PfBlockerNG v2.0 w/DNSBL

robatwork · Sep 28, 2016, 11:08 AM

@robatwork,

So to be clear, ensure that the LAN devices have only your AD DNS servers defined. Then set the AD DNS server DNS Forwarder settings to pfSense only… This way DNSBL will filter the traffic.

The resolver can be in Resolver mode or in Forwarder mode.... I recommend Resolver mode....

That is exactly how we are configured (in Resolver mode). Testing continues….

jim82 · Sep 29, 2016, 3:49 PM

Hi all,

Yesterday I added 4 new lists to DNSBL, see attachment 1.

Right after I added these new lists, my DNSBL Alerts/Log stopped working, and all blocks are now shown in the "DENY" log section. See attachment 2.

Can anyone shed light as to what I have done wrong?

Thanks

BR Jim

BBcan177 · Sep 29, 2016, 4:31 PM

Hi jim82,

In the DNSBL tab, only add DNSBL based feeds, the RW_IPBL is an IP based list that should be added to the IPv4 Tab.

Goto the General Tab, and enable Suppression and follow that with a Force Reload - All… This will remove any RFC1918 or loopback addresses that might be in a list. I am going to make this standard in the next release to avoid this issue... The Deny alerts that you see are from the DNSBL_IP firewall rule. In DNSBL, you enabled the "DNSBL_IP" option which will collect and block any IP addresses that are found in a Domain based feed.

jim82 · Sep 29, 2016, 5:14 PM

Thanks a lot for your swift reply! Should I remove the RW_IPBL list from DNSBL?

BR Jim
EDIT: I've now removed the list from DNSBL and added it to IPv4, is this the correct way of doing it?

@BBcan177:

Hi jim82,

In the DNSBL tab, only add DNSBL based feeds, the RW_IPBL is an IP based list that should be added to the IPv4 Tab.

Goto the General Tab, and enable Suppression and follow that with a Force Reload - All… This will remove any RFC1918 or loopback addresses that might be in a list. I am going to make this standard in the next release to avoid this issue... The Deny alerts that you see are from the DNSBL_IP firewall rule. In DNSBL, you enabled the "DNSBL_IP" option which will collect and block any IP addresses that are found in a Domain based feed.

Qinn · Oct 2, 2016, 12:31 PM

@RonpfS:

The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.

Just out of curiosity, is there any progress on this? I saw that MaxMind: Last-Modified: Tue, 02 Aug 2016 is still on August. Of course I could do a "php /usr/local/www/pfblockerng/pfblockerng.php dc", but everything is working fine (pfBlockerNG v2.1.1_4) so no need for it, as in ….if it ain't broke, than don't try to fix it ;)

Cheers Qinn

varazir · Oct 9, 2016, 8:33 AM

Hello I keep getting this in the update log

Could not open ISO

UPDATE PROCESS START [ 10/09/16 10:30:37 ]

===[  DNSBL Process  ]================================================

[ hphost_partial ]	 exists.
[ mvps_hosts ]		 exists.
[ SomeoneWhoCares ]	 exists.
[ BBcan177 ]		 exists.
[ DNSBL_IP ]		 Updating aliastable... 
  no changes.
  Total IP count = 1

===[  Continent Process  ]============================================

Could not open ISO [ SH_v4 ]

[ pfB_Africa_v4 ]	 exists.
Could not open ISO [ AP_v4 ]

Could not open ISO [ CX_v4 ]

Could not open ISO [ CC_v4 ]

[ pfB_Asia_v4 ]		 exists. [ 10/09/16 10:30:38 ]
Could not open ISO [ PN_v4 ]

[ pfB_Oceania_v4 ]	 exists.
[ pfB_SAmerica_v4 ]	 exists.
[ pfB_Top_v4 ]		 exists.
[ pfB_Top_v6 ]		 exists. [ 10/09/16 10:30:42 ]
[ pfB_PS_v4 ]		 exists.

===[  IPv4 Process  ]=================================================

===[  IPv6 Process  ]=================================================

===[  Aliastables / Rules  ]==========================================

No changes to Firewall rules, skipping Filter Reload
No Changes to Aliases, Skipping pfctl Update

 UPDATE PROCESS ENDED [ 10/09/16 10:30:43 ]

BBcan177 · Oct 10, 2016, 4:17 AM

@varazir:

Could not open ISO [ SH_v4 ]
Could not open ISO [ AP_v4 ]
Could not open ISO [ CX_v4 ]
Could not open ISO [ CC_v4 ]
Could not open ISO [ PN_v4 ]

Yes this is an issue with the MaxMind monthly database changes not reporting on some GeoIPs… I have a fix for this which will be in the next release which will add a "placeholder" for all GeoIPs regardless if they are not defined by MaxMind... Just ignore for the time being...

BBcan177 · Oct 10, 2016, 4:18 AM

@jim82:

Thanks a lot for your swift reply! Should I remove the RW_IPBL list from DNSBL?
EDIT: I've now removed the list from DNSBL and added it to IPv4, is this the correct way of doing it?

Yes… remove from DNSBL and Add the RW_IPBL to the IPv4 tab...

BBcan177 · Oct 10, 2016, 4:20 AM

@Qinn:

Just out of curiosity, is there any progress on this? I saw that MaxMind: Last-Modified: Tue, 02 Aug 2016 is still on August. Of course I could do a "php /usr/local/www/pfblockerng/pfblockerng.php dc", but everything is working fine (pfBlockerNG v2.1.1_4) so no need for it, as in ….if it ain't broke, than don't try to fix it ;)

Do you have any MaxMind update errors in /var/log/pfblockerng/geoip.log?

