Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    pfBlockerNG
    192
    1.1k
    1.6m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Maxburn
      last edited by

      Did charting make it into this release? I can't seem to find it.

      https://forum.pfsense.org/index.php?topic=144733.msg787832#msg787832

      1 Reply Last reply Reply Quote 0
      • E
        Escorpiom
        last edited by

        I've just set this up, and the blocker is indeed very effective!
        At the moment I'm using the DNSBL part only but so far it's impressive.

        The only thing missing at the moment is the DNS blocking for IPv6 content. For example on Youtube.
        As I understand this would be a new future for the upcoming 3.0 release, if so then I'm eager to try it out.

        Thanks for your work on pfBlockerNG and your support, it's a must have for PfSense.

        Cheers.

        Edit:
        I should have posted this in the pfBlockerNG 2.1 topic, that's the actual version installed on my pfsense box.

        1 Reply Last reply Reply Quote 0
        • L
          labradorg13
          last edited by

          Hi do you have any guide or tutorial for the new version of pfblockerng w/ dnsbl.
          Kindly please share.

          Thanks

          pfSenseTestP 1 Reply Last reply Reply Quote 0
          • pfSenseTestP
            pfSenseTest @labradorg13
            last edited by

            @labradorg13 https://www.linuxincluded.com/block-ads-malvertising-on-pfsense-using-pfblockerng-dnsbl/

            2x SG-5100 | MBT-4220 (retired) | SG-1000 (retired)

            1 Reply Last reply Reply Quote 0
            • S
              SashaZt
              last edited by

              Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()
              Help???

              BBcan177B 2 Replies Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator @SashaZt
                last edited by

                @sashazt said in PfBlockerNG v2.0 w/DNSBL:

                Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()
                Help???

                Strange error... Looks like it didn't install properly... Do you have enough hard drive space? Try to remove/reinstall the package.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • O
                  Overloader
                  last edited by

                  It looks like a PHP Opcache issue. Simply reboot pfsense after upgrade. Then it works.

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator @SashaZt
                    last edited by

                    @sashazt said in PfBlockerNG v2.0 w/DNSBL:

                    Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()

                    Can you confirm if you are on pfSense 2.4.3? or 2.4.4?

                    Also did this occur when you upgraded pfBlockerNG-devel? or was this a new installation of pfBlockerNG-devel?

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    O 1 Reply Last reply Reply Quote 0
                    • O
                      Overloader @BBcan177
                      last edited by

                      @bbcan177 I'm running pfsense 2.4.3-RELEASE-p1 and upgraded from pfBlockerNG 2.1.4_9 to 2.2.5_11 (dev). There are no installation errors but it looks like that the PHP files are cached due opcache.

                      $ php -v
                      PHP 5.6.34 (cli) (built: Mar 16 2018 16:55:46) 
                      Copyright (c) 1997-2016 The PHP Group
                      Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
                          with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies
                          with Suhosin v0.9.38, Copyright (c) 2007-2015, by SektionEins GmbH
                      
                      M 1 Reply Last reply Reply Quote 0
                      • M
                        MarcoP @Overloader
                        last edited by

                        @overloader is your php using opcache.validate_timestamps=0?
                        If it doesn't opcache should be able to check the modified timestamp and regenerate the cache.


                        I found out a little issue with a feed blocking it's own IP, funny.

                        Info regarding the feed
                        PRI4 - CCT_IP - https[:]//cybercrime-tracker[.]net/fuckerz.php - 213.186.33.3

                        I'll drop an email and report it directly to the list owner, till here easy.


                        However the main gateway is still able to connect and download from that IP.

                        pfSense gateway - pfBlockerNG Reports
                        Sep 4 10:00:47 WIFI pfB_PRI4_v4 (1770006077) 192.168.20.103:44188 213.186.33.3:443 cluster015.ovh.net TCP:S

                        pfSense test box on WIFI vlan - 192.168.20.103 - pfBlockerNG error.log
                        [ pfB_PRI4_v4 - CCT_IP_v4 ] Download FAIL [ 09/04/18 10:00:53 ] Firewall and/or IDS (Legacy mode only) are not blocking download.

