PfBlockerNG v2.0 w/DNSBL

BBcan177 · Apr 13, 2017, 4:34 PM

I haven't had any stability issues since disabling DNSBL across both of my VMs. But on one of them I am getting a strange error that I cannot seem to get to go away on boot. This doesn't seem to impact the functionality of pfBlockerNG, but it is bugging me that I can't get it to go away. I have even tried restoring an older XML on a fresh install, but it seems that the XML is not older than when the issue began.

Starting package pfBlockerNG… Something wrong happened while reading request.

How can I troubleshoot this and alleviate this issue from my system? Thank you in advance!

I read some of your posts, but there isn't much details to help you… Did you use all the default settings for DNSBL? What interfaces did you select? What VIP address? Do these overlap with other subnets? What feeds are you using in DNSBL? Did you review the pfblockerng.log/System Log/Resolver Log for clues?

TyphooN · Apr 16, 2017, 1:06 AM

I fixed the stability problem and the issue was not DNSBL. It just appears that enabling DNSBL was a catalyst in setting off the real issue (I/O). I was getting some SCSI errors after updating to the latest version of ESXI. Once I changed the device that my VM's disks were attached to to the SATA device rather than SCSI, all issues were eliminated. My VMs have been stable with DNSBL enabled for over 24 hours now, which has never happened before. I am sorry for going down the wrong rabbit hole initially, but I am excited that I can now use DNSBL without any issues! Thank you BBcan177 for all of your hard work on pfBlockerNG!

BBcan177 · Apr 16, 2017, 2:57 AM

@TyphooN:

I fixed the stability problem and the issue was not DNSBL.

Glad you got it sorted out :)

heliop100 · Apr 19, 2017, 5:51 PM

Hi,

I have one IPV4 alias list that works before and now are generating the "/var/db/aliastables/pfB_Allow_List.txt"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<title>400 - Bad Request</title>

400 - Bad Request

Why that happening?

Thanks

BBcan177 · Apr 19, 2017, 8:14 PM

@heliop100:

<title>400 - Bad Request</title>

What URL are you using? Load the URL in the browser and see what it returns. You're getting a 400 error on connection. Check the Alerts tab if something is blocking access to that URL.

"The 400 Bad Request error is an HTTP status code that means that the request you sent to the website server, often something simple like a request to load a web page, was somehow incorrect or corrupted and the server couldn't understand it."

heliop100 · Apr 19, 2017, 9:07 PM

Hi,

It's not an URL.
Is a WHOIS based on AS number.

Thanks

BBcan177 · Apr 20, 2017, 2:56 AM

@heliop100:

Is a WHOIS based on AS number.

So you select "whois" and enter an AS for example: AS13414 in the source field? Is this an IPv4 or v6 alias? Maybe post a screenshot…

What does this command report when you run it from the shell? You can change the ASN to the number that you configured above:

mwhois -h whois.radb.net \!gAS13414

UPDATE:
You can see if its listed in DNSBL and if the host cmd responds with the DNSBL VIP, then it need to be whitelist in DNSBL.

host -t A whois.radb.net

heliop100 · Apr 20, 2017, 5:54 PM

@BBcan177:

@heliop100:

Is a WHOIS based on AS number.

So you select "whois" and enter an AS for example: AS13414 in the source field? Is this an IPv4 or v6 alias? Maybe post a screenshot…

What does this command report when you run it from the shell? You can change the ASN to the number that you configured above:
mwhois -h whois.radb.net \!gAS13414
UPDATE:
You can see if its listed in DNSBL and if the host cmd responds with the DNSBL VIP, then it need to be whitelist in DNSBL.
host -t A whois.radb.net

Hi, is an IPV4 alias.

