Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved
    pfBlockerNG
    192
    1.1k
    1.4m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      TyphooN
      last edited by

      I fixed the stability problem and the issue was not DNSBL.  It just appears that enabling DNSBL was a catalyst in setting off the real issue (I/O).  I was getting some SCSI errors after updating to the latest version of ESXI.  Once I changed the device that my VM's disks were attached to to the SATA device rather than SCSI, all issues were eliminated.  My VMs have been stable with DNSBL enabled for over 24 hours now, which has never happened before.  I am sorry for going down the wrong rabbit hole initially, but I am excited that I can now use DNSBL without any issues!  Thank you BBcan177 for all of your hard work on pfBlockerNG!

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @TyphooN:

        I fixed the stability problem and the issue was not DNSBL.

        Glad you got it sorted out  :)

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • H
          heliop100
          last edited by

          Hi,

          I have one IPV4 alias list that works before and now are generating the "/var/db/aliastables/pfB_Allow_List.txt"

          "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

          <title>400 - Bad Request</title>

          400 - Bad Request

          Why that happening?

          Thanks

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @heliop100:

            <title>400 - Bad Request</title>

            What URL are you using? Load the URL in the browser and see what it returns. You're getting a 400 error on connection. Check the Alerts tab if something is blocking access to that URL.

            "The 400 Bad Request error is an HTTP status code that means that the request you sent to the website server, often something simple like a request to load a web page, was somehow incorrect or corrupted and the server couldn't understand it."

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • H
              heliop100
              last edited by

              Hi,

              It's not an URL.
              Is a WHOIS based on AS number.

              Thanks

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @heliop100:

                Is a WHOIS based on AS number.

                So you select "whois" and enter an AS for example:    AS13414    in the source field? Is this an IPv4 or v6 alias? Maybe post a screenshot…

                What does this command report when you run it from the shell? You can change the ASN to the number that you configured above:

                mwhois -h whois.radb.net \!gAS13414

                UPDATE:
                You can see if its listed in DNSBL and if the host cmd responds with the DNSBL VIP, then it need to be whitelist in DNSBL.

                host -t A whois.radb.net

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • H
                  heliop100
                  last edited by

                  @BBcan177:

                  @heliop100:

                  Is a WHOIS based on AS number.

                  So you select "whois" and enter an AS for example:    AS13414    in the source field? Is this an IPv4 or v6 alias? Maybe post a screenshot…

                  What does this command report when you run it from the shell? You can change the ASN to the number that you configured above:

                  mwhois -h whois.radb.net \!gAS13414

                  UPDATE:
                  You can see if its listed in DNSBL and if the host cmd responds with the DNSBL VIP, then it need to be whitelist in DNSBL.

                  host -t A whois.radb.net

                  Hi, is an IPV4 alias.

