Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      surface
      last edited by

      @RonpfS:

      @surface:

      Hi all,

      I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

      Thanks in advance for your help!

      Maybe you should read this https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 again

      I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by

        @surface:

        I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

        I made modifications to the post in the last days to better explain the fixes.

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • RonpfSR
          RonpfS
          last edited by

          @matt.will:

          Hey Ron,

          Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

          M

          The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.

          2.4.5-RELEASE-p1 (amd64)
          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

          1 Reply Last reply Reply Quote 0
          • QinnQ
            Qinn
            last edited by

            In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

            Cheers Qinn

            Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
            Firmware: Latest-stable-pfSense CE (amd64)
            Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

            1 Reply Last reply Reply Quote 0
            • RonpfSR
              RonpfS
              last edited by

              @Qinn:

              In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

              Cheers Qinn

              System logs are one liner, pfblockerng.log is formated to be read top to bottom.

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • QinnQ
                Qinn
                last edited by

                @BBcan177:

                Here are more DNSBL Feeds that can be used in pfBlockerNG.
                (Copy and paste URLS as plain text)

                1. Create a new alias for these.
                  These are not necessarily ADvert domains. So I named mine "Malicious"

                hpHosts
                http://hosts-file.net/download/hosts.zip

                SWC
                http://someonewhocares.org/hosts/hosts

                spam404
                https://spam404bl.com/blacklist.txt
                https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

                malc0de
                https://malc0de.com/bl/BOOT

                MDS (use 'Flex' state)
                https://mirror1.malwaredomains.com/files/justdomains

                MVPS
                http://winhelp2002.mvps.org/hosts.txt

                MDL
                http://www.malwaredomainlist.com/hostslist/hosts.txt

                GJTech
                http://adblock.gjtech.net/?format=unix-hosts

                dShield_SD  (They also have a conservative list available)
                https://www.dshield.org/feeds/suspiciousdomains_High.txt

                Zeus
                https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

                1. These two feeds post full URLs, so there can be some more false positives.
                  Create a new Alias, and use Alexa as a recommendation.

                PhishTank
                https://data.phishtank.com/data/online-valid.csv.bz2

                OpenPhish
                https://www.openphish.com/feed.txt

                MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
                https://lists.malwarepatrol.net

                1. This is a feed that I manage (as time permits)
                  MS_2
                  https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

                2. Use this in its own Alias:

                BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
                http://osint.bambenekconsulting.com/feeds/dga-feed.gz

                BBC_C2
                http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

                1. Use this feed in its own alias as it is updated more frequently.
                  So you can update it more often than once per day.

                hpHosts_partial
                http://hosts-file.net/hphosts-partial.asp

                If users find other feeds, please post back so that others may benefit also.
                Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

                I got a

                [ DNSBL FAIL ] [ Skipping : GJTech ]

                [1471592032] unbound-checkconf[36350:0] error: error parsing local-data at 30 '}).filter(' 60 IN A 10.10.10.1': Syntax error, could not parse the RR's TTL
                [1471592032] unbound-checkconf[36350:0] error: Bad local-data RR }).filter(' 60 IN A 10.10.10.1
                [1471592032] unbound-checkconf[36350:0] fatal error: failed local-zone, local-data configuration
                [ dShield_SD ]      exists. [ 08/19/16 09:33:52 ]

                …..are the use of the sources mentioned above still to be advised? My Count went from 78k to a 476k and looking at the packets those extra 400k doesn't seem to be highly effective.

                Thanks for any advise,

                Cheers Qinn

                Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                Firmware: Latest-stable-pfSense CE (amd64)
                Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                1 Reply Last reply Reply Quote 0
                • RonpfSR
                  RonpfS
                  last edited by

                  The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
                  Just turn the list state to OFF.

                  2.4.5-RELEASE-p1 (amd64)
                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                  1 Reply Last reply Reply Quote 0
                  • QinnQ
                    Qinn
                    last edited by

                    @RonpfS:

                    The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
                    Just turn the list state to OFF.

                    Thanks RonpfS for the reply.

