PfBlockerNG v2.0 w/DNSBL

[BBcan177]

@tjbaudio:

I think I have traced my problem to NAT reflection.

From an earlier post, it seems like you reversed the in/outbound interfaces in the pkg General tab. Not sure if that's related. Also try to enable suppression in the general tab and run a "Force Reload -All". This will remove any loopback addresses that could potentially be in the DNSBL IP aliastable.

[tjbaudio]

Thank you for the recommendations.  These did not work.  Unfortunately I may not have much time over the next week to work on this.  I am thinking I may try a fresh install again when I do.  Taking screen shots the whole way.  If it works you can use them for a how to, if not I will know what I did :o

[D0X]

Problem here;

Running pfsense 2.3.1 with pfblockerng.

Did set up IPV4 with two lists, EasyList and EasyPrivacy.
I also have DNSBL enabled with Easylist.

But now when browsing I continuously get Safari telling me the certificate is invalid (as shown in the attached picture, it is in Dutch but I think you'll get it).
The certificate seems to me just the thing you'd like to have being blocked. How do I fix this, it is bugging the hell out of me.


[BBcan177]

@tjbaudio:

Thank you for the recommendations.  These did not work.  Unfortunately I may not have much time over the next week to work on this.  I am thinking I may try a fresh install again when I do.  Taking screen shots the whole way.  If it works you can use them for a how to, if not I will know what I did :o

With just a single WAN/LAN, it should be fairly straightforward to setup the pkg…  Double check your LAN Devices for DNS and ensure that they only have pfSense as its only DNS server setting.

[BBcan177]

@D0X:

But now when browsing I continuously get Safari telling me the certificate is invalid (as shown in the attached picture, it is in Dutch but I think you'll get it).

Safari seems to be the only browser that has this issue. Doesn't seem to occur with Chrome/FF/IE/Edge etc…

Are these cert popups happening when you browse to that blocked Domain directly, or when its blocking that Domain as part of the webpage?  Two checks to ensure DNBSL is working as expected... Ping the DNSBL VIP and get a proper response ... Browse to the DNSBL VIP and get the 1x1 pix...

If the popups are from a few common Domains, try to whitelist those and see if that improves it.

Also, in the IPv4 tab, you cannot enter any EasyList Feeds... the IPv4 tab is for IP based listed only.

DNSBL is designed to block the DNS resolution to Advert/Malicious Domains. As such only a portion of the EasyList/Privacy Feeds can be used (Where the feeds lists the actual ADvert Domain). Browser-Addons like ADBlock/UBlock manipulate the elements that are displayed on the page. So they can block certain elements from a particular Domain, while DNSBL can only block the entire Domain.

Only two EasyList feeds can be used with DNSBL and they are hardcoded in the EasyList Tab. There are several other DNSBL Feeds listed at the start of this thread that can fill in the gap to block the balance of the Domains from serving any ADs.  Plus its achieved at Network level, without any add-ons manipulating or potentially opening security holes in the browser.

It would really be nice if Safari fixed this issue with their software... Not much I can do to fix that without killing the package logging feature and just NXDOMAIN the DNS requests.

[D0X]

Safari seems to be the only browser that has this issue. Doesn't seem to occur with Chrome/FF/IE/Edge etc…

Are these cert popups happening when you browse to that blocked Domain directly, or when its blocking that Domain as part of the webpage?  Two checks to ensure DNBSL is working as expected... Ping the DNSBL VIP and get a proper response ... Browse to the DNSBL VIP and get the 1x1 pix...

Should the VIP be one inside the LAN subnet or outside, tried both. Only inside the subnet I am getting the 1x1 pix, both don't respond to pings.

If the popups are from a few common Domains, try to whitelist those and see if that improves it.

googleads.g.doubleclick.net seems to be the main culprit. Isn't there any other way to block this certificate?

Also, in the IPv4 tab, you cannot enter any EasyList Feeds… the IPv4 tab is for IP based listed only.

Check, only using DNSBL now.

It would really be nice if Safari fixed this issue with their software… Not much I can do to fix that without killing the package logging feature and just NXDOMAIN the DNS requests.

[BBcan177]

@D0X:

Should the VIP be one inside the LAN subnet or outside, tried both. Only inside the subnet I am getting the 1x1 pix, both don't respond to pings.

