Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.7m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      I assume that Adaway is also the name of the Alias?

      Do you have anything in the custom list at the bottom of this alias? I think that's the part that's not parsing properly. Anything in a custom list must be formatted properly.

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • R
        Redyr Banned
        last edited by

        @BBcan177:

        I assume that Adaway is also the name of the Alias?

        Do you have anything in the custom list at the bottom of this alias? I think that's the part that's not parsing properly. Anything in a custom list must be formatted properly.

        The name of the alias is Adaway, and I don't have anything in the custom list.

        I've changed the name of the alias, and the label like this:

        Adaway_list ] Downloading update .. 200 OK. completed ..
        [ pfB_Adaway1 Adaway_list ] List Error ]

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          It looks like you added this list to the IPv4 tab when it's a domain based list and should only be used in the DNSBL tab.

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • R
            Redyr Banned
            last edited by

            @BBcan177:

            It looks like you added this list to the IPv4 tab when it's a domain based list and should only be used in the DNSBL tab.

            I removed it from IPV4, sorry to bother you with this.

            Thank you

            1 Reply Last reply Reply Quote 0
            • Y
              yodaphone
              last edited by

              @BBcan177:

              Here are more DNSBL Feeds that can be used in pfBlockerNG.
              (Copy and paste URLS as plain text)

              1. Create a new alias for these.
                These are not necessarily ADvert domains. So I named mine "Malicious"

              malc0de
              https://malc0de.com/bl/BOOT

              I get this error for malc0de. all other lists are fine

              [ DNSBL_Malicious - malc0de ] Download FAIL [ 02/21/17 01:21:47 ]
                Firewall and/or IDS are not blocking download.

              Set up exactly the way you have described.

              I'm on 2.3.3 RC

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @yodaphone:

                I get this error for malc0de. all other lists are fine

                [ DNSBL_Malicious - malc0de ] Download FAIL [ 02/21/17 01:21:47 ]
                  Firewall and/or IDS are not blocking download.

                Not having any issues with that feed…  Try to

                ping malc0de.com
                

                and see if it responds… Check the Alerts Tab to see if any alerts get reported... Could be Snort/Suricata, or another Firewall rule....

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • H
                  HeatmiserNYC
                  last edited by

                  Hey BBCAN,
                  Is there a way to get Reek's anti-adblocking list to work under Pfblocker? This would be extremely convenient.

                  My apologies if this has been asked a trillion times before….

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @HeatmiserNYC:

                    Is there a way to get Reek's anti-adblocking list to work under Pfblocker? This would be extremely convenient

                    Unfortunately not. DNSBL can't manipulate the browser except for sinkholing the DNS request.

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • B
                      Brutos
                      last edited by

                      Does anyone have a good list for blocking porn sites please?b

                      I have google and searched and cant find any.

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfBasic Banned
                        last edited by

                        @Brutos:

                        Does anyone have a good list for blocking porn sites please?b

                        I have google and searched and cant find any.

                        https://forum.pfsense.org/index.php?topic=125863.0

                        1 Reply Last reply Reply Quote 0
                        • D
                          D0X
                          last edited by

                          @BBcan177:

                          @D0X:

                          Thanks for your support so far, but for now I've given up on pfblockerng. Not that the package is flawed, but Safari on OSX and IOS is driving me nuts.

                          NP…. Should you decide to pick it backup at some point, try to see why the Ping/Browse to the DNSBL VIP wasn't working. That will cause issues on its own.... also since it was one Domain that was predominantly causing issues,  you could also Whitelist it...

                          Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            @D0X:

                            Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

                            Is this with Safari, or all other browsers?

                            Can you review this link:
                                https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • ?
                              Guest
                              last edited by

                              Does anyone have a good list for blocking porn sites please?b

                              There are more options to get better results and for porn sites an OpenDNS account might be a good solution as well!
                              Squid & SquidGuard or DansGuardian plus pfBlockerNG & DNSBL plus an OpenDNS account

                              1 Reply Last reply Reply Quote 0
                              • D
                                D0X
                                last edited by

                                @BBcan177:

                                @D0X:

                                Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

                                Is this with Safari, or all other browsers?

                                Can you review this link:
                                    https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099

                                Safari indeed, on all devices, moving to another browser is not an option here. Doing the mod you suggested, no logging whatsoever will work?

