PfBlockerNG v2.0 w/DNSBL

heliop100

Hi,

It's not an URL.
Is a WHOIS based on AS number.

Thanks

BBcan177

Is a WHOIS based on AS number.

So you select "whois" and enter an AS for example: AS13414 in the source field? Is this an IPv4 or v6 alias? Maybe post a screenshot…

What does this command report when you run it from the shell? You can change the ASN to the number that you configured above:

mwhois -h whois.radb.net \!gAS13414

UPDATE:
You can see if its listed in DNSBL and if the host cmd responds with the DNSBL VIP, then it need to be whitelist in DNSBL.

host -t A whois.radb.net

heliop100

@BBcan177:

@heliop100:

Is a WHOIS based on AS number.

So you select "whois" and enter an AS for example: AS13414 in the source field? Is this an IPv4 or v6 alias? Maybe post a screenshot…

What does this command report when you run it from the shell? You can change the ASN to the number that you configured above:
mwhois -h whois.radb.net \!gAS13414
UPDATE:
You can see if its listed in DNSBL and if the host cmd responds with the DNSBL VIP, then it need to be whitelist in DNSBL.
host -t A whois.radb.net

Hi, is an IPV4 alias.

mwhois -h whois.radb.net \!gAS13414
```returs:

mwhois -h whois.radb.net \!gAS14061

A3848
5.101.96.0/21 5.101.104.0/22 5.101.108.0/24 5.101.109.0/24 5.101.110.0/24 5.101.111.0/24 37.139.0.0/19 45.55.32.0/19 45.55.64.0/19 45.55.96.0/22 45.55.100.0/22 45.55.104.0/22 45.55.116.0/22 45.55.120.0/22 45.55.124.0/22 45.55.128.0/17 45.55.128.0/18 45.55.192.0/18 46.101.0.0/18 46.101.64.0/22 46.101.68.0/22 46.101.72.0/21 ….. a lot more

And

host -t A whois.radb.net


whois.radb.net has address 198.108.0.18

DNSBL are disable.
Thanks.

![pfbloquerNG.jpg](/public/_imported_attachments_/1/pfbloquerNG.jpg)
![pfbloquerNG.jpg_thumb](/public/_imported_attachments_/1/pfbloquerNG.jpg_thumb)

BBcan177

You're on an older version of pfSense and pfBlockerNG… I'd suggest updating to the latest versions...

TyphooN

BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread. Is there an exhaustive list of feeds or any "must have" feeds that I might have missed? Thank you! 8)

BBcan177

@TyphooN:

BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread. Is there an exhaustive list of feeds or any "must have" feeds that I might have missed? Thank you! 8)

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...

Currently listing:

IPv4: 105 Feeds
IPv6: 9 Feeds
DNSBL: 71 Feeds

Just working on the last bits … Hope to have it out soon....
I will post some screenshots when I can...

TyphooN

@BBcan177:

@TyphooN:

BBcan, I've read and been using most of the feeds mentioned in the first few pages of this thread. Is there an exhaustive list of feeds or any "must have" feeds that I might have missed? Thank you! 8)

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...

Currently listing:

IPv4: 105 Feeds

IPv6: 9 Feeds

DNSBL: 71 Feeds

Just working on the last bits … Hope to have it out soon....
I will post some screenshots when I can...

Awesome! Can't wait for it's release! Thank you for your continued contribution, pfBlockerNG is already great but this is the icing on the cake!

Ramosel

@BBcan177:

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...
I will post some screenshots when I can...

As one of BBcan's testers, I can tell you he has done an amazing job on this feature. It alone will be worth the update.

pfBasic

Any guesstimates for ETA?

spyshagg

I'd like to report a serious bug.

After the first setup and first reboot, PFblockerNG proceeds to alter the order of the pre-existing Floating Rules.
Before PFblockerNG:

1º Custom quick Allow rules to many things

2º Custom quick Deny all rule to all traffic on my subnets.

After PFblockerNG

1º PFblocker own rules

2º Custom quick Deny all rule to all traffic on my subnets.

3º Custom quick Allow rules to many things.

It changed the order of my Deny Rule to be above my Allow rules, thus blocking all traffic.

I fixed the rules ordering, but I have yet to reboot the machine to see if they are preserved.

Edit: I see there is an option on how to order pfblockerng floating rules, and the default one says:

pfb_block / Reject | all other rules

It either considered my custom Deny rule to be one of its own, or it simply parses all existing rules looking for "deny/reject" and jumps them ahead.

TyphooN

@Ramosel:

@BBcan177:

I am working on the next version of pfBlockerNG v3.0 which will have a Feeds Management Tab for IPv4/v6/DNSBL feeds … plus many other features ...
I will post some screenshots when I can...

As one of BBcan's testers, I can tell you he has done an amazing job on this feature. It alone will be worth the update.