Typically you set the DNSBL VIP to "LAN", and if you are in a Multi-LAN network, you can enable the option in the DNSBL Tab to create a Floating Permit rule to allow all of your LAN Subnets to hit the DNSBL VIP address. You will get unexpected behaviour until your fix the Ping/Browse to the VIP.  Also ensure that your LAN devices only have pfSense as its DNS Server.

[D0X]

@BBcan177:

@D0X:

Should the VIP be one inside the LAN subnet or outside, tried both. Only inside the subnet I am getting the 1x1 pix, both don't respond to pings.

Typically you set the DNSBL VIP to "LAN", and if you are in a Multi-LAN network, you can enable the option in the DNSBL Tab to create a Floating Permit rule to allow all of your LAN Subnets to hit the DNSBL VIP address. You will get unexpected behaviour until your fix the Ping/Browse to the VIP.  Also ensure that your LAN devices only have pfSense as its DNS Server.

Thanks for your support so far, but for now I've given up on pfblockerng. Not that the package is flawed, but Safari on OSX and IOS is driving me nuts.

[BBcan177]

@D0X:

Thanks for your support so far, but for now I've given up on pfblockerng. Not that the package is flawed, but Safari on OSX and IOS is driving me nuts.

NP…. Should you decide to pick it backup at some point, try to see why the Ping/Browse to the DNSBL VIP wasn't working. That will cause issues on its own.... also since it was one Domain that was predominantly causing issues,  you could also Whitelist it...

[Qinn]

Hi there is it possible to save and restore the pfBlockerNG settings at a certain phase, so when you mess up you can return to a previous setup?

[RonpfS]

@Qinn:

Hi there is it possible to save and restore the pfBlockerNG settings at a certain phase, so when you mess up you can return to a previous setup?

Every change in pfBlockerNG is saved in the config file.

You can save the config with Diagnostics/Backup & Restore/Backup & Restore and do a restore of the config at a later time.

[wiz561]

I just updated the pfBlockerNG package and I'm now receiving these errors when I reboot…

There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:37:54
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:39:58
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:40:37

I'm running pfBlockerNG 2.1.1_2 with PfSense 2.3.2-RELEASE (amd64).  I have 2gb of memory and 34% in use with a 2gb swap and 0% in use (for the swap).

I'm assuming it's not a memory issue and possibly something else.  I was wondering if anybody else had this issue and what a possible fix may be.

Thanks!

[RonpfS]

@wiz561:

I just updated the pfBlockerNG package and I'm now receiving these errors when I reboot…

There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:37:54
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:39:58
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:40:37

I'm running pfBlockerNG 2.1.1_2 with PfSense 2.3.2-RELEASE (amd64).  I have 2gb of memory and 34% in use with a 2gb swap and 0% in use (for the swap).

I'm assuming it's not a memory issue and possibly something else.  I was wondering if anybody else had this issue and what a possible fix may be.

Thanks!

Did you ran a Force Reload IP since the reboot?
Look at /var/db/aliastables/pfB_Europe_v6.txt, it should have only IP in it.

[wiz561]

@RonpfS:

@wiz561:

I just updated the pfBlockerNG package and I'm now receiving these errors when I reboot…

There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:37:54
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:39:58
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:40:37

I'm running pfBlockerNG 2.1.1_2 with PfSense 2.3.2-RELEASE (amd64).  I have 2gb of memory and 34% in use with a 2gb swap and 0% in use (for the swap).

I'm assuming it's not a memory issue and possibly something else.  I was wondering if anybody else had this issue and what a possible fix may be.

Thanks!

Did you ran a Force Reload IP since the reboot?
Look at /var/db/aliastables/pfB_Europe_v6.txt, it should have only IP in it.

Thanks for the response.  Yes, I ran through the force reload (all of them) and (update, cron, reload), and nothing.  I even tried to move the pfB_Europe_v6.txt file to .old and I'm still getting that error message.

[RonpfS]

https://forum.pfsense.org/index.php?topic=115357.msg643944#msg643944

@BBcan177:

@lpallard:

There were error(s) loading the rules: /tmp/rules.debug:37: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [37]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 14:55:00
There were error(s) loading the rules: /tmp/rules.debug:37: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [37]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 14:55:11
There were error(s) loading the rules: /tap/rules.debug:37: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [37]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 14:55:20 

These all seem to be related to the MaxMind IPv6 database. Looks like you will need to bump the pfSense max aliastable entries limit from 2M to 4M. If you enable aggregation in the general tab, it should condense the CIDRs and reduce the overall IP count. This changed due to using the new MaxMind Geolite2 database which seems to have smaller subsets of the data listed causing more IP entries to be added.

