PfBlockerNG v2.0 w/DNSBL

RonpfS · Feb 3, 2017, 8:12 PM

@doktornotor:

LOL, ok… https://redmine.pfsense.org/issues/7203

Maybe just add "Legend : "

doktornotor · Feb 3, 2017, 8:22 PM

@RonpfS:

@doktornotor:

LOL, ok… https://redmine.pfsense.org/issues/7203

Maybe just add "Legend : "

Yeah I tried and that looked even worse than now. Leaving this to someone else.

Redyr · Feb 8, 2017, 12:48 PM

Hello,

Regarding Adaway,

https://adaway.org/hosts.txt

Although the list is downloaded:

[ Adaway ] Downloading update .. 200 OK. completed ..

I got this error:

[ pfB_Adaway Adaway ] List Error ]

Please advise

BBcan177 · Feb 8, 2017, 12:57 PM

I assume that Adaway is also the name of the Alias?

Do you have anything in the custom list at the bottom of this alias? I think that's the part that's not parsing properly. Anything in a custom list must be formatted properly.

Redyr · Feb 8, 2017, 4:03 PM

@BBcan177:

I assume that Adaway is also the name of the Alias?

Do you have anything in the custom list at the bottom of this alias? I think that's the part that's not parsing properly. Anything in a custom list must be formatted properly.

The name of the alias is Adaway, and I don't have anything in the custom list.

I've changed the name of the alias, and the label like this:

Adaway_list ] Downloading update .. 200 OK. completed ..
[ pfB_Adaway1 Adaway_list ] List Error ]

BBcan177 · Feb 8, 2017, 4:13 PM

It looks like you added this list to the IPv4 tab when it's a domain based list and should only be used in the DNSBL tab.

Redyr · Feb 8, 2017, 6:17 PM

@BBcan177:

It looks like you added this list to the IPv4 tab when it's a domain based list and should only be used in the DNSBL tab.

I removed it from IPV4, sorry to bother you with this.

Thank you

yodaphone · Feb 21, 2017, 1:25 AM

@BBcan177:

Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)

Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"

malc0de
https://malc0de.com/bl/BOOT

I get this error for malc0de. all other lists are fine

[ DNSBL_Malicious - malc0de ] Download FAIL [ 02/21/17 01:21:47 ]
Firewall and/or IDS are not blocking download.

Set up exactly the way you have described.

I'm on 2.3.3 RC

BBcan177 · Feb 21, 2017, 3:14 PM

@yodaphone:

I get this error for malc0de. all other lists are fine

[ DNSBL_Malicious - malc0de ] Download FAIL [ 02/21/17 01:21:47 ]
Firewall and/or IDS are not blocking download.

Not having any issues with that feed… Try to

ping malc0de.com

and see if it responds… Check the Alerts Tab to see if any alerts get reported... Could be Snort/Suricata, or another Firewall rule....

HeatmiserNYC · Feb 26, 2017, 11:39 PM

Hey BBCAN,
Is there a way to get Reek's anti-adblocking list to work under Pfblocker? This would be extremely convenient.

My apologies if this has been asked a trillion times before….

BBcan177 · Feb 27, 2017, 12:45 AM

@HeatmiserNYC:

Is there a way to get Reek's anti-adblocking list to work under Pfblocker? This would be extremely convenient

Unfortunately not. DNSBL can't manipulate the browser except for sinkholing the DNS request.

Brutos · Mar 2, 2017, 10:41 AM

Does anyone have a good list for blocking porn sites please?b

I have google and searched and cant find any.

pfBasic · Mar 2, 2017, 3:06 PM

@Brutos:

Does anyone have a good list for blocking porn sites please?b

I have google and searched and cant find any.

https://forum.pfsense.org/index.php?topic=125863.0

D0X · Mar 26, 2017, 2:24 PM

@BBcan177:

@D0X:

Thanks for your support so far, but for now I've given up on pfblockerng. Not that the package is flawed, but Safari on OSX and IOS is driving me nuts.

NP…. Should you decide to pick it backup at some point, try to see why the Ping/Browse to the DNSBL VIP wasn't working. That will cause issues on its own.... also since it was one Domain that was predominantly causing issues, you could also Whitelist it...

Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

BBcan177 · Mar 26, 2017, 3:59 PM

@D0X:

Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

Is this with Safari, or all other browsers?

Can you review this link:
https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099

Guest · Mar 26, 2017, 4:41 PM

Does anyone have a good list for blocking porn sites please?b

There are more options to get better results and for porn sites an OpenDNS account might be a good solution as well!
Squid & SquidGuard or DansGuardian plus pfBlockerNG & DNSBL plus an OpenDNS account

D0X · Mar 26, 2017, 5:24 PM

@BBcan177:

@D0X:

Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

Is this with Safari, or all other browsers?

Can you review this link:
https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099

Safari indeed, on all devices, moving to another browser is not an option here. Doing the mod you suggested, no logging whatsoever will work?

Running Pi-Hole here for a few days now, as an alternative. But this means adding another box to my network. Plus the config is a little weird (pfSense DCHP server forwarding Pi-Hole dns address to clients, clients using Pi-Hole and Pi-Hole using the pfSense DNS Resolver again as its upstream DNS, don't know, feels weird).

BBcan177 · Mar 26, 2017, 5:32 PM

Both solutions use Lighttpd and both push a 1x1 pix. Strange that it doesn't show any cert errors… Will have to do some digging...

In the link, there is another option to drop just the HTTPS alerts with a firewall rule.

n3by · Mar 26, 2017, 6:32 PM

pihole it use only http, not https ( because of that on https you have error with site incorrect configured…).

TyphooN · Apr 5, 2017, 2:18 AM

I have been banging my head against the desk for almost a month now and have not been able to find a way to get either of my 2 pfSense VMs (vmware esxi host) to remain stable for ~12 hours with DNSBL enabled while using feeds that were on the first few pages of this forum post. Issues that I tend to have, sometimes as little as a few hours of uptime.. sometimes around 12-20 hours. I have been using pfblockerng for quite some time using the traditional ipv4 blocklists with no problems. Only after I have enabled DNSBL, and added several feeds have I had these symptoms:

The Web GUI becomes unresponsive
Unbound becomes unresponsive, leading to DNS being unable to resolve for clients
The console is unresponsive
DHCPD stops functioning
Less frequently than the above symptoms, routing stops all together. Most of the time as long as Unbound is responsive, then everything is fine besides being able to make changes or view anything in the WebGUI or console.

All of these issues are only fixed by hard rebooting the instances. Because of this, I have had to reinstall and restore via the xml config quite a few times, as I have had issues upgrading due to the instability.

Things I have tried (but none seem to help):

Increasing the memory of my VMs from 4gb -> 8gb
Increasing Max Threads of the WebGUI to 12
Using Service Watchdog on impacted services

The only thing that has improved my stability is disabling DNSBL, and I do not want to do this. I would love to retain this functionality, but at this point it seems like no matter what I do I end up with the above symptoms.

Any advice would be much appreciated. I am on the latest 2.4 daily snapshots, and update as frequently as I can.