How do you become a tester? I would like to sign up if any more are needed! I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process. Kind of why I religiously update my pfSense box daily whenever updates are available :)

BBcan177

@TyphooN:

How do you become a tester? I would like to sign up if any more are needed! I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process. Kind of why I religiously update my pfSense box daily whenever updates are available :)

I sent a PM :)

yodaphone

@BBcan177:

@TyphooN:

How do you become a tester? I would like to sign up if any more are needed! I always love to try bleeding edge/potentially buggy software and assist in the debugging/feedback process. Kind of why I religiously update my pfSense box daily whenever updates are available :)

I sent a PM :)

I'd love to test too.. :) let me know if can include me..

mifronte

Just got caught up on this thread. The only thing I am unclear on is what is the ramifications of having these two options enabled?

1. Register DHCP leases in the DNS Resolver
2. Register Static DHCP static mappings in the DNS Resolver

Thanks.

RonpfS

At every registration, Unbound reloads, so if it takes 1-3 minutes to restart (depending on you domain block list size), you have no DNS service available.

Static mappings are not dynamic, so Unbound will reload only when you save the mappings.

mifronte

Yes, unbound reloading delay makes sense. Look like I will have to limit my DNSBL feeds since I need both features enabled.

Another question for DNSBL is do you normally Deny Both or just Deny Outbound and allow pfSense implicit block to handle the inbound. I am trying to imagine a case for Deny Both in DNSBL. For anything incoming, the session has to be initiated from inside the firewall. So for unwanted ads to come in, they have to be embedded in the response of the original request in the form of actual content and not a URL. In which case, DNSBL would not be able to block it anyway.

Mr. Jingles

@RonpfS:

At every registration, Unbound reloads, so if it takes 1-3 minutes to restart (depending on you domain block list size), you have no DNS service available.

Static mappings are not dynamic, so Unbound will reload only when you save the mappings.

Thanks Ron. This might be added as an explanation in the screen, next to these two options.

BBcan177

@mifronte:

Another question for DNSBL is do you normally Deny Both or just Deny Outbound and allow pfSense implicit block to handle the inbound. I am trying to imagine a case for Deny Both in DNSBL. For anything incoming, the session has to be initiated from inside the firewall. So for unwanted ads to come in, they have to be embedded in the response of the original request in the form of actual content and not a URL. In which case, DNSBL would not be able to block it anyway.

If you have open WAN ports, then you only need to protect those ports… If so, you can use the "Adv. Inbound" rule settings to add the DST IP(s) and Port(s) so the rules are effective for those events only... The default pfSense block rule on the WAN will handle all other blocking required...

IP Blocking uses the Firewall rules to block/permit/match while DNSBL is blocking based on DNS request by the LAN clients... Don't get the two mixed up :)

mifronte

@BBcan177:

…

IP Blocking uses the Firewall rules to block/permit/match while DNSBL is blocking based on DNS request by the LAN clients... Don't get the two mixed up :)

Sorry if I sound like a newbie, but I just found out about pfBLockNG a few days ago and have been reading the forums to fully understand the package.

This is where I am confused about is if DNSBL is blocking based on DNS request by the LAN clients, why are there options in DNSBL to block incoming? I am trying to understand a scenario where I would have DNS request coming in through the WAN that I would need blocking. Or is the incoming blocking options in DNSBL is just a way to implement IP Blocking using DNSBL feeds?

I am feeling like I am missing a connection to fully understand the difference between IP blocking and DNSBL "incoming" blocking. By incoming, I am referring to requests originating from the WAN/internet.

BBcan177

@mifronte:

-I am missing a connection to fully understand the difference between IP blocking and DNSBL "incoming" blocking. My incoming, I am referring to requests originating from the WAN/internet.

Some of the DNSBL Feeds contain IP addresses.. So when IPs are found in DNSBL, they can be added to a "DNSBL_IP" aliastable to be blocked. So the IP settings in DNSBL are just for that part. Typically IP based feeds are entered in the IPv4/6 Tabs and GeoIP.

There is also a "Permit Rule" in DNSBL which is used to allow other Vlans to be able to access the DNSBL VIP address.

Hope that makes it clearer.