an a hour. I've tried manual updates as well as CRON, but no success in completing the updates. Any thoughts?
**Saving configuration [ 06/23/16 21:16:18 ] …
Adding Unbound Server:Include line... completed
Validating database... completed
Reloading Unbound ... completed
DNSBL update [ 0 ]… completedDNSBL - Adding Unbound custom 'include' option
Saving new DNSBL web server configuration to port [ 8081 & 8443 ]
Saving pfSense config…
VIP address configured. Widget Packet statistics reset.
Restarting Service DNSBL...
UPDATE PROCESS START [ 06/23/16 21:16:30 ]===[ DNSBL Process ]================================================
**Saving configuration [ 06/23/16 21:37:53 ] …
Restarting Service DNSBL...
CRON PROCESS START [ 06/23/16 22:00:00 ]
[ FookEasy ]
Update found
[ FookPriv ]
Update found
UPDATE PROCESS START===[ DNSBL Process ]================================================
-
What spec machine fook? If it's a Pi the likely right, it's it's s top end Xeon then somethings likely wrong. How many lists, de-dupe on etc?
-
I'm running an Intel(R) Celeron(R) CPU N2930 @ 1.83GHz 4 CPUs: 1 package(s) x 4 core(s). I've 8GB ram and 40Gb SDD.
I do have IP4V De-Dupe currently enabled with most of the Top 20 spammer countries selected. I've selected the two default DNSBL EasyList feeds and Top1M Alex sites. Within EasyList I've selected all categories and chosen Unbound as the list action.
Happy to tweak these settings or test any other recommendation.
Thanks!
-
Ive just noticed an annoying bug when pressing save on the Firewall/pfBlockerNG/Edit/IPv4 page if there are any errors all your data gets wiped out :-(
This is an issue with the pfSense pkg_edit.php code… I have been discussing a fix with the Devs... Hope to get it resolved shortly...
-
[quote] Hi - I'm having some trouble with pfBlockerNG updates when DNSBL is enabled. The update process spikes my CPU to 100% for more than an a hour. I've tried manual updates as well as CRON, but no success in completing the updates. Any thoughts? **Saving configuration [ 06/23/16 21:16:18 ] ... Adding Unbound Server:Include line... completed Validating database... completed Reloading Unbound ... completed DNSBL update [ 0 ]... completed ------------------------------------------ DNSBL - Adding Unbound custom 'include' option Saving new DNSBL web server configuration to port [ 8081 & 8443 ] Saving pfSense config... VIP address configured. Widget Packet statistics reset. Restarting Service DNSBL... UPDATE PROCESS START [ 06/23/16 21:16:30 ] From the portion of the log that you posted above, the DNSBL count is "0"... Did you add any DNSBL feeds? Run a [b]top -SH[/b] command from the shell and see whats eating memory... [/quote] -
have you force reloaded on the Update Tab?
I most definitely did. The exclusion list has been sitting in there for months and never worked. I just got motivated to look into why it's not working today.
What kind of Domain are you suppressing?
Can you grep for it:
grep "example.com" /var/db/pfblockerng/dnsbl/*.txt grep "example.com" /var/db/pfblockerng/dnsblalias/*.txtThanks for the response. Sorry it took awhile, I was out on travel and just got back.
OK… I think it might be working but I just have to pay closer attention to it. The issue I was having was with the Walgreens site. Whenever I would refill a prescription, it would hang and a log would get written in the dnsbl alerts. I think the issue is me not adding all the domains that it got redirected to-to that whitelist.
I ended up trying one of the domains that was blocked previously but whitelisted, and it seemed to let me through. So.....I think it's an issue with whitelisting the redirects and not with pfblocker or dnsbl itself.
-
[quote] Hi - I'm having some trouble with pfBlockerNG updates when DNSBL is enabled. The update process spikes my CPU to 100% for more than an a hour. I've tried manual updates as well as CRON, but no success in completing the updates. Any thoughts? **Saving configuration [ 06/23/16 21:16:18 ] ... Adding Unbound Server:Include line... completed Validating database... completed Reloading Unbound ... completed DNSBL update [ 0 ]... completed ------------------------------------------ DNSBL - Adding Unbound custom 'include' option Saving new DNSBL web server configuration to port [ 8081 & 8443 ] Saving pfSense config... VIP address configured. Widget Packet statistics reset. Restarting Service DNSBL... UPDATE PROCESS START [ 06/23/16 21:16:30 ] From the portion of the log that you posted above, the DNSBL count is "0"... Did you add any DNSBL feeds? Run a [b]top -SH[/b] command from the shell and see whats eating memory... [/quote] Hi BBcan177 I added another DNSBL feed and have started the update process. Here is the results from top -SH last pid: 57837; load averages: 1.10, 1.03, 0.69 up 1+21:05:30 18:56:13 202 processes: 6 running, 166 sleeping, 30 waiting CPU: 25.3% user, 0.0% nice, 0.1% system, 0.4% interrupt, 74.2% idle Mem: 380M Active, 2656M Inact, 755M Wired, 668M Buf, 4027M Free Swap: 16G Total, 16G Free PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32798 root 103 0 220M 33536K CPU0 0 11:35 100.00% php 11 root 155 ki31 0K 64K CPU1 1 43.6H 88.67% idle{idle: cpu1} 11 root 155 ki31 0K 64K RUN 0 42.6H 84.67% idle{idle: cpu0} 11 root 155 ki31 0K 64K CPU2 2 43.7H 71.00% idle{idle: cpu2} 11 root 155 ki31 0K 64K RUN 3 43.7H 63.18% idle{idle: cpu3} 98665 root 20 0 2023M 1872M uwait 1 109:34 1.07% suricata{FlowManagerThre} 55524 clamav 20 0 787M 701M select 2 15:30 0.00% clamd{clamd} 98665 root 20 0 2023M 1872M nanslp 1 13:59 0.00% suricata{suricata} 98665 root 20 0 2023M 1872M uwait 2 13:53 0.00% suricata{Detect2} 98665 root 20 0 2023M 1872M uwait 1 11:40 0.00% suricata{Detect1} 98665 root 20 0 2023M 1872M uwait 3 9:32 0.00% suricata{Detect3}