                        Inbound interface is WAN

                        • Advanced inbound on OpenPorts alias
                        • Advanced outbound any any - as default
                        • Floating rules deny both directions

                        Outbound interfaces, all including WAN

                        • Advance inbound/outbound as default
                        • Floating rules denying both directions

                        Pinging the IP from WAN correctly fails so pfB rules are working, but why is it still able to download, or is pfBlockerNG able to circumvent it's own block lists.

                        I was only able to found out the feed blocking it's own IP only because I was synching to the client.

                        Cheers

                        1 Reply Last reply Reply Quote 0
                        • gnitingG
                          gniting
                          last edited by

                          I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.

                          Thanks.

                          BBcan177B 1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator @gniting
                            last edited by

                            @ibbetsion said in PfBlockerNG v2.0 w/DNSBL:

                            I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.

                            https://forum.netgate.com/topic/135708/is-pfblockerng-devel-stable

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            gnitingG 1 Reply Last reply Reply Quote 0
                            • gnitingG
                              gniting @BBcan177
                              last edited by

                              @bbcan177 said in PfBlockerNG v2.0 w/DNSBL:

                              @ibbetsion said in PfBlockerNG v2.0 w/DNSBL:

                              I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.

                              https://forum.netgate.com/topic/135708/is-pfblockerng-devel-stable

                              Thank you.

                              1 Reply Last reply Reply Quote 0
                              • A
                                anttechs
                                last edited by

                                I love it and it even has the BBC in the list lol
                                I am I dying to get more Anti corp lists like what you see on filterlist.com because of spying but I get a lot of :

                                [ pfB_PRI1_v4 - BBC_C2_Agr_v4 ] Download FAIL [ 02/03/19 11:04:34 ] 
                                [ pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL [ 02/03/19 11:04:19 ]
                                [ pfB_PRI1_v4 - CINS_army_v4 ] Download FAIL [ 02/03/19 11:04:02 ]
                                [ pfB_PRI1_v4 - BBC_C2_v4 ] Download FAIL [ 02/03/19 11:03:46 ]
                                [ DNSBL_NSA - NSAblocklist1 ] Download FAIL [ 02/03/19 11:03:30 ]
                                [ DNSBL_facebook - FB2 ] Download FAIL [ 02/03/19 11:03:15 ]

                                and this

                                [ BBC_C2_Agr_v4 ] Downloading update . cURL Error: 60
                                SSL certificate problem: self signed certificate Retry in 5 seconds...
                                . cURL Error: 60
                                SSL certificate problem: self signed certificate Retry in 5 seconds...
                                . cURL Error: 60
                                SSL certificate problem: self signed certificate Retry in 5 seconds...
                                .. unknown http status code | 0

                                [ pfB_PRI1_v4 - BBC_C2_Agr_v4 ] Download FAIL [ 02/03/19 11:04:34 ]
                                [ osint.bambenekconsulting.com ] Domain listed in DNSBL

                                The Following List has been REMOVED [ BBC_C2_Agr_v4 ]

                                and I have no idea if I'm doing something wrong or it's just the site?

                                or its because it's not in the right format?

                                But its still going great and so much simpler to use.
                                Great work.

                                I do wonder if this is 0.0.0.0 example.com is ok to put as a list?
                                I could just ake my own list but then they would not get updated.

                                I want to block all companies like google, apple, Microsoft, NSA Government, and so on.
                                I just use a paiid vpn to reach the outside world.

                                Intel(R) Celeron(R) CPU J1900 @ 1.99GHz
                                Current: 1992 MHz, Max: 1993 MHz
                                4 CPUs: 1 package(s) x 4 core(s)
                                AES-NI CPU Crypto: No
                                8 Gig RAM
                                250GB SSD

                                https://ant-techs.is/ip-blocklists

                                1 Reply Last reply Reply Quote 0
                                • M
                                  MarcoP
                                  last edited by

                                  @anttechs edit filerlist to filterlists ;)

                                  About the failed downloads, if i remember right some list does include other list' IP, so if you have WAN as Outbound interface in pfBlockerNG these IPs are going to be blocked. The same should apply for the SSL error.

