PfBlockerNG v2.0 w/DNSBL

duanes

My system has 8GB of RAM. This is very frustrating.

I have adjusted the max table entries to 70000000
and in php.ini and php setup files suhosin.memory_limit = 1024000000
Also, changed the config.inc file so that AMD64 = 4096M

Then reinstall pfBlockerNG and I still get this near the end. It is still

Executing custom_php_install_command()…
MaxMind GeoIP databases previously downloaded.
Adding pfBlockerNG Widget to the Dashboard... done.
Remove any existing and create link for DNSBL lighttpd executable... done.
Creating DNSBL web server start-up script... done.
Creating DNSBL web server config ... done.
Starting DNSBL Service... done.
Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
Custom commands completed ... done.
Executing custom_php_resync_config_command()...1 table created.
1/1 addresses added.
PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed

Ramosel

It's not something I use all the time but I KNOW there used to be links on one of the pfBlockerNG screens to get you to an external lookup for finding AS numbers. Has that moved? Been dropped? I can't find it anywhere…..

varazir

@RonpfS:

Ahh ok, so I just thought I missed something well, and you was right when I turned on my backup it had the same settings as I hade after the reinstallation.

Everything is purring like kitten again. :)

cmpufxr

I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

Everything works as it should now, even blocking the youtube ads and porn.

I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

RonpfS

@cmpufxr:

I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

Everything works as it should now, even blocking the youtube ads and porn.

I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

A fix for this issue is being tested.

RonpfS

@duanes:

Also, changed the config.inc file so that AMD64 = 4096M

PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed

Did you reboot after making the modifications ? Maybe the ini settings are not loaded without the reboot.

134217728 show that the max memory configured somewhere is still 128M.
Maybe you are pushing the limit too far and it resets to 128M
Most users are running fine with 512M, 640M or maybe 768M, using 4096M per PHP process on a 4GB system doesn't make sense.

Double check the modifications you made and try again.

surface

@RonpfS:

@surface:

Hi all,

I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

Thanks in advance for your help!

Maybe you should read this https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 again

I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

RonpfS

@surface:

I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

I made modifications to the post in the last days to better explain the fixes.

RonpfS

@matt.will:

Hey Ron,

Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

M

The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.

Qinn

In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

Cheers Qinn

RonpfS

@Qinn:

In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

Cheers Qinn

System logs are one liner, pfblockerng.log is formated to be read top to bottom.

Qinn

@BBcan177:

Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)

Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"

hpHosts
http://hosts-file.net/download/hosts.zip

SWC
http://someonewhocares.org/hosts/hosts

spam404
~~https://spam404bl.com/blacklist.txt~~
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

malc0de
https://malc0de.com/bl/BOOT

MDS (use 'Flex' state)
https://mirror1.malwaredomains.com/files/justdomains

MVPS
http://winhelp2002.mvps.org/hosts.txt

MDL
http://www.malwaredomainlist.com/hostslist/hosts.txt

GJTech
http://adblock.gjtech.net/?format=unix-hosts

dShield_SD (They also have a conservative list available)
https://www.dshield.org/feeds/suspiciousdomains_High.txt

Zeus
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

These two feeds post full URLs, so there can be some more false positives.
Create a new Alias, and use Alexa as a recommendation.

PhishTank
https://data.phishtank.com/data/online-valid.csv.bz2

OpenPhish
https://www.openphish.com/feed.txt

MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
https://lists.malwarepatrol.net

This is a feed that I manage (as time permits)
MS_2
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

Use this in its own Alias:

BBC_DGA (This is a large feed of DGA for the likes of Cryptolocker et al…)
http://osint.bambenekconsulting.com/feeds/dga-feed.gz

BBC_C2
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

Use this feed in its own alias as it is updated more frequently.
So you can update it more often than once per day.

hpHosts_partial
http://hosts-file.net/hphosts-partial.asp

If users find other feeds, please post back so that others may benefit also.
Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

I got a

[ DNSBL FAIL ] [ Skipping : GJTech ]

[1471592032] unbound-checkconf[36350:0] error: error parsing local-data at 30 '}).filter(' 60 IN A 10.10.10.1': Syntax error, could not parse the RR's TTL
[1471592032] unbound-checkconf[36350:0] error: Bad local-data RR }).filter(' 60 IN A 10.10.10.1
[1471592032] unbound-checkconf[36350:0] fatal error: failed local-zone, local-data configuration
[ dShield_SD ] exists. [ 08/19/16 09:33:52 ]

…..are the use of the sources mentioned above still to be advised? My Count went from 78k to a 476k and looking at the packets those extra 400k doesn't seem to be highly effective.

Thanks for any advise,

Cheers Qinn

RonpfS

The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
Just turn the list state to OFF.

Qinn

@RonpfS:

The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
Just turn the list state to OFF.

Thanks RonpfS for the reply.

jrdnlc

I set this up last night and so far good other than certification error pop ups i keep getting on certain sites. Anyone know if there is a fix for this?

Also, do you guys use IPv4 lists and DNSBL or just one?

RonpfS

Try Chrome or Firefox.

jrdnlc

@RonpfS:

Try Chrome or Firefox.

Not a fan or either. Any other option?

Qinn

@jrdnlc:

@RonpfS:

Try Chrome or Firefox.

Not a fan or either. Any other option?

Nope, take a look at Reply #161 https://forum.pfsense.org/index.php?topic=102470.msg575727#msg575727

filthyskillet

The way I resolved it is to permanently add cert… click show cert and choose trust check box this will add trust but when it resolves it is handeled dnsbl and returns 1x1pixel.

BBcan177

Here is a link to PR # 175 for pfBlockerNG v2.1.1_3

https://forum.pfsense.org/index.php?topic=115357.msg649167#msg649167