PfBlockerNG v2.0 w/DNSBL

xbipin · Oct 25, 2016, 1:11 PM

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

blueduckdock · Oct 25, 2016, 5:40 PM

@xbipin:

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

You could put those hosts on a separate interface. I would think that'd be easy enough.

xbipin · Oct 26, 2016, 6:16 AM

@blueduckdock:

@xbipin:

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

You could put those hosts on a separate interface. I would think that'd be easy enough.

well we have a small LAN and creating separate interfaces using vlans would be some what of a overkill.
if unbound could serve DNS queries per host that would solve this as i believe it would be a very useful feature and many would be interested in.

gcu_greyarea · Oct 26, 2016, 11:57 AM

You could Configure your DHCP server and specify the DNS option as external DNS server e.g. Google DNS.
For the small number if hosts you need to filter create a static DHCP Mapping(Reservation) and specify the unbound DNS server on the LAN Address.
Create an IP alias for these hosts and create a firewall rule to stop them acciessing any other DNS servers.

Obviously this creates a problem when all hosts must use the unbound resolver.

Other options would be - running a few virtual instances of pfSense -each with their own DnS resolver and DNSBLs. Then specify custom DNS servers via DHCP mappings.

xbipin · Oct 26, 2016, 12:58 PM

we currently block external DNS access from LAN and force every1 to use unbound and i guess unbound config doesnt mention any option to filter dns per host or probably run multiple instances of it which would seem like a more easier option without the complexities do multiple other things for same effect.

cyber roam i guess does this dns filtering per host so curious on how do they achieve it as many other ppl in my region use that just for the purpose of blocking certain domains per host

BBcan177 · Oct 29, 2016, 4:46 PM

There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....

xbipin · Oct 30, 2016, 5:14 AM

@BBcan177:

There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....

thanks for the info, is there any such feature request at unbound side or probably any plans to add it in the future?

pfBasic · Nov 3, 2016, 4:45 AM

I just ran into an issue and wanted to put it out here.

I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.

I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".

Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.

BBcan177 · Nov 4, 2016, 12:47 AM

@pfBasic:

I just ran into an issue and wanted to put it out here.

I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.

I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".

Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.

Best to submit this to Stop Forum Spam.

hulleyrob · Nov 6, 2016, 6:02 PM

Is anyone else seeing this lately after a cron?

There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]:

Has only started happening in the last few weeks.

Some googling suggested setting NIC speed manually from auto.

If anyone has got any other ideas please post.

Thanks

Rob

BBcan177 · Nov 7, 2016, 4:15 AM

Looks like a bad aliastable possibly. Try a Force reload and/or a reboot.

Check the pfblockerng.log and system logs for further clues. If you hover over the Firewall rules, do you get the aliastable popup? Could also be unrelated to the package. You could temporarily disable the package and see if it re occurs.

hulleyrob · Nov 7, 2016, 1:21 PM

Ok thanks for that does this look ok as it is the only alias that didn't look right to me?

It only seemed to appear after i ticked de-duplication is it.

Rob

![Screen Shot 2016-11-07 at 13.19.46.jpg](/public/imported_attachments/1/Screen Shot 2016-11-07 at 13.19.46.jpg)
![Screen Shot 2016-11-07 at 13.19.46.jpg_thumb](/public/imported_attachments/1/Screen Shot 2016-11-07 at 13.19.46.jpg_thumb)

BBcan177 · Nov 8, 2016, 4:15 AM

That is used for the IP Suppression… Its ok as is...

erwintwr · Nov 10, 2016, 8:26 AM

Hi guys

i am busy running a test server where i plan to simulate our current Squid+squidguard setup, but add DNSBL to it.

one think i note is that some ad's are still getting through ( comparing with AdBlock on chrome)

Is it possible to load an AdBlock list ( and from where?) , so that user experience is similar to having AdBlock extension activate?

Thx

pfBasic · Nov 11, 2016, 6:24 AM

It looks like I got one thing working on my setup but killed DNSBL in the process.