                    Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                    Firmware: Latest-stable-pfSense CE (amd64)
                    Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                    1 Reply Last reply Reply Quote 0
                    • J
                      jrdnlc
                      last edited by

                      I set this up last night and so far good other than certification error pop ups i keep getting on certain sites. Anyone know if there is a fix for this?

                      Also, do you guys use IPv4 lists and DNSBL or just one?

                      1 Reply Last reply Reply Quote 0
                      • RonpfSR
                        RonpfS
                        last edited by

                        Try Chrome or Firefox.

                        2.4.5-RELEASE-p1 (amd64)
                        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                        1 Reply Last reply Reply Quote 0
                        • J
                          jrdnlc
                          last edited by

                          @RonpfS:

                          Try Chrome or Firefox.

                          Not a fan or either. Any other option?

                          1 Reply Last reply Reply Quote 0
                          • QinnQ
                            Qinn
                            last edited by

                            @jrdnlc:

                            @RonpfS:

                            Try Chrome or Firefox.

                            Not a fan or either. Any other option?

                            Nope, take a look at Reply #161 https://forum.pfsense.org/index.php?topic=102470.msg575727#msg575727

                            Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                            Firmware: Latest-stable-pfSense CE (amd64)
                            Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                            1 Reply Last reply Reply Quote 0
                            • F
                              filthyskillet
                              last edited by

                              The way I resolved it is to permanently add cert… click show cert and choose trust check box this will add trust but when it resolves it is handeled dnsbl and returns 1x1pixel.

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                Here is a link to PR # 175 for pfBlockerNG v2.1.1_3

                                https://forum.pfsense.org/index.php?topic=115357.msg649167#msg649167

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • P
                                  PF64
                                  last edited by

                                  2.1.1_4 is out , hopefully the answer to all

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    srit
                                    last edited by

                                    Good morning. I'm having the cannot allocate memory issue after upgrading from 2.1.1_2 to 2.1.1_3, then to 2.1.1_4. Uninstalling and reinstalling with and without keep settings checked off and i am still getting the cannot allocate memory error in pfsense. I've also been doing a force update after each try just in case.

                                    Looking at the pfblockerng.log i cannot see any errors or failures. see below for exact error from pfsense.

                                    There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18

                                    if it helps i have 16GB in the FW.

                                    Thanks.

                                    1 Reply Last reply Reply Quote 0
                                    • RonpfSR
                                      RonpfS
                                      last edited by

                                      @srit:

                                      There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18

                                      if it helps i have 16GB in the FW.

                                      Thanks.

                                      You should have leave you original post in the pfBlockerNG v2.1 w/TLD thread.

                                      It is mentionned many many times that if you are using GeoIP tables, you need to raise Firewall Maximum Table Entries in System / Advanced / Firewall & NAT

                                      The file on my pfsense is called South_America_v6.txt, maybe you have leftover from the previous installation. Open the Africa GeoIP tab, verify your selections and hit save, this will update the table. Then run Force Reload IP.
                                      I just enabled the South America GeoIP table on my system and it has the same name as yours pfB_SAmerica_v6, so it is probably just a table size issue.

                                      2.4.5-RELEASE-p1 (amd64)
                                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        srit
                                        last edited by

                                        Thank you I raised it to 4.5M to be safe.

                                        I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.

                                        I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.

                                        Once again thank you.

                                        1 Reply Last reply Reply Quote 0
                                        • RonpfSR
                                          RonpfS
                                          last edited by

                                          @srit:

                                          I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.

                                          2.1.1_4 is pfBlockerNG with DNSBL and TLD. No harm done, one thread or the other will do. But it may be better to use the pfBlockerNG v2.1 w/TLD in the future.

                                          @srit:

                                          I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.

                                          The size of MaxMind GeoIP database is 3-5x larger than previously, that used to make php crashes with the 2.1.1_2 version, this has been fixed.

                                          However the tables generated are 3-5x larger as well, that requires an increase to the Firewall Maximum Table Entries as the default value isn't enough.

                                          2.4.5-RELEASE-p1 (amd64)
                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            srit
                                            last edited by

                                            Thank you for the clarification. I appreciate it. I will endeavor to use that forum for these posts in the future.  ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.