Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • X
        xbipin
        last edited by

        @BBcan177:

        There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....

        thanks for the info, is there any such feature request at unbound side or probably any plans to add it in the future?

        1 Reply Last reply Reply Quote 0
        • P
          pfBasic Banned
          last edited by

          I just ran into an issue and wanted to put it out here.

          I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.

          I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".

          Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @pfBasic:

            I just ran into an issue and wanted to put it out here.

            I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.

            I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".

            Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.

            Best to submit this to Stop Forum Spam.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • H
              hulleyrob
              last edited by

              Is anyone else seeing this lately after a cron?

              There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]:

              Has only started happening in the last few weeks.

              Some googling suggested setting NIC speed manually from auto.

              If anyone has got any other ideas please post.

              Thanks

              Rob

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                Looks like a bad aliastable possibly. Try a Force reload and/or a reboot.

                Check the pfblockerng.log and system logs for further clues. If you hover over the Firewall rules, do you get the aliastable popup? Could also be unrelated to the package. You could temporarily disable the package and see if it re occurs.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • H
                  hulleyrob
                  last edited by

                  Ok thanks for that does this look ok as it is the only alias that didn't look right to me?

                  It only seemed to appear after i ticked de-duplication is it.

                  Rob

                  ![Screen Shot 2016-11-07 at 13.19.46.jpg](/public/imported_attachments/1/Screen Shot 2016-11-07 at 13.19.46.jpg)
                  ![Screen Shot 2016-11-07 at 13.19.46.jpg_thumb](/public/imported_attachments/1/Screen Shot 2016-11-07 at 13.19.46.jpg_thumb)

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    That is used for the IP Suppression… Its ok as is...

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • E
                      erwintwr
                      last edited by

                      Hi guys

                      i am busy running a test server where i plan to simulate our current Squid+squidguard setup, but add DNSBL to it.

                      one think i note is that some ad's are still getting through ( comparing with AdBlock on chrome)

                      Is it possible to load an AdBlock list ( and from where?) , so that user experience is similar to having AdBlock extension activate?

                      Thx

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfBasic Banned
                        last edited by

                        It looks like I got one thing working on my setup but killed DNSBL in the process.

                        I recently setup policy based routing where my pass firewall rules determine the Gateway to be used. I did this so that I could have one interface route all traffic through my VPN client and another interface not utilize the VPN at all. That works great, but ever since I set that up I have 0 hits on all of my DNSBL feeds and ads are coming through.

                        Any ideas on how I can use pfBlockerNG DNSBL while still utilizing policy based routing for my purposes?

                        1 Reply Last reply Reply Quote 0
                        • X
                          XmickS
                          last edited by

                          My DNSBL has stopped working. When I do a Fprce Update, I get this in the log

                          ------------------------------------------
                          Assembling database... completed
                          Validating database... completed
                          Reloading Unbound... Failed to Reload... Restoring previous database.... Not completed.
                          
                          *** DNSBL update [ 0 ] [ 8654 ] ... OUT OF SYNC ! ***
                          ------------------------------------------
                          

                          When I execute "Shell Output - unbound-control -c /var/unbound/unbound.conf status"
                          I get this:

                          error: SSL handshake failed
                          34386131464:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/builder/pfsense-232/tmp/FreeBSD-src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1191:
                          

                          I've just uninstalled PfBlockerNG and after that a reboot, but it still persists. Any ideas?

                          1 Reply Last reply Reply Quote 0
                          • L
                            laviniuc
                            last edited by

                            the cron/reload/update job stalls for me. no error, just stops at dnsbl. works if i disable alexa whitelist or if i stop the dnsbl component. anyone else having this problem?

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              @laviniuc:

                              the cron/reload/update job stalls for me. no error, just stops at dnsbl. works if i disable alexa whitelist or if i stop the dnsbl component. anyone else having this problem?

                              It might be related to Alexa retiring its TOP1M feed… They have since restored the feed, but uncertain of its ultimate fate...

                              https://twitter.com/adamcaudill/status/800813805009768448
                              https://twitter.com/Alexa_Support/status/801167423726489600

                              I would try the following and see if it fixes this issue:

                              mv /var/db/pfblockerng/top-1m.csv /var/db/pfblockerng/top-1m.csv.old
                              

                              Then run a "Force Reload" and see if it re-downloads the Alexa Archive and rebuilds the Alexa whitelist…

                              As reference, the Alexa TOP1M feed url:

                              https://s3.amazonaws.com/alexa-static/top-1m.csv.zip
                              

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • L
                                laviniuc
                                last edited by

                                @BBcan177:

                                @laviniuc:

                                the cron/reload/update job stalls for me. no error, just stops at dnsbl. works if i disable alexa whitelist or if i stop the dnsbl component. anyone else having this problem?

                                It might be related to Alexa retiring its TOP1M feed… They have since restored the feed, but uncertain of its ultimate fate...