mwhois -h whois.radb.net \!gAS13414
```returs:

mwhois -h whois.radb.net \!gAS14061

A3848
5.101.96.0/21 5.101.104.0/22 5.101.108.0/24 5.101.109.0/24 5.101.110.0/24 5.101.111.0/24 37.139.0.0/19 45.55.32.0/19 45.55.64.0/19 45.55.96.0/22 45.55.100.0/22 45.55.104.0/22 45.55.116.0/22 45.55.120.0/22 45.55.124.0/22 45.55.128.0/17 45.55.128.0/18 45.55.192.0/18 46.101.0.0/18 46.101.64.0/22 46.101.68.0/22 46.101.72.0/21 ….. a lot more

And

host -t A whois.radb.net


whois.radb.net has address 198.108.0.18

DNSBL are disable.
Thanks.

![pfbloquerNG.jpg](/public/_imported_attachments_/1/pfbloquerNG.jpg)
![pfbloquerNG.jpg_thumb](/public/_imported_attachments_/1/pfbloquerNG.jpg_thumb)

BBcan177 · Apr 20, 2017, 9:52 PM

You're on an older version of pfSense and pfBlockerNG… I'd suggest updating to the latest versions...

TyphooN · May 4, 2017, 9:24 PM

BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread. Is there an exhaustive list of feeds or any "must have" feeds that I might have missed? Thank you! 8)

BBcan177 · May 4, 2017, 9:44 PM

@TyphooN:

BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread. Is there an exhaustive list of feeds or any "must have" feeds that I might have missed? Thank you! 8)

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...

Currently listing:

IPv4: 105 Feeds
IPv6: 9 Feeds
DNSBL: 71 Feeds

Just working on the last bits … Hope to have it out soon....
I will post some screenshots when I can...

TyphooN · May 5, 2017, 12:36 AM

@BBcan177:

@TyphooN:

BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread. Is there an exhaustive list of feeds or any "must have" feeds that I might have missed? Thank you! 8)

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...

Currently listing:

IPv4: 105 Feeds

IPv6: 9 Feeds

DNSBL: 71 Feeds

Just working on the last bits … Hope to have it out soon....
I will post some screenshots when I can...

Awesome! Can't wait for it's release! Thank you for your continued contribution, pfBlockerNG is already great but this is the icing on the cake!

Ramosel · May 18, 2017, 3:06 AM

@BBcan177:

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...
I will post some screenshots when I can...

As one of BBcan's testers, I can tell you he has done an amazing job on this feature. It alone will be worth the update.

pfBasic · May 18, 2017, 3:40 AM

Any guesstimates for ETA?

spyshagg · May 18, 2017, 8:56 AM

I'd like to report a serious bug.

After the first setup and first reboot, PFblockerNG proceeds to alter the order of the pre-existing Floating Rules.
Before PFblockerNG:

1º Custom quick Allow rules to many things

2º Custom quick Deny all rule to all traffic on my subnets.

After PFblockerNG

1º PFblocker own rules

2º Custom quick Deny all rule to all traffic on my subnets.

3º Custom quick Allow rules to many things.

It changed the order of my Deny Rule to be above my Allow rules, thus blocking all traffic.

I fixed the rules ordering, but I have yet to reboot the machine to see if they are preserved.

Edit: I see there is an option on how to order pfblockerng floating rules, and the default one says:

pfb_block / Reject | all other rules

It either considered my custom Deny rule to be one of its own, or it simply parses all existing rules looking for "deny/reject" and jumps them ahead.

TyphooN · May 23, 2017, 7:07 PM

@Ramosel:

@BBcan177:

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...
I will post some screenshots when I can...

As one of BBcan's testers, I can tell you he has done an amazing job on this feature. It alone will be worth the update.

How do you become a tester? I would like to sign up if any more are needed! I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process. Kind of why I religiously update my pfSense box daily whenever updates are available :)

BBcan177 · May 27, 2017, 4:32 AM

@TyphooN:

How do you become a tester? I would like to sign up if any more are needed! I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process. Kind of why I religiously update my pfSense box daily whenever updates are available :)

I sent a PM :)

yodaphone · May 27, 2017, 1:05 PM

@BBcan177:

@TyphooN:

How do you become a tester? I would like to sign up if any more are needed! I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process. Kind of why I religiously update my pfSense box daily whenever updates are available :)

I sent a PM :)

I'd love to test too.. :) let me know if can include me..

mifronte · Jun 9, 2017, 12:28 AM

Just got caught up on this thread. The only thing I am unclear on is what is the ramifications of having these two options enabled?

1. Register DHCP leases in the DNS Resolver
2. Register Static DHCP static mappings in the DNS Resolver

Thanks.

RonpfS · Jun 9, 2017, 1:35 AM

At every registration, Unbound reloads, so if it takes 1-3 minutes to restart (depending on you domain block list size), you have no DNS service available.

Static mappings are not dynamic, so Unbound will reload only when you save the mappings.