[wiz561]

@RonpfS:

https://forum.pfsense.org/index.php?topic=115357.msg643944#msg643944

@BBcan177:

@lpallard:

There were error(s) loading the rules: /tmp/rules.debug:37: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [37]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 14:55:00
There were error(s) loading the rules: /tmp/rules.debug:37: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [37]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 14:55:11
There were error(s) loading the rules: /tap/rules.debug:37: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [37]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 14:55:20 

These all seem to be related to the MaxMind IPv6 database. Looks like you will need to bump the pfSense max aliastable entries limit from 2M to 4M. If you enable aggregation in the general tab, it should condense the CIDRs and reduce the overall IP count. This changed due to using the new MaxMind Geolite2 database which seems to have smaller subsets of the data listed causing more IP entries to be added.

Thanks for the response.  Are you saying that I should change the…

Firewall Maximum Table Entries: 2000000

to

Firewall Maximum Table Entries: 4000000

I just wanted to make sure I'm changing the right thing.  Also, when the cron jobs were running, I saw something with some large numbers of maybe the 200000 and I was at something like 150000...  Sorry I didn't make note of it.

Thanks!

[RonpfS]

@wiz561:

Thanks for the response.  Are you saying that I should change the…

Firewall Maximum Table Entries: 2000000

to

Firewall Maximum Table Entries: 4000000

I just wanted to make sure I'm changing the right thing.

This looks like it  ;)
Firewall Maximum Table Entries : Maximum number of table entries for systems such as aliases, sshlockout, snort, etc, combined.

@wiz561:

Also, when the cron jobs were running, I saw something with some large numbers of maybe the 200000 and I was at something like 150000…  Sorry I didn't make note of it.

Thanks!

You can review the log file by going to the Firewall/pfBlockerNG/Log Browser tab

[wiz561]

@RonpfS:

@wiz561:

Thanks for the response.  Are you saying that I should change the…

Firewall Maximum Table Entries: 2000000

to

Firewall Maximum Table Entries: 4000000

I just wanted to make sure I'm changing the right thing.

This looks like it  ;)
Firewall Maximum Table Entries : Maximum number of table entries for systems such as aliases, sshlockout, snort, etc, combined.

@wiz561:

Also, when the cron jobs were running, I saw something with some large numbers of maybe the 200000 and I was at something like 150000…  Sorry I didn't make note of it.

Thanks!

You can review the log file by going to the Firewall/pfBlockerNG/Log Browser tab

Thanks.  I saw that 20000 number get changed to 40000-something so I think it's working.  Hopefully this will fix it!

I've been having some issues lately so I'm hoping that maybe this clears up some of the problems.  I think it's snort related, as the problems ceased when I stopped snort for a few days.

[Qinn]

@RonpfS:

@Qinn:

Hi there is it possible to save and restore the pfBlockerNG settings at a certain phase, so when you mess up you can return to a previous setup?

Every change in pfBlockerNG is saved in the config file.

You can save the config with Diagnostics/Backup & Restore/Backup & Restore and do a restore of the config at a later time.

Thanks for the reply, but I was hoping for a separate config file, as far as I can see there is none.

[PF64]

@wiz561:

I just updated the pfBlockerNG package and I'm now receiving these errors when I reboot…

There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:37:54
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:39:58
There were error(s) loading the rules: /tmp/rules.debug:47: cannot define table pfB_Europe_v6: Cannot allocate memory - The line in question reads [47]: table <pfB_Europe_v6> persist file "/var/db/aliastables/pfB_Europe_v6.txt" @ 2016-07-31 12:40:37

I'm running pfBlockerNG 2.1.1_2 with PfSense 2.3.2-RELEASE (amd64).  I have 2gb of memory and 34% in use with a 2gb swap and 0% in use (for the swap).

I'm assuming it's not a memory issue and possibly something else.  I was wondering if anybody else had this issue and what a possible fix may be.

Thanks!

I have a huge issue with the last update as well. It eats memory like a banshee in a matter of minutes! I have 16Gb and it fills it to the brim then gives me the same errors, can't load rules.