                                https://twitter.com/adamcaudill/status/800813805009768448
                                https://twitter.com/Alexa_Support/status/801167423726489600

                                I would try the following and see if it fixes this issue:

                                mv /var/db/pfblockerng/top-1m.csv /var/db/pfblockerng/top-1m.csv.old
                                

                                Then run a "Force Reload" and see if it re-downloads the Alexa Archive and rebuilds the Alexa whitelist…

                                As reference, the Alexa TOP1M feed url:

                                https://s3.amazonaws.com/alexa-static/top-1m.csv.zip
                                

                                thanks, much obliged, it works perfectly now. i'll keep on the lookout for if they drop the feed again… maybe you could check if anything weird happens on the import code if the url can't be found? before i stopped the import / disabled dnsbl it was stalling the cpu/dns resolver (guessing weird things happened when the first import took as long as the refresh timeout and then the second import started wihtout the first one completing?)

                                1 Reply Last reply Reply Quote 0
                                • T
                                  TomT
                                  last edited by

                                  Hi
                                  I've just installed pfBlockerNG 2.1.1_4 on a test pfSense install.

                                  I've enabled it and then gone to update.
                                  I've selected the option to reload but nothing is downloaded.

                                  Checking /var/db/aliastables there is nothing showing.
                                  Can anyone point me in the right direction ?

                                   UPDATE PROCESS START [ 12/01/16 11:26:27 ]
                                  
                                  Clearing all DNSBL Feeds... 
                                  ** DNSBL Disabled **
                                  
                                  ===[  Continent Process  ]============================================
                                  
                                  ===[  IPv4 Process  ]=================================================
                                  
                                  ===[  IPv6 Process  ]=================================================
                                  
                                  ===[  Aliastables / Rules  ]==========================================
                                  
                                  No changes to Firewall rules, skipping Filter Reload
                                  No Changes to Aliases, Skipping pfctl Update
                                  
                                   UPDATE PROCESS ENDED
                                  

                                  Thanks

                                  1 Reply Last reply Reply Quote 0
                                  • RonpfSR
                                    RonpfS
                                    last edited by

                                    Did you define any tables ?

                                    2.4.5-RELEASE-p1 (amd64)
                                    Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                    Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      DigitalJer
                                      last edited by

                                      Is it possible to use an alternative list, such as:

                                      https://blog.majestic.com/development/alexa-top-1-million-sites-retired-heres-majestic-million/

                                      –------------------------------------------------
                                      2.4.3-RELEASE (amd64)
                                      built on Mon Mar 26 18:02:04 CDT 2018
                                      FreeBSD 11.1-RELEASE-p7
                                      VM in ESXi 5.5
                                      1 x 1000baseTX (WAN)
                                      1 x 1000baseTX (LAN)

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        BoxMacNCheese
                                        last edited by

                                        @tonymorella:

                                        @Atlan:

                                        I am receiving certificate invalid errors after enabling the DNSBL when navigating certain sites - so far the culprit seems to mainly be googleads.g.doubleclick.net when trying to serve content over an HTTPS enabled website.

                                        The attempt still shows in the Alerts tab of pfBlockerNG, the main site still loads, but it seems to be wanting to use the firewall's self signed certificate as the certificate for the ad server host.

                                        Did I miss a setting somewhere to prevent this from happening?

                                        Ya ran into the same problem while beta testing, completely forgot about this issue until I read your post :) For a quick fix I created a CA and web certificate via pfsense GUI then copies this cert to /var/unbound/dnsbl_cert.pem which dnsbl light http will use.  Then push out the CA to all the desktops, could be done via GPO or login scripts. With https://letsencrypt.org/ picking up traction, everything is going to be running over TLS or SSL soon going to have to implement this type of fix.

                                        **EDIT: Sorry guys did a bad job on this post and what I was doing, it does not fix the underlying issue with the TLS stream being bad because the cert is not valid, reggie14 did a much better job testing this than I. In my setup is simply helped limit the errors in Chrome. Again just a quick fix that might help. Again sorry for the confusion.

                                        FYI the update from Chrome 45 to 46 made a difference in what come up under security warnings:
                                        http://arstechnica.com/information-technology/2015/10/chrome-finally-kills-off-the-http-https-mixed-content-warning/**

                                        Thanks
                                        Tony M

                                        I am new to pfsense and new to this forum. I do not tend to go digging up the past but was there any conclusion to the https page errors received while using DNSBL? I initially scrapped my setup of squidguard due to its failure to even pass through to HTTPS sites. Now the DNSBL is working adequately but if I am to block certain domains (such as www.yahoo.com), I receive an insecure connection error on my browser instead of the 1x1 pixel error page. Is there a way for me to get rid of this error? Or is there a way to potentially redirect this https domain being blocked to an internal webpage?

                                        Also if this is in the wrong section or if this has already been answered I apologize in advance.

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          @Knyte:

                                          Is it possible to use an alternative list, such as:

                                          https://blog.majestic.com/development/alexa-top-1-million-sites-retired-heres-majestic-million/

                                          Alexa has re-instated the Alexa Top1M Feed, not sure if/when they will discontinue it again….
                                              https://twitter.com/Alexa_Support/status/801167423726489600

                                          However, Cisco has recently released an alternative TOP1M version:
                                              https://blog.opendns.com/2016/12/14/cisco-umbrella-1-million/

                                          I will be adding this to the next release as an alternative option to the package...

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            @BoxMacNCheese:

                                            …https page errors received while using DNSBL?

                                            Usually this occurs with Safari Browsers only… I don't know of any workarounds, except for whitelisting those domains that are causing this behaviour...

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.