Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RonpfSR
      RonpfS
      last edited by

      /etc/inc/config.inc
      I updated the previous post.

      2.4.5-RELEASE-p1 (amd64)
      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

      1 Reply Last reply Reply Quote 0
      • V
        varazir
        last edited by

        @RonpfS:

        You have to edit the /usr/local/etc/php.ini, /etc/rc.php_ini_setup files to

        suhosin.memory_limit = 805306368

        I'll try the rc.php_ini_setup when I get back home.

        I changed to this(I'm running on a 64bit system)

        // Set memory limit to 512M on amd64.
        if ($ARCH == "amd64") {
          ini_set("memory_limit", "768M");
        } else {
          ini_set("memory_limit", "128M");
        }

        1 Reply Last reply Reply Quote 0
        • V
          varazir
          last edited by

          Thanks it worked!!

          1 Reply Last reply Reply Quote 0
          • S
            surface
            last edited by

            Hi all,

            I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

            Thanks in advance for your help!

            1 Reply Last reply Reply Quote 0
            • RonpfSR
              RonpfS
              last edited by

              @surface:

              Hi all,

              I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

              Thanks in advance for your help!

              Maybe you should read this https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 again

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • V
                varazir
                last edited by

                I made the mistake to reinstall the pkg. ( didn't take a snapshot before doing it) But I have a backup of the machine that I could restore and boot up.

                My idea was if it could be done to export the settings from the backuped VM ( running ) and import it in my live system?

                I can't find any way to extract the settings. found a way to sync the settings could try that but export import would be easier I think.

                1 Reply Last reply Reply Quote 0
                • RonpfSR
                  RonpfS
                  last edited by

                  @varazir:

                  I made the mistake to reinstall the pkg. ( didn't take a snapshot before doing it) But I have a backup of the machine that I could restore and boot up.

                  My idea was if it could be done to export the settings from the backuped VM ( running ) and import it in my live system?

                  I can't find any way to extract the settings. found a way to sync the settings could try that but export import would be easier I think.

                  The settings for pfBlockerNG are stored in the config.xml file.

                  But on a new installation, restoring the config file without modifications will not work with DNSBL enabled. The Resolver service (unbound) will not start as the unbound <custom_options>will try to load /var/unbound/pfb_dnsbl.conf which doesn't exist on a new installation. Without DNS Resolver running, the reinstallation of package on reboot will fail.
                  One workaround is to```
                  touch /var/unbound/pfb_dnsbl.conf

                  
                  Edit the config.xml to disable pfBlockerNG and DNSBL first.
                  
                  To disable pfBlockerNG in the config.xml change
                  
                  	 <pfblockerng><config><enable_cb>on</enable_cb>
                  			<pfb_keep>on</pfb_keep></config></pfblockerng>
                  
                  	 <pfblockerng><config><enable_cb><pfb_keep>on</pfb_keep></enable_cb></config></pfblockerng>
                  
                  
                  To disable DNSBL in the config.xml change
                  
                  	 <pfblockerngdnsblsettings><config><pfb_dnsbl>on</pfb_dnsbl></config></pfblockerngdnsblsettings>
                  
                  
                  **AND** change custom_options :
                  
                   <unbound><active_interface>lan,opt1,lo0</active_interface>
                  	<outgoing_interface>wan</outgoing_interface>
                  	<custom_options>c2VydmVyOmluY2x1ZGU6IC92YXIvdW5ib3VuZC9wZmJfZG5zYmwuY29uZg==</custom_options></unbound> 
                  
                   <unbound><active_interface>lan,opt1,lo0</active_interface>
                  	<outgoing_interface>wan</outgoing_interface></unbound> 
                  
                  
                  On reboot the package installation should proceed and pfBlockerNG will rebuild the MaxMind database. If you had memory issues, you will have to apply the other fixes for memory issues https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 **before** restoring the config.xml file to the new installation.
                  
                  Then you re enable pfBlockerNG and DNSBL, do a Force Update to download the Tables and rebuild the pfBlockerNG database.</custom_options>

                  2.4.5-RELEASE-p1 (amd64)
                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                  1 Reply Last reply Reply Quote 0
                  • M
                    matt.will
                    last edited by

                    Hey Ron,

                    Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

                    M

                    1 Reply Last reply Reply Quote 0
                    • D
                      duanes
                      last edited by

                      My system has 8GB of RAM.  This is very frustrating.

                      I have adjusted the max table entries to 70000000
                      and in php.ini and php setup files suhosin.memory_limit = 1024000000
                      Also, changed the config.inc file so that AMD64 = 4096M

                      Then reinstall pfBlockerNG and I still get this near the end.  It is still

                      Executing custom_php_install_command()…
                      MaxMind GeoIP databases previously downloaded.
                      Adding pfBlockerNG Widget to the Dashboard... done.
                      Remove any existing and create link for DNSBL lighttpd executable... done.
                      Creating DNSBL web server start-up script... done.
                      Creating DNSBL web server config ... done.
                      Starting DNSBL Service... done.
                      Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
                      Custom commands completed ... done.
                      Executing custom_php_resync_config_command()...1 table created.
                      1/1 addresses added.
                      PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed

                      1 Reply Last reply Reply Quote 0
                      • R
                        Ramosel
                        last edited by

                        It's not something I use all the time but I KNOW there used to be links on one of the pfBlockerNG screens to get you to an external lookup for finding AS numbers.  Has that moved?  Been dropped?  I can't find it anywhere…..

                        1 Reply Last reply Reply Quote 0
                        • V
                          varazir
                          last edited by

                          @RonpfS:

                          Ahh ok, so I just thought I missed something well, and you was right when I turned on my backup it had the same settings as I hade after the reinstallation.