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    anttechs
                                    last edited by

                                    Many thanks ;)
                                    I'm still learning everyday lol
                                    mines on LAN Outbound Firewall Rules reject.
                                    but Wan is set to default

                                    I think I get it

                                    I disabled TLD because I had .com and most of the others in there, I may be going over the top lol

                                    Intel(R) Celeron(R) CPU J1900 @ 1.99GHz
                                    Current: 1992 MHz, Max: 1993 MHz
                                    4 CPUs: 1 package(s) x 4 core(s)
                                    AES-NI CPU Crypto: No
                                    8 Gig RAM
                                    250GB SSD

                                    https://ant-techs.is/ip-blocklists

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      MarcoP @anttechs
                                      last edited by

                                      @anttechs said in PfBlockerNG v2.0 w/DNSBL:

                                      Many thanks ;)

                                      You're welcome

                                      I disabled TLD because I had .com and most of the others in there

                                      Yeap, that would be it!

                                      Cheers

                                      1 Reply Last reply Reply Quote 1
                                      • B
                                        beachbum2021
                                        last edited by

                                        can a dev confirm whether or not snort/suricata are available in the 2.5 dev? they are installable but not listed in services or showing in top

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          ck42
                                          last edited by ck42

                                          Was using the non-devel package and began seeing the crashes.

                                          Uninstalled and installed the Devel package (2.2.5_37). Still seeing this. (2.4.5-p1)

                                          Crash report details:

                                          PHP Errors:
                                          [13-Nov-2020 12:33:48 America/New_York] PHP Fatal error:  Uncaught Error: Cannot create references to/from string offsets in /usr/local/pkg/pfblockerng/pfblockerng_install.inc:113
                                          Stack trace:
                                          #0 /etc/inc/pkg-utils.inc(770) : eval()'d code(1): include_once()
                                          #1 /etc/inc/pkg-utils.inc(770): eval()
                                          #2 /etc/inc/pkg-utils.inc(858): eval_once('include_once('/...')
                                          #3 /etc/rc.packages(74): install_package_xml('pfBlockerNG-dev...')
                                          #4 {main}
                                            thrown in /usr/local/pkg/pfblockerng/pfblockerng_install.inc on line 113
                                          
                                          

                                          /etc/rc.packages: New alert found: PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng_install.inc, Line: 113, Message: Uncaught Error: Cannot create references to/from string offsets in /usr/local/pkg/pfblockerng/pfblockerng_install.inc:113 Stack trace: #0 /etc/inc/pkg-utils.inc(770) : eval()'d code(1): include_once() #1 /etc/inc/pkg-utils.inc(770): eval() #2 /etc/inc/pkg-utils.inc(858): eval_once('include_once('/...') #3 /etc/rc.packages(74): install_package_xml('pfBlockerNG-dev...') #4 {main} thrown

                                          Anything I need to worry about?

                                          1 Reply Last reply Reply Quote 0
                                          • RonpfSR
                                            RonpfS
                                            last edited by

                                            if you look at /usr/local/pkg/pfblockerng/pfblockerng_install.inc

                                            it's about the cron jobs removal.

                                            // Remove discontinued pfBlockerNG CRON job
                                            $pfb_cron = &$config['cron']['item'];
                                            if (isset($pfb_cron)) {
                                            	foreach ($pfb_cron as $key => $item) {
                                            		if (strpos($item['command'], 'pfblockerng.php dc >>') !== FALSE) {
                                            			unset($pfb_cron[$key]);
                                            		}
                                            	}
                                            }
                                            

                                            Have a look at /etc/crontab, you can also install the Cron package.

                                            2.4.5-RELEASE-p1 (amd64)
                                            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.