I would manually run the update and see if it reports any errors…

php /usr/local/www/pfblockerng/pfblockerng.php dc

regne · Oct 10, 2016, 8:27 PM

Hi.

I keep watching in the general system log entries like this:
*nginx: 2016/10/10 19:04:39 [error] 23499#100098: 737 open() "/usr/local/www/utsync.ashx" failed (2: No such file or directory),client: 10.10.10.1, server: , request: "GET /utsync.ashx?eid=50052&et=0&fp=2X9bJ6tnRz5B2L0llgZVTWayaMg4TcNYwOj-CDyEPl1k&return=http%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP/1.1", host: "ml314.com", referrer: "http://viraliq.com/15-musicians-didnt-know-passed?utm_source=revcontent&utm_medium=referral&utm_campaign=desktop&utm_content_id=996712&utm_boost_id=116872&utm_targeting=editorial%20news&utm_widget_id=31653"

I understand that DNSBL has successfully diverted the DNS petition to server 10.10.10.1 and the requested file is not there but is, logging these messages, the right behavior?

Is there a way to disable them?. They are populating the system logs and hiding important stuff.

erwintwr · Oct 11, 2016, 7:13 AM

just wanted to give a personal thank you to bbcan for his committed FREE support on this amazing addon.

you sir are a legend :)

Qinn · Oct 15, 2016, 7:50 AM

@BBcan177:

@Qinn:

Just out of curiosity, is there any progress on this? I saw that MaxMind: Last-Modified: Tue, 02 Aug 2016 is still on August. Of course I could do a "php /usr/local/www/pfblockerng/pfblockerng.php dc", but everything is working fine (pfBlockerNG v2.1.1_4) so no need for it, as in ….if it ain't broke, than don't try to fix it ;)

Do you have any MaxMind update errors in /var/log/pfblockerng/geoip.log?

I would manually run the update and see if it reports any errors…
php /usr/local/www/pfblockerng/pfblockerng.php dc

I encoutered no errors, so no log file. Btw I am on a APU2C4, 2.3.2-RELEASE-p1 (amd64) and pfBlockerNG 2.1.1_4

gcu_greyarea · Oct 22, 2016, 6:27 AM

pfBlockerNG on Bridge

Just wondering if anybody else has seen this.

I run a Bridged Setup (WAN-LAN) and have setup the Management IP on the Bridge Interface (192.168.15.215). This Interface also listens on other ports (OpenVPN , NTP) including 53 for unbound.

DNSBL listens on the default ports and the VIP is 192.168.15.216. I know that ideally this would be a different net, but DNSBL appears to work fine.

I do get strange DNSBL Log entries which I do not understand:
e.g.
DNSBL Recject,Oct 22 16:09:42,192.168.15.216,192.168.15.1, | / |

The pfBlcokerNG Alerts Tab shows the same entry with "No Match" . i.e. unable to determine which DNSBL Feed triggered the "Reject"

Ip Address 192.168.15.1 is the gateway (an ISP Provided router I cannot replace). I don't know why 192.168.15.1 would want to contact the DNSBL VIP?

gcu_greyarea · Oct 23, 2016, 9:53 AM

I was able to narrow down the issue through further testing.

The log entry and its assorted Alert ("No Match") …

DNSBL Recject,Oct 22 16:09:42,192.168.15.216,192.168.15.1, | / |

... can be reproduced by manually testing the DNSBL VIP Ports. e.g. http://vip-ip:80 (8081) . The error is generated for both https and https on ports (80, 8081, 443, 8433)

As it turns out our ISP Provided router wants to connect to the DNSBL VIP IP via port 80 (Seen via packet capture)...
Since WAN and LAN Interfaces are Bridged and filtering is done on the Bridge IF I have no way of blocking the Routers connection attempts...

blueduckdock · Oct 24, 2016, 7:36 PM

Quick Q- in the sync section there is "Sync to configured backup server." Is this for CARP installs?
I'd like to have my HQ box sync not only to the other carp member but also our regional offices. Wondering if/how this works.

xbipin · Oct 25, 2016, 1:11 PM

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

blueduckdock · Oct 25, 2016, 5:40 PM

@xbipin:

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

You could put those hosts on a separate interface. I would think that'd be easy enough.

xbipin · Oct 26, 2016, 6:16 AM

@blueduckdock:

@xbipin:

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

You could put those hosts on a separate interface. I would think that'd be easy enough.

well we have a small LAN and creating separate interfaces using vlans would be some what of a overkill.
if unbound could serve DNS queries per host that would solve this as i believe it would be a very useful feature and many would be interested in.

gcu_greyarea · Oct 26, 2016, 11:57 AM

You could Configure your DHCP server and specify the DNS option as external DNS server e.g. Google DNS.
For the small number if hosts you need to filter create a static DHCP Mapping(Reservation) and specify the unbound DNS server on the LAN Address.
Create an IP alias for these hosts and create a firewall rule to stop them acciessing any other DNS servers.

Obviously this creates a problem when all hosts must use the unbound resolver.

Other options would be - running a few virtual instances of pfSense -each with their own DnS resolver and DNSBLs. Then specify custom DNS servers via DHCP mappings.

xbipin · Oct 26, 2016, 12:58 PM

we currently block external DNS access from LAN and force every1 to use unbound and i guess unbound config doesnt mention any option to filter dns per host or probably run multiple instances of it which would seem like a more easier option without the complexities do multiple other things for same effect.

cyber roam i guess does this dns filtering per host so curious on how do they achieve it as many other ppl in my region use that just for the purpose of blocking certain domains per host