                          Everything is purring like kitten again. :)

                          1 Reply Last reply Reply Quote 0
                          • C
                            cmpufxr
                            last edited by

                            I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

                            I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

                            Everything works as it should now, even blocking the youtube ads and porn.

                            I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

                            1 Reply Last reply Reply Quote 0
                            • RonpfSR
                              RonpfS
                              last edited by

                              @cmpufxr:

                              I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

                              I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

                              Everything works as it should now, even blocking the youtube ads and porn.

                              I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

                              A fix for this issue is being tested.

                              2.4.5-RELEASE-p1 (amd64)
                              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                              1 Reply Last reply Reply Quote 0
                              • RonpfSR
                                RonpfS
                                last edited by

                                @duanes:

                                Also, changed the config.inc file so that AMD64 = 4096M

                                PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed

                                Did you reboot after making the modifications ? Maybe the ini settings are not loaded without the reboot.

                                134217728 show that the max memory configured somewhere is still 128M.
                                Maybe you are pushing the limit too far and it resets to 128M
                                Most users are running fine with 512M, 640M or maybe 768M, using 4096M per PHP process on a 4GB system doesn't make sense.

                                Double check the modifications you made and try again.

                                2.4.5-RELEASE-p1 (amd64)
                                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                1 Reply Last reply Reply Quote 0
                                • S
                                  surface
                                  last edited by

                                  @RonpfS:

                                  @surface:

                                  Hi all,

                                  I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

                                  Thanks in advance for your help!

                                  Maybe you should read this https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 again

                                  I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

                                  1 Reply Last reply Reply Quote 0
                                  • RonpfSR
                                    RonpfS
                                    last edited by

                                    @surface:

                                    I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

                                    I made modifications to the post in the last days to better explain the fixes.

                                    2.4.5-RELEASE-p1 (amd64)
                                    Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                    Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                    1 Reply Last reply Reply Quote 0
                                    • RonpfSR
                                      RonpfS
                                      last edited by

                                      @matt.will:

                                      Hey Ron,

                                      Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

                                      M

                                      The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.

                                      2.4.5-RELEASE-p1 (amd64)
                                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                      1 Reply Last reply Reply Quote 0
                                      • QinnQ
                                        Qinn
                                        last edited by

                                        In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

                                        Cheers Qinn

                                        Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                        Firmware: Latest-stable-pfSense CE (amd64)
                                        Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                        1 Reply Last reply Reply Quote 0
                                        • RonpfSR
                                          RonpfS
                                          last edited by

                                          @Qinn:

                                          In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

                                          Cheers Qinn

                                          System logs are one liner, pfblockerng.log is formated to be read top to bottom.

                                          2.4.5-RELEASE-p1 (amd64)
                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                          1 Reply Last reply Reply Quote 0
                                          • QinnQ
                                            Qinn
                                            last edited by

                                            @BBcan177:

                                            Here are more DNSBL Feeds that can be used in pfBlockerNG.
                                            (Copy and paste URLS as plain text)

                                            1. Create a new alias for these.
                                              These are not necessarily ADvert domains. So I named mine "Malicious"

                                            hpHosts
                                            http://hosts-file.net/download/hosts.zip

                                            SWC
                                            http://someonewhocares.org/hosts/hosts

                                            spam404
                                            https://spam404bl.com/blacklist.txt
                                            https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

                                            malc0de
                                            https://malc0de.com/bl/BOOT

                                            MDS (use 'Flex' state)
                                            https://mirror1.malwaredomains.com/files/justdomains

                                            MVPS
                                            http://winhelp2002.mvps.org/hosts.txt

                                            MDL
                                            http://www.malwaredomainlist.com/hostslist/hosts.txt

                                            GJTech
                                            http://adblock.gjtech.net/?format=unix-hosts

                                            dShield_SD  (They also have a conservative list available)
                                            https://www.dshield.org/feeds/suspiciousdomains_High.txt

                                            Zeus
                                            https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

                                            1. These two feeds post full URLs, so there can be some more false positives.
                                              Create a new Alias, and use Alexa as a recommendation.

                                            PhishTank
                                            https://data.phishtank.com/data/online-valid.csv.bz2

                                            OpenPhish
                                            https://www.openphish.com/feed.txt

                                            MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
                                            https://lists.malwarepatrol.net

                                            1. This is a feed that I manage (as time permits)
                                              MS_2
                                              https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

                                            2. Use this in its own Alias:

                                            BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
                                            http://osint.bambenekconsulting.com/feeds/dga-feed.gz

                                            BBC_C2
                                            http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

                                            1. Use this feed in its own alias as it is updated more frequently.
                                              So you can update it more often than once per day.

                                            hpHosts_partial
                                            http://hosts-file.net/hphosts-partial.asp

                                            If users find other feeds, please post back so that others may benefit also.
                                            Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

                                            I got a

                                            [ DNSBL FAIL ] [ Skipping : GJTech ]

                                            [1471592032] unbound-checkconf[36350:0] error: error parsing local-data at 30 '}).filter(' 60 IN A 10.10.10.1': Syntax error, could not parse the RR's TTL
                                            [1471592032] unbound-checkconf[36350:0] error: Bad local-data RR }).filter(' 60 IN A 10.10.10.1
                                            [1471592032] unbound-checkconf[36350:0] fatal error: failed local-zone, local-data configuration
                                            [ dShield_SD ]      exists. [ 08/19/16 09:33:52 ]

                                            …..are the use of the sources mentioned above still to be advised? My Count went from 78k to a 476k and looking at the packets those extra 400k doesn't seem to be highly effective.

                                            Thanks for any advise,

                                            Cheers Qinn

                                            Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                            Firmware: Latest-stable-pfSense CE (amd64)
                                            Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.