Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      khorton
      last edited by

      @BBcan177:

      @khorton:

      Is this the "Reload" selection on the Update page?  I was running "Update" after making any changes.

      Yes the Update tab has "Update|Cron|Reload" buttons… For Reload you can further select a reload of IP/DNSBL or All...

      Force Update will not "Reload" any changes that you made... Without running a "Force Reload", a previously downloaded Feed will not use the new settings, until Cron runs, and its re-downloaded... So thats the reason for the "Force Reload" button.

      Click on the blue "i" infoblock Icons on the pages… It will show additional help text...

      By "DNSBL whitelist", do you mean the "Custom Domain Whitelist" on the DNSBL page? ".doubleclick.net" (without the quotes) is the first line on that list.  Or should I be looking a different whitelist?

      Yes, DNSBL Custom Whitelist.

      Thanks for the clarification.  I had previously read the info triggered by the blue "i"s.  It makes perfect sense now that I know how the option works.  I had assumed, incorrectly, that the lists would be reloaded after an update.

      Now, when I run 'grep "doubleclick.net" /var/unbound/pfb_dnsbl.conf', I get a null result, apparently as expected.  And, happily, my wife hasn't complained about Safari barfing up SSL certificate errors for over 24 hours.

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by

        @reason:

        When running the force reload dnsbl, I noticed some of the TLD's, that I enter in the custom whitelist, were listed but not the exact subdomains that should have been whitelisted by using (for example) .facebook.com. I wanted mail.facebook.com to be whitelisted but it whitelisted ads.facebook.

        If you put .FQDN it will whitelist the whole .FQDN domain, If you put .facebook.com it will whitelist the whole .facebook.com domain, mail.facebook.com, ads.facebook.com, what.ever.they.use.facebook.com, etc.

        @reason:

        Newegg was not even listed.

        So it looks like it searching the other DNSBL lists for those hostnames but not finding them so it's not exclusively whitelisting them.

        Do I need to enter the fqdn as listed in the alerts?

        Look at the Alerts Tab DNSBL section and hover over the "+" icon, it will tell you why the blocks happens.
        You can also click on it to Whitelist it from the alerts tabs. When the whitelisting happens, it will comes back with what actions it tooks. Sometimes it will also whitelist CNAME of the FQDN. Then have a look at the Custom Domain Whitelist to see what was done.

        There is also a legend infoblock at the bottom of the page.

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • M
          maverik1
          last edited by

          @BBcan177:

          Here are some basic instructions to get started with DNSBL.

          1. Open the pfBNG "DNSBL" Tab:

          (Use the defaults unless you have a need to use otherwise)
          Enter the DNSBL VIP as 10.10.10.1
          Enter the DNSBL Listening Port as 8081
          Enter the DNSBL SSL Listening port as 8443
          Select the DNSBL Listening Interface as Lan

          I have vlans configured on pfsense. Therefore there is no LAN option. The my only options are the different vlans, so what can I choose for the listening interface?

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @maverik1:

            @BBcan177:

            Here are some basic instructions to get started with DNSBL.

            1. Open the pfBNG "DNSBL" Tab:

            (Use the defaults unless you have a need to use otherwise)
            Enter the DNSBL VIP as 10.10.10.1
            Enter the DNSBL Listening Port as 8081
            Enter the DNSBL SSL Listening port as 8443
            Select the DNSBL Listening Interface as Lan

            I have vlans configured on pfsense. Therefore there is no LAN option. The my only options are the different vlans, so what can I choose for the listening interface?

            Hi maverik1,

            I haven't tested that before, but I assume that it should be ok to choose any one of the VLANS…

            After enabling DNSBL, run this command from the shell to see if the DNSBL VIP is assigned to the VLAN:

            ifconfig
            

            You should see a line like this in the VLAN:

            inet 10.10.10.1 netmask 0xffffffff broadcast 10.10.10.1
            

            Then try to ping the DNSBL VIP address and see if it responds…

            Since you have multiple VLANs, its a good idea to enable the DNSBL Permit rule option....

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • Q
              q54e3w
              last edited by

              I can confirm pfbNG works fine with VLANs.

              1 Reply Last reply Reply Quote 0
              • R
                robatwork
                last edited by

                OK here's a strange occurrence…
                pfSense just upgraded to 2.3.2 but this behaviour happened with 2.2.1 on a physically different router.

                pfb version 2.1.1_4.

                On our LAN when we use google chrome (latest) and go to google it can take several seconds for google to display. Doing a search can take 20 seconds to respond, but it does come back eventually.

                On firefox or any other browser, internet access is instant, including identical searches on the same PC simultaneously.

                pfb is working OK when enabled ie blocking incoming and outgoing ipv4 correctly.

                When pfBlockerNG is disabled, searches and access on chrome become instant too, so something in pfBlocker is slowing down just chrome.
                This behaviour is consistent across different PCs on different versions of windows.