I recently setup policy based routing where my pass firewall rules determine the Gateway to be used. I did this so that I could have one interface route all traffic through my VPN client and another interface not utilize the VPN at all. That works great, but ever since I set that up I have 0 hits on all of my DNSBL feeds and ads are coming through.

Any ideas on how I can use pfBlockerNG DNSBL while still utilizing policy based routing for my purposes?

XmickS · Nov 14, 2016, 9:19 PM

My DNSBL has stopped working. When I do a Fprce Update, I get this in the log

------------------------------------------
Assembling database... completed
Validating database... completed
Reloading Unbound... Failed to Reload... Restoring previous database.... Not completed.

*** DNSBL update [ 0 ] [ 8654 ] ... OUT OF SYNC ! ***
------------------------------------------

When I execute "Shell Output - unbound-control -c /var/unbound/unbound.conf status"
I get this:

error: SSL handshake failed
34386131464:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/builder/pfsense-232/tmp/FreeBSD-src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1191:

I've just uninstalled PfBlockerNG and after that a reboot, but it still persists. Any ideas?

laviniuc · Nov 23, 2016, 12:32 PM

the cron/reload/update job stalls for me. no error, just stops at dnsbl. works if i disable alexa whitelist or if i stop the dnsbl component. anyone else having this problem?

BBcan177 · Nov 23, 2016, 2:59 PM

@laviniuc:

the cron/reload/update job stalls for me. no error, just stops at dnsbl. works if i disable alexa whitelist or if i stop the dnsbl component. anyone else having this problem?

It might be related to Alexa retiring its TOP1M feed… They have since restored the feed, but uncertain of its ultimate fate...

https://twitter.com/adamcaudill/status/800813805009768448
https://twitter.com/Alexa_Support/status/801167423726489600

I would try the following and see if it fixes this issue:

mv /var/db/pfblockerng/top-1m.csv /var/db/pfblockerng/top-1m.csv.old

Then run a "Force Reload" and see if it re-downloads the Alexa Archive and rebuilds the Alexa whitelist…

As reference, the Alexa TOP1M feed url:

https://s3.amazonaws.com/alexa-static/top-1m.csv.zip

laviniuc · Nov 23, 2016, 5:11 PM

@BBcan177:

@laviniuc:

the cron/reload/update job stalls for me. no error, just stops at dnsbl. works if i disable alexa whitelist or if i stop the dnsbl component. anyone else having this problem?

It might be related to Alexa retiring its TOP1M feed… They have since restored the feed, but uncertain of its ultimate fate...

https://twitter.com/adamcaudill/status/800813805009768448
https://twitter.com/Alexa_Support/status/801167423726489600

I would try the following and see if it fixes this issue:
mv /var/db/pfblockerng/top-1m.csv /var/db/pfblockerng/top-1m.csv.old
Then run a "Force Reload" and see if it re-downloads the Alexa Archive and rebuilds the Alexa whitelist…

As reference, the Alexa TOP1M feed url:
https://s3.amazonaws.com/alexa-static/top-1m.csv.zip

thanks, much obliged, it works perfectly now. i'll keep on the lookout for if they drop the feed again… maybe you could check if anything weird happens on the import code if the url can't be found? before i stopped the import / disabled dnsbl it was stalling the cpu/dns resolver (guessing weird things happened when the first import took as long as the refresh timeout and then the second import started wihtout the first one completing?)

TomT · Dec 1, 2016, 11:28 AM

Hi
I've just installed pfBlockerNG 2.1.1_4 on a test pfSense install.

I've enabled it and then gone to update.
I've selected the option to reload but nothing is downloaded.

Checking /var/db/aliastables there is nothing showing.
Can anyone point me in the right direction ?

 UPDATE PROCESS START [ 12/01/16 11:26:27 ]

Clearing all DNSBL Feeds... 
** DNSBL Disabled **

===[  Continent Process  ]============================================

===[  IPv4 Process  ]=================================================

===[  IPv6 Process  ]=================================================

===[  Aliastables / Rules  ]==========================================

No changes to Firewall rules, skipping Filter Reload
No Changes to Aliases, Skipping pfctl Update

 UPDATE PROCESS ENDED

Thanks