                                Running Pi-Hole here for a few days now, as an alternative. But this means adding another box to my network. Plus the config is a little weird (pfSense DCHP server forwarding Pi-Hole dns address to clients, clients using Pi-Hole and Pi-Hole using the pfSense DNS Resolver again as its upstream DNS, don't know, feels weird).

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  Both solutions use Lighttpd and both push a 1x1 pix. Strange that it doesn't show any cert errors… Will have to do some digging...

                                  In the link, there is another option to drop just the HTTPS alerts with a firewall rule.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    n3by
                                    last edited by

                                    pihole it use only http, not https ( because of that on https you have error with site incorrect configured…).

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      TyphooN
                                      last edited by

                                      I have been banging my head against the desk for almost a month now and have not been able to find a way to get either of my 2 pfSense VMs (vmware esxi host) to remain stable for ~12 hours with DNSBL enabled while using feeds that were on the first few pages of this forum post.  Issues that I tend to have, sometimes as little as a few hours of uptime.. sometimes around 12-20 hours.  I have been using pfblockerng for quite some time using the traditional ipv4 blocklists with no problems.  Only after I have enabled DNSBL, and added several feeds have I had these symptoms:

                                      • The Web GUI becomes unresponsive
                                      • Unbound becomes unresponsive, leading to DNS being unable to resolve for clients
                                      • The console is unresponsive
                                      • DHCPD stops functioning
                                      • Less frequently than the above symptoms, routing stops all together.  Most of the time as long as Unbound is responsive, then everything is fine besides being able to make changes or view anything in the WebGUI or console.

                                      All of these issues are only fixed by hard rebooting the instances.  Because of this, I have had to reinstall and restore via the xml config quite a few times, as I have had issues upgrading due to the instability.

                                      Things I have tried (but none seem to help):

                                      • Increasing the memory of my VMs from 4gb -> 8gb
                                      • Increasing Max Threads of the WebGUI to 12
                                      • Using Service Watchdog on impacted services

                                      The only thing that has improved my stability is disabling DNSBL, and I do not want to do this.  I would love to retain this functionality, but at this point it seems like no matter what I do I end up with the above symptoms.

                                      Any advice would be much appreciated.  I am on the latest 2.4 daily snapshots, and update as frequently as I can.

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        Do you see any errors in the Resolver.log?

                                        Its best not to use the Service watchdog with DNSBL, since it can try to restart Unbound at in appropriate times…

                                        Are you using the literal IP address to access to webgui?

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          TyphooN
                                          last edited by

                                          @BBcan177:

                                          Do you see any errors in the Resolver.log?

                                          Its best not to use the Service watchdog with DNSBL, since it can try to restart Unbound at in appropriate times…

                                          Are you using the literal IP address to access to webgui?

                                          I have been connecting to the WebGUI only via ip address, not hostname.  I have turned off the service watchdog for DNSBL and Unbound.

                                          Here is the entire log for 1 of my VMs,  I am in the process of restoring the other one from XML at the moment, but will give you that one when I have a chance.

                                          https://pastebin.com/059BCEeV

                                          Edit:
                                          Here are some screenshots of everything that occured during syncing the DNSBL feeds of my other VM whilst restoring the XML.  I had to hard reboot the instance a few times for it to complete:

                                          https://imgur.com/a/788UU

                                          Here is the resolver.log:
                                          https://pastebin.com/R9jGU7Xs

                                          I have disabled DNSBL on 1 of my VMs, as I need at least 1 of them to be stable today (working from home).  Will monitor the other one for instability and provide an updated log when I can.  Are there any other logs that you may be interested in?

                                          1 Reply Last reply Reply Quote 0
                                          • RonpfSR
                                            RonpfS
                                            last edited by

                                            Did you disable the two "DHCP registrations" checkboxes?
                                            @BBcan177:

                                            Some recommendations:

                                            • The DNS Resolver can also be used in 'Forwardering mode'; however its best to not use this 'Forwarding mode' and keep it in 'resolver mode' as this will query the Root DNS servers for the DNS queries instead of relying on an ISPs DNS etc…

                                            • If you use the 'DNS Resolver Forwarder mode', only configure 'DNSSEC' if the configured DNS servers support DNSSEC. The enabling of 'DNSSEC' to harden your DNS security is highly recommended.

                                            • Disable the two "DHCP registrations" checkboxes, unless you really require those options.

                                            2.4.5-RELEASE-p1 (amd64)
                                            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.