                  mwhois -h whois.radb.net \!gAS13414
```returs:

mwhois -h whois.radb.net \!gAS14061

A3848
5.101.96.0/21 5.101.104.0/22 5.101.108.0/24 5.101.109.0/24 5.101.110.0/24 5.101.111.0/24 37.139.0.0/19 45.55.32.0/19 45.55.64.0/19 45.55.96.0/22 45.55.100.0/22 45.55.104.0/22 45.55.116.0/22 45.55.120.0/22 45.55.124.0/22 45.55.128.0/17 45.55.128.0/18 45.55.192.0/18 46.101.0.0/18 46.101.64.0/22 46.101.68.0/22 46.101.72.0/21 ….. a lot more

And

                  host -t A whois.radb.net

                  
whois.radb.net has address 198.108.0.18

DNSBL are disable.
Thanks.

![pfbloquerNG.jpg](/public/_imported_attachments_/1/pfbloquerNG.jpg)
![pfbloquerNG.jpg_thumb](/public/_imported_attachments_/1/pfbloquerNG.jpg_thumb)
                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    You're on an older version of pfSense and pfBlockerNG… I'd suggest updating to the latest versions...

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • T
                      TyphooN
                      last edited by

                      BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread.  Is there an exhaustive list of feeds or any "must have" feeds that I might have missed?  Thank you!  8)

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        @TyphooN:

                        BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread.  Is there an exhaustive list of feeds or any "must have" feeds that I might have missed?  Thank you!  8)

                        I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...

                        Currently listing:

                        • IPv4:  105 Feeds

                        • IPv6:      9 Feeds

                        • DNSBL: 71 Feeds

                        Just working on the last bits … Hope to have it out soon....
                        I will post some screenshots when I can...

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • T
                          TyphooN
                          last edited by

                          @BBcan177:

                          @TyphooN:

                          BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread.  Is there an exhaustive list of feeds or any "must have" feeds that I might have missed?  Thank you!  8)

                          I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...

                          Currently listing:

                          • IPv4:  105 Feeds

                          • IPv6:      9 Feeds

                          • DNSBL: 71 Feeds

                          Just working on the last bits … Hope to have it out soon....
                          I will post some screenshots when I can...

                          Awesome!  Can't wait for it's release!  Thank you for your continued contribution, pfBlockerNG is already great but this is the icing on the cake!

                          1 Reply Last reply Reply Quote 0
                          • R
                            Ramosel
                            last edited by

                            @BBcan177:

                            I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...
                            I will post some screenshots when I can...

                            As one of BBcan's testers, I can tell you he has done an amazing job on this feature.  It alone will be worth the update.

                            1 Reply Last reply Reply Quote 0
                            • P
                              pfBasic Banned
                              last edited by

                              Any guesstimates for ETA?

                              1 Reply Last reply Reply Quote 0
                              • S
                                spyshagg
                                last edited by

                                I'd like to report a serious bug.

                                After the first setup and first reboot, PFblockerNG proceeds to alter the order of the pre-existing Floating Rules.
                                Before PFblockerNG:

                                1º Custom quick Allow rules to many things

                                2º Custom quick Deny all rule to all traffic on my subnets.

                                After PFblockerNG

                                1º  PFblocker own rules

                                2º Custom quick Deny all rule to all traffic on my subnets.

                                3º Custom quick Allow rules to many things.

                                It changed the order of my Deny Rule to be above my Allow rules, thus blocking all traffic.

                                I fixed the rules ordering, but I have yet to reboot the machine to see if they are preserved.

                                Edit: I see there is an option on how to order pfblockerng floating rules, and the default one  says:

                                pfb_block / Reject | all other rules

                                It either considered my custom Deny rule to be one of its own, or it simply parses all existing rules looking for "deny/reject" and jumps them ahead.

                                1 Reply Last reply Reply Quote 0
                                • T
                                  TyphooN
                                  last edited by

                                  @Ramosel:

                                  @BBcan177:

                                  I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...
                                  I will post some screenshots when I can...

                                  As one of BBcan's testers, I can tell you he has done an amazing job on this feature.  It alone will be worth the update.

                                  How do you become a tester?  I would like to sign up if any more are needed!  I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process.  Kind of why I religiously update my pfSense box daily whenever updates are available :)

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    @TyphooN:

                                    How do you become a tester?  I would like to sign up if any more are needed!  I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process.  Kind of why I religiously update my pfSense box daily whenever updates are available :)

                                    I sent a PM :)

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • Y
                                      yodaphone
                                      last edited by

                                      @BBcan177:

                                      @TyphooN:

                                      How do you become a tester?  I would like to sign up if any more are needed!  I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process.  Kind of why I religiously update my pfSense box daily whenever updates are available :)

                                      I sent a PM :)

                                      I'd love  to test too.. :) let me know if can include me..

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mifronte
                                        last edited by

                                        Just got caught up on this thread.  The only thing I am unclear on is what is the ramifications of having these two options enabled?

                                        1. Register DHCP leases in the DNS Resolver
                                        2. Register Static DHCP static mappings in the DNS Resolver

                                        Thanks.

                                        SuperMicro Atom C2758 A1SRI-2758F 16GB
                                        2.7.2 (amd64)

                                        1 Reply Last reply Reply Quote 0
                                        • RonpfSR
                                          RonpfS
                                          last edited by

                                          At every registration, Unbound reloads, so if it takes 1-3 minutes to restart (depending on you domain block list size), you have no DNS service available.

                                          Static mappings are not dynamic, so Unbound will reload only when you save the mappings.

                                          2.4.5-RELEASE-p1 (amd64)
                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mifronte
                                            last edited by

                                            Yes, unbound reloading delay makes sense.  Look like I will have to limit my DNSBL feeds since I need both features enabled.

                                            Another question for DNSBL is do you normally Deny Both or just Deny Outbound and allow pfSense implicit block to handle the inbound.  I am trying to imagine a case for Deny Both in DNSBL.  For anything incoming, the session has to be initiated from inside the firewall.  So for unwanted ads to come in, they have to be embedded in the response of the original request in the form of actual content and not a URL.  In which case, DNSBL would not be able to block it anyway.

                                            SuperMicro Atom C2758 A1SRI-2758F 16GB
                                            2.7.2 (amd64)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post