                I don't really have much idea what this can be, and logs aren't telling me much.

                tl;dr - chrome+pfblockerng = very slow. Firefox = fast. Turn off pfblocker =all browsers incl chrome fast

                1 Reply Last reply Reply Quote 0
                • T
                  tonymorella
                  last edited by

                  @robatwork:

                  OK here's a strange occurrence…
                  pfSense just upgraded to 2.3.2 but this behaviour happened with 2.2.1 on a physically different router.

                  pfb version 2.1.1_4.

                  On our LAN when we use google chrome (latest) and go to google it can take several seconds for google to display. Doing a search can take 20 seconds to respond, but it does come back eventually.

                  On firefox or any other browser, internet access is instant, including identical searches on the same PC simultaneously.

                  pfb is working OK when enabled ie blocking incoming and outgoing ipv4 correctly.

                  When pfBlockerNG is disabled, searches and access on chrome become instant too, so something in pfBlocker is slowing down just chrome.
                  This behaviour is consistent across different PCs on different versions of windows.

                  I don't really have much idea what this can be, and logs aren't telling me much.

                  tl;dr - chrome+pfblockerng = very slow. Firefox = fast. Turn off pfblocker =all browsers incl chrome fast

                  What block lists are you running?  Also, ctrl-shift-I to get into dev mode for both look at performance in FF and timeline in chrome, run them both and compare.

                  1 Reply Last reply Reply Quote 0
                  • R
                    robatwork
                    last edited by

                    @tonymorella:

                    What block lists are you running?  Also, ctrl-shift-I to get into dev mode for both look at performance in FF and timeline in chrome, run them both and compare.

                    Currently running top_v4 and top_v6 by selecting various countries in the Top 20.
                    Also 5 lists in IPv4 to block some social networking sites by AS number.
                    And DNSBL is enabled although I was testing the speed prior to this and I don't think it made any difference. TLD isn't ticked. All other options are default.

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @robatwork:

                      On our LAN when we use google chrome (latest) and go to google it can take several seconds for google to display. Doing a search can take 20 seconds to respond, but it does come back eventually.

                      You can open the Chrome cache viewer with this URL (Clear that and see if it helps):

                      chrome://net-internals/#dns
                      

                      Also ensure that the LAN devices only have pfSense as its DNS server.

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • R
                        robatwork
                        last edited by

                        @BBcan177:

                        @robatwork:

                        On our LAN when we use google chrome (latest) and go to google it can take several seconds for google to display. Doing a search can take 20 seconds to respond, but it does come back eventually.

                        You can open the Chrome cache viewer with this URL (Clear that and see if it helps):

                        chrome://net-internals/#dns
                        

                        Also ensure that the LAN devices only have pfSense as its DNS server.

                        Will try the cache clear, thanks.

                        However the LAN devices are all set with our domain servers as DNS servers. The DNS on the AD servers are all set to just have the pfsense as the only forwarder. pfSense has DNS Resolver only. I did just watch the last hangout about DNS and believe that I am setup OK with just resolver even though we are multi-WAN.  If you think I'd be better off with DNS forwarder instead please let me know.

                        Thanks for your help :)

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          @robatwork,

                          So to be clear, ensure that the LAN devices have only your AD DNS servers defined. Then set the AD DNS server DNS Forwarder settings to pfSense only…  This way DNSBL will filter the traffic.

                          The resolver can be in Resolver mode or in Forwarder mode....  I recommend Resolver mode....

                          If you are referring to the DNS Forwarder (dnsmasq), then DNSBL will not function, as its not configured for that.

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • R
                            robatwork
                            last edited by

                            @BBcan177:

                            @robatwork,

                            So to be clear, ensure that the LAN devices have only your AD DNS servers defined. Then set the AD DNS server DNS Forwarder settings to pfSense only…  This way DNSBL will filter the traffic.

                            The resolver can be in Resolver mode or in Forwarder mode....  I recommend Resolver mode....

                            That is exactly how we are configured (in Resolver mode). Testing continues….

                            1 Reply Last reply Reply Quote 0
                            • J
                              jim82
                              last edited by

                              Hi all,

                              Yesterday I added 4 new lists to DNSBL, see attachment 1.

                              Right after I added these new lists, my DNSBL Alerts/Log stopped working, and all blocks are now shown in the "DENY" log section. See attachment 2.

                              Can anyone shed light as to what I have done wrong?

                              Thanks

                              BR Jim

                              1.JPG
                              1.JPG_thumb
                              2.JPG
                              2.JPG_thumb

                              Best regards
                              Jim

                              Still learning, correct me if I'm wrong please.

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                Hi jim82,

                                In the DNSBL tab, only add DNSBL based feeds, the RW_IPBL is an IP based list that should be added to the IPv4 Tab.

                                Goto the General Tab, and enable Suppression and follow that with a Force Reload - All… This will remove any RFC1918 or loopback addresses that might be in a list. I am going to make this standard in the next release to avoid this issue...  The Deny alerts that you see are from the DNSBL_IP firewall rule. In DNSBL, you enabled the "DNSBL_IP" option which will collect and block any IP addresses that are found in a Domain based feed.

