Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      Deadpool
      last edited by

      @BBcan177:

      Thanks,  I am hoping to get this out shortly… Just trying to clean up a couple loose ends.... Stay tuned!

      maybe as a cristmas gift @bbcan ?  ::) ::)
      really look forward to your release

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @Deadpool:

        @BBcan177:

        Thanks,  I am hoping to get this out shortly… Just trying to clean up a couple loose ends.... Stay tuned!

        maybe as a cristmas gift @bbcan ?  ::) ::)
        really look forward to your release

        Probably after the Holidays… Just been really crazy busy lately...  :(

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • H
          heliop100
          last edited by

          Hi,

          I have a custom IPV4 Denny List
          On Custom Address(es) I have 9 IPs but only 7 off them are been loaded
          5.9.110.236
          54.207.50.1
          187.17.111.97
          169.45.117.93
          96.6.123.19
          104.16.84.55
          104.16.83.55
          162.243.102.114
          187.61.117.226

          These two are not loading, I try to change order, set "Update Custom List" on drop down, etc.
          5.9.110.236
          162.243.102.114

          Any ideas?

          Thanks

          1 Reply Last reply Reply Quote 0
          • RonpfSR
            RonpfS
            last edited by

            Did you ran a Force Update and a Force Reload IP ?
            Look at the pfblockerng.log, error.log to see what is happening when that Table is loaded?
            Does these IPs get whitelisted?

            2.4.5-RELEASE-p1 (amd64)
            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

            1 Reply Last reply Reply Quote 0
            • H
              heliop100
              last edited by

              Hi,

              I found that on log:

              [ Denny_list_custom ] Downloading update  . completed ..
                –----------------------------
                Original Master    Final   
                ------------------------------
                9        7          7          [ Pass ]

              I realize that the IP 162.243.102.114 are included in another entry as member of AS14061

              But not find any conflict on the IP 5.9.110.236

              Thanks.

              1 Reply Last reply Reply Quote 0
              • RonpfSR
                RonpfS
                last edited by

                Maybe it's already in another Table

                grep "5.9.110.236" /var/db/pfblockerng/deny/*
                

                or using a different range

                grep "5.9.110" /var/db/pfblockerng/deny/*
                grep "5.9.11" /var/db/pfblockerng/deny/*
                grep "5.9.1" /var/db/pfblockerng/deny/*
                grep "5.9." /var/db/pfblockerng/deny/*
                

                2.4.5-RELEASE-p1 (amd64)
                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                1 Reply Last reply Reply Quote 0
                • H
                  heliop100
                  last edited by

                  Bingo

                  I find it on: /var/db/pfblockerng/deny/IBlock_Proxy.txt:5.9.110.236exi

                  But I have one server communicating on port 123 with that IP, believe are one NTP server.

                  Why are not blocking it?

                  1 Reply Last reply Reply Quote 0
                  • H
                    Hugovsky
                    last edited by

                    I'm having problems with iOS 11.3 BETA. It seems that safari can't go to 0.0.0.0 and pages can't load. Solution was to reinstall package and use the VIP address, as I was using the certificate hack and 0.0.0.0.

                    EDIT: Sorry, wrong version. I'm on 2.1.

                    1 Reply Last reply Reply Quote 0
                    • xanaroX
                      xanaro
                      last edited by

                      earlier this month 1.1.1.1 (DNS server) was announced.
                      I noticed I can use their backup server 1.0.0.1 but cannot use 1.1.1.1

                      I have read that it is because of pfblockerNG, I tried the suggested edit from shell

                      https://www.reddit.com/r/PFSENSE/comments/88wg6g/issue_with_pfblockerng_dnsbl_and_cloudflares_1111/

                      sed -i '' 's/1.1.1.1/1.1.1.2/g' /usr/local/pkg/pfblockerng/pfblockerng.sh

                      but it does not seem to have worked, any help is appreciated.

                      1 Reply Last reply Reply Quote 0
                      • RonpfSR
                        RonpfS
                        last edited by

                        You have to do a Force Reload All when you change this IP.

                        2.4.5-RELEASE-p1 (amd64)
                        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                        1 Reply Last reply Reply Quote 0
                        • M
                          Maxburn
                          last edited by

                          Did charting make it into this release? I can't seem to find it.

                          https://forum.pfsense.org/index.php?topic=144733.msg787832#msg787832

                          1 Reply Last reply Reply Quote 0
                          • E
                            Escorpiom
                            last edited by

                            I've just set this up, and the blocker is indeed very effective!
                            At the moment I'm using the DNSBL part only but so far it's impressive.

