PfBlockerNG v2.1 w/TLD

brandur · Jul 21, 2016, 9:40 AM

Sounds like a very exciting update :D
Thank you

Pippin · Jul 21, 2016, 9:44 AM

Very nice addition, chapeau 8)

pftdm007 · Jul 23, 2016, 7:42 PM

Cant wait for this update to roll out!!!!!

zerodamage · Jul 27, 2016, 1:39 AM

Is this available to install now? I am only showing version 2.0.17 for update. I uninstalled hoping maybe I would then see the updated version but it's still not there.

As a matter of fact, it says "Not Ready" in the update window when trying to install or update it now. I now do not have it installed and am not able to install it but my system says it is installed.

It actually did install but only to version 2.0.17. Is that right?

BBcan177 · Jul 27, 2016, 1:53 AM

https://twitter.com/pfsense/status/755227123187449856

BBcan177 · Jul 29, 2016, 3:33 AM

The latest version of pfBlockerNG v2.1.1_1 has been reviewed and merged into pfSense 2.3.3 Dev. If your on the 2.3.3 Snapshots, its available to be installed now.

I believe that the Devs will merge it for pfSense 2.3.2 shortly, so stay tuned for the update.

If you have any questions or Feedback, please let me know….

Please Read the instructions in the DNSBL tab for the new TLD feature before enabling it.
Once enabled, follow that with a "Force Reload - DNSBL".

Review any MaxMind GeoIP settings, since there have been significant changes with the upgrade to GeoLite2.

Note: If you have less than 5GB of RAM and you have added the Bambenek DGA DNSBL Feed, please move that to the last entry in the DNSBL Feeds. Since that feed is quite large (700k+ Domains), its best to allow TLD to process the other Feeds first before hitting the max TLD Domain limit. (http://osint.bambenekconsulting.com/feeds/dga-feed.gz).

f34rinc · Jul 29, 2016, 2:51 PM

Nice work BBcan177 :D setup blocking of .ru as a test and it works.

DownloadDeviant · Jul 29, 2016, 5:46 PM

THANKS! Can't wait! Good stuff….great work...and thanks for helping us dumb dumbs :P here and over at Reddit!

PS - is there a quick n dirty way to test PFBNG to be sure you've generally set it up correctly? Like going to a website and not seeing ads, etc.?

mauroman33 · Jul 29, 2016, 9:12 PM

Thank you so much for this fantastic work!!!

BBcan177 · Jul 29, 2016, 10:27 PM

@DownloadDeviant:

THANKS! Can't wait! Good stuff….great work...and thanks for helping us dumb dumbs :P here and over at Reddit!

PS - is there a quick n dirty way to test PFBNG to be sure you've generally set it up correctly? Like going to a website and not seeing ads, etc.?

Thanks… Are you on the latest 2.1.1_1 version? Haven't heard much feedback yet, so not sure if many have installed it yet...

Not sure what sites are the worst for ADs... but yahoo is probably up there....

@mauroman33:

Thank you so much for this fantastic work!!!

Thanks!

DownloadDeviant · Jul 30, 2016, 12:02 AM

@BBcan177:

Thanks… Are you on the latest 2.1.1_1 version? Haven't heard much feedback yet, so not sure if many have installed it yet...

Not sure what sites are the worst for ADs... but yahoo is probably up there....

I'm still on 2.0.17. I've slowed down my updating a bit since I've had some snags and had to rebuild 3 times in the past 7 weeks. Two were my fault…lol I thought I had router plugged into the battery port on the UPS but didn't...storm hit...lost power...pf went corrupt. Sooooooooo, I'm a bit worn out on tampering right now. lol That said, I'll probably upgrade it this weekend.

Yahoo it is then. I'm very new to pfBNG so I need to learn it and get comfortable. I don't want to get too aggressive. I just want it to serve as a companion for my Firefox plugins and to help keep my girlfriend protected.

someuser123 · Jul 30, 2016, 12:21 AM

pfBlockerNG-2.1.1_1 is working like charm, On 2.3.3-DEVELOPMENT (amd64) no issues.

TLD Blacklist is really handy, Thanks BBcan177

BBcan177 · Aug 22, 2016, 2:30 AM

Here are the links for Malware Corpus Tracker which can be used w/ pfBlockerNG DNSBL:

Site:
http://track.h3x.eu/about/400

Available Feeds:
https://tracker.h3x.eu/api/sites_1month.php
https://tracker.h3x.eu/api/sites_1week.php
https://tracker.h3x.eu/api/sites_1day.php
https://tracker.h3x.eu/api/sites_1hour.php

DO NOT Select all of these Feeds. You should pick only one Feed. For example: the "1Month" will include the "1Week/1Day/1Hour".

[ Edit - change to https ]

Twitter:
https://twitter.com/h3x2b

ntct · Jul 30, 2016, 6:10 AM

Hi BBcan177,

I can't update h3x feed from available feeds list in pfBlockerNG v2.1.

It show below.

[ h3x ]			 Downloading update .. 200 OK
 Remote timestamp missing 
 No Domains Found

And I can't let TLD Exclusion List working. Can you give a example or check it works?

RonpfS · Jul 30, 2016, 9:26 AM

@ntct:

Hi BBcan177,

I can't update h3x feed from available feeds list in pfBlockerNG v2.1.

It show below.
[ h3x ]			 Downloading update .. 200 OK
 Remote timestamp missing 
 No Domains Found

Same here

@ntct:

And I can't let TLD Exclusion List working. Can you give a example or check it works?

Did you do a Force Reload after changing the list ?

hulleyrob · Jul 30, 2016, 11:34 AM

[ 1month ]		 Downloading update .. 200 OK
  Remote timestamp missing 
 No Domains Found

[ 1week ]		 Downloading update [ 07/30/16 12:31:20 ] .. 200 OK
  Remote timestamp missing 
 No Domains Found

[ 1day ]		 Downloading update .. 200 OK
  Remote timestamp missing 
 No Domains Found

[ 1hour ]		 Downloading update .. 200 OK
  Remote timestamp missing 
 No Domains Found

Me three, anyone post how exactly you get these list working?

BBcan177 · Jul 30, 2016, 12:40 PM

Here is a patch to fix the H3X Feed… Sorry about that ...

@BBcan177:

Here are the links for Malware Corpus Tracker which can be used w/ pfBlockerNG DNSBL:

UPDATE:

Guess the internal QA testing didn't work too well when I tested this Feed.
Please follow these instructions below to patch the code to get the following feed to parse:

Edit /usr/local/pkg/pfblockerng/pfblockerng.inc

Goto Line 3368 which contains the following:
$h3x_feed = TRUE;
Reference:
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/pkg/pfblockerng/pfblockerng.inc#L3368

and add the following line after line 3368:
$liteparser = TRUE;
Then follow that with a "Force Update"

BBcan177 · Jul 30, 2016, 12:42 PM

@ntct:

And I can't let TLD Exclusion List working. Can you give a example or check it works?

Can you provide more detail about what you're trying to accomplish?

hulleyrob · Jul 30, 2016, 12:42 PM

Works for me.

For the lazy:

vi +3368 /usr/local/pkg/pfblockerng/pfblockerng.inc

to go straight to the line.

Thanks BBcan

BBcan177 · Jul 30, 2016, 8:37 PM

I have posted a PR #164 to fix the H3x parser issue noted above.
‎https://github.com/pfsense/FreeBSD-ports/pull/164‎

Once this is merged the pkg will be at version 2.1.1_2.

If you manually edited the file noted above, or not, you do not need to make any further changes with this version.