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jim82
                                  last edited by

                                  Thanks a lot for your swift reply! Should I remove the RW_IPBL list from DNSBL?

                                  BR Jim
                                  EDIT: I've now removed the list from DNSBL and added it to IPv4, is this the correct way of doing it?

                                  @BBcan177:

                                  Hi jim82,

                                  In the DNSBL tab, only add DNSBL based feeds, the RW_IPBL is an IP based list that should be added to the IPv4 Tab.

                                  Goto the General Tab, and enable Suppression and follow that with a Force Reload - All… This will remove any RFC1918 or loopback addresses that might be in a list. I am going to make this standard in the next release to avoid this issue...  The Deny alerts that you see are from the DNSBL_IP firewall rule. In DNSBL, you enabled the "DNSBL_IP" option which will collect and block any IP addresses that are found in a Domain based feed.

                                  Best regards
                                  Jim

                                  Still learning, correct me if I'm wrong please.

                                  1 Reply Last reply Reply Quote 0
                                  • QinnQ
                                    Qinn
                                    last edited by

                                    @RonpfS:

                                    The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.

                                    Just out of curiosity, is there any progress on this? I saw that MaxMind: Last-Modified: Tue, 02 Aug 2016 is still on August. Of course I could do a "php /usr/local/www/pfblockerng/pfblockerng.php dc", but everything is working fine (pfBlockerNG v2.1.1_4) so no need for it, as in ….if it ain't broke, than don't try to fix it ;)

                                    Cheers Qinn

                                    Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                    Firmware: Latest-stable-pfSense CE (amd64)
                                    Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                    1 Reply Last reply Reply Quote 0
                                    • V
                                      varazir
                                      last edited by

                                      Hello I keep getting this in the update log

                                      Could not open ISO

                                      UPDATE PROCESS START [ 10/09/16 10:30:37 ]
                                      
                                      ===[  DNSBL Process  ]================================================
                                      
                                      [ hphost_partial ]	 exists.
                                      [ mvps_hosts ]		 exists.
                                      [ SomeoneWhoCares ]	 exists.
                                      [ BBcan177 ]		 exists.
                                      [ DNSBL_IP ]		 Updating aliastable... 
                                        no changes.
                                        Total IP count = 1
                                      
                                      ===[  Continent Process  ]============================================
                                      
                                      Could not open ISO [ SH_v4 ]
                                      
                                      [ pfB_Africa_v4 ]	 exists.
                                      Could not open ISO [ AP_v4 ]
                                      
                                      Could not open ISO [ CX_v4 ]
                                      
                                      Could not open ISO [ CC_v4 ]
                                      
                                      [ pfB_Asia_v4 ]		 exists. [ 10/09/16 10:30:38 ]
                                      Could not open ISO [ PN_v4 ]
                                      
                                      [ pfB_Oceania_v4 ]	 exists.
                                      [ pfB_SAmerica_v4 ]	 exists.
                                      [ pfB_Top_v4 ]		 exists.
                                      [ pfB_Top_v6 ]		 exists. [ 10/09/16 10:30:42 ]
                                      [ pfB_PS_v4 ]		 exists.
                                      
                                      ===[  IPv4 Process  ]=================================================
                                      
                                      ===[  IPv6 Process  ]=================================================
                                      
                                      ===[  Aliastables / Rules  ]==========================================
                                      
                                      No changes to Firewall rules, skipping Filter Reload
                                      No Changes to Aliases, Skipping pfctl Update
                                      
                                       UPDATE PROCESS ENDED [ 10/09/16 10:30:43 ]
                                      
                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        @varazir:

                                        Could not open ISO [ SH_v4 ]
                                        Could not open ISO [ AP_v4 ]
                                        Could not open ISO [ CX_v4 ]
                                        Could not open ISO [ CC_v4 ]
                                        Could not open ISO [ PN_v4 ]

                                        Yes this is an issue with the MaxMind monthly database changes not reporting on some GeoIPs… I have a fix for this which will be in the next release which will add a "placeholder" for all GeoIPs regardless if they are not defined by MaxMind...  Just ignore for the time being...

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          @jim82:

                                          Thanks a lot for your swift reply! Should I remove the RW_IPBL list from DNSBL?
                                          EDIT: I've now removed the list from DNSBL and added it to IPv4, is this the correct way of doing it?

                                          Yes… remove from DNSBL and Add the RW_IPBL to the IPv4 tab...

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            @Qinn:

                                            Just out of curiosity, is there any progress on this? I saw that MaxMind: Last-Modified: Tue, 02 Aug 2016 is still on August. Of course I could do a "php /usr/local/www/pfblockerng/pfblockerng.php dc", but everything is working fine (pfBlockerNG v2.1.1_4) so no need for it, as in ….if it ain't broke, than don't try to fix it ;)

                                            Do you have any MaxMind update errors in  /var/log/pfblockerng/geoip.log?

                                            I would manually run the update and see if it reports any errors…

                                            php /usr/local/www/pfblockerng/pfblockerng.php dc
                                            

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.