                            The only thing missing at the moment is the DNS blocking for IPv6 content. For example on Youtube.
                            As I understand this would be a new future for the upcoming 3.0 release, if so then I'm eager to try it out.

                            Thanks for your work on pfBlockerNG and your support, it's a must have for PfSense.

                            Cheers.

                            Edit:
                            I should have posted this in the pfBlockerNG 2.1 topic, that's the actual version installed on my pfsense box.

                            1 Reply Last reply Reply Quote 0
                            • L
                              labradorg13
                              last edited by

                              Hi do you have any guide or tutorial for the new version of pfblockerng w/ dnsbl.
                              Kindly please share.

                              Thanks

                              pfSenseTestP 1 Reply Last reply Reply Quote 0
                              • pfSenseTestP
                                pfSenseTest @labradorg13
                                last edited by

                                @labradorg13 https://www.linuxincluded.com/block-ads-malvertising-on-pfsense-using-pfblockerng-dnsbl/

                                2x SG-5100 | MBT-4220 (retired) | SG-1000 (retired)

                                1 Reply Last reply Reply Quote 0
                                • S
                                  SashaZt
                                  last edited by

                                  Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()
                                  Help???

                                  BBcan177B 2 Replies Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator @SashaZt
                                    last edited by

                                    @sashazt said in PfBlockerNG v2.0 w/DNSBL:

                                    Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()
                                    Help???

                                    Strange error... Looks like it didn't install properly... Do you have enough hard drive space? Try to remove/reinstall the package.

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • O
                                      Overloader
                                      last edited by

                                      It looks like a PHP Opcache issue. Simply reboot pfsense after upgrade. Then it works.

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator @SashaZt
                                        last edited by

                                        @sashazt said in PfBlockerNG v2.0 w/DNSBL:

                                        Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()

                                        Can you confirm if you are on pfSense 2.4.3? or 2.4.4?

                                        Also did this occur when you upgraded pfBlockerNG-devel? or was this a new installation of pfBlockerNG-devel?

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        O 1 Reply Last reply Reply Quote 0
                                        • O
                                          Overloader @BBcan177
                                          last edited by

                                          @bbcan177 I'm running pfsense 2.4.3-RELEASE-p1 and upgraded from pfBlockerNG 2.1.4_9 to 2.2.5_11 (dev). There are no installation errors but it looks like that the PHP files are cached due opcache.

                                          $ php -v
                                          PHP 5.6.34 (cli) (built: Mar 16 2018 16:55:46) 
                                          Copyright (c) 1997-2016 The PHP Group
                                          Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
                                              with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies
                                              with Suhosin v0.9.38, Copyright (c) 2007-2015, by SektionEins GmbH
                                          
                                          M 1 Reply Last reply Reply Quote 0
                                          • M
                                            MarcoP @Overloader
                                            last edited by

                                            @overloader is your php using opcache.validate_timestamps=0?
                                            If it doesn't opcache should be able to check the modified timestamp and regenerate the cache.


                                            I found out a little issue with a feed blocking it's own IP, funny.

                                            Info regarding the feed
                                            PRI4 - CCT_IP - https[:]//cybercrime-tracker[.]net/fuckerz.php - 213.186.33.3

                                            I'll drop an email and report it directly to the list owner, till here easy.


                                            However the main gateway is still able to connect and download from that IP.

                                            pfSense gateway - pfBlockerNG Reports
                                            Sep 4 10:00:47 WIFI pfB_PRI4_v4 (1770006077) 192.168.20.103:44188 213.186.33.3:443 cluster015.ovh.net TCP:S

                                            pfSense test box on WIFI vlan - 192.168.20.103 - pfBlockerNG error.log
                                            [ pfB_PRI4_v4 - CCT_IP_v4 ] Download FAIL [ 09/04/18 10:00:53 ] Firewall and/or IDS (Legacy mode only) are not blocking download.

                                            Inbound interface is WAN

                                            • Advanced inbound on OpenPorts alias
                                            • Advanced outbound any any - as default
                                            • Floating rules deny both directions

                                            Outbound interfaces, all including WAN

                                            • Advance inbound/outbound as default
                                            • Floating rules denying both directions

                                            Pinging the IP from WAN correctly fails so pfB rules are working, but why is it still able to download, or is pfBlockerNG able to circumvent it's own block lists.

                                            I was only able to found out the feed blocking it's own IP only because I was synching to the client.

                                            Cheers

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.