Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfBlockerNG not working

    Scheduled Pinned Locked Moved pfBlockerNG
    33 Posts 8 Posters 13.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator @MrPutin
      last edited by

      @MrPutin

      What are you trying to accomplish? IP and DNSBL (Domain) blocking?
      For DNSBL, you need to make sure that your LAN Devices have their DNS setting set to pfSense only, and no other DNS server.

      Goto the pfBlockerNG Log Browser Tab and review the pfblockerng.log and error.log.
      Run a "Force Reload All" and post the output here.

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177ย  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      M U 2 Replies Last reply Reply Quote 1
      • M
        MrPutin @BBcan177
        last edited by MrPutin

        @BBcan177

        • I have DC server : DHCP and DNS server -192.168.2.1 , 2 WANs
          *Pfsense - i have : openVPN , DHCP replay ,DNS Resolver ,and pfBlockerNG-devel
          I send you the log and photos
          111.jpg p2rRlmY.jpg ie64I9g.jpg 868TMsq.jpg eILLQaZ.jpg yJy4szr.jpg ENMSOsH.jpg AyUl4Bt.jpg VTtAH9V.jpg
        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          If you have an AD/DHCP/DNS Server, then make sure that all Lan devices are pointing their DNS Settings to you AD/DNS server. Then set the AD DNS server "Forwarder" to pfSense, so that DNSBL can filter those requests.

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177ย  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          M 1 Reply Last reply Reply Quote 1
          • M
            MrPutin @BBcan177
            last edited by MrPutin

            @BBcan177
            Then set the AD DNS server "Forwarder" to pfSense, so that DNSBL can filter those requests. >>>This is my silly mistake, thank you very much for your help !!! ๐Ÿ‘ ๐Ÿ‘ ๐Ÿ‘

            1 Reply Last reply Reply Quote 0
            • S
              shoaib
              last edited by

              @MrPutin I am facing the same problem, could you please guide me as well. i am using pfsense as my dns server but still can't make it work. also i have vpn configured ipsec and lan2 .. maybe that's causing the problem..

              GertjanG 1 Reply Last reply Reply Quote 1
              • GertjanG
                Gertjan @shoaib
                last edited by

                @shoaib said in pfBlockerNG not working:

                also i have vpn configured ipsec and lan2 .. maybe that's causing the problem..

                Well ????
                Ditch that VPN and ipsec and re-test.

                if not,

                @shoaib said in pfBlockerNG not working:

                same problem

                This was already solved :

                @BBcan177 said in pfBlockerNG not working:

                What problem are you having? I can't diagnose without any relevant information? Logs? Description?

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                1 Reply Last reply Reply Quote 0
                • U
                  UWLane @BBcan177
                  last edited by

                  @BBcan177
                  I am having an issue where my local machine is not redirecting all dns traffic to local host. I have the firewall rules in place as per instructions to catch all other outbound dns requests other than local dns but it doesn't block. Just wondering if you can assist?

                  JeGrJ 1 Reply Last reply Reply Quote 0
                  • malf0rmedZM
                    malf0rmedZ
                    last edited by malf0rmedZ

                    Hi, I have a similar problem and setup.

                    I'm using DNSBL with a few block lists. I followed this setup guide.

                    My main concern is blocking porn as I have kids at home.

                    In my tests yesterday, some websites were blocked and some that are clearly in the lists were not.

                    Today I enabled DNSBL again without really making any changes (apart for the daily pfSense reboot) and now porn sites are blocked.

                    I'll shed more details on the problem and my setup:

                    An example site is porn(h)ub. It is in the block list but I could still browse it.

                    Here are screenshots of my setup:
                    https://imgur.com/a/P3ADnd8

                    RonpfSR 1 Reply Last reply Reply Quote 0
                    • JeGrJ
                      JeGr LAYER 8 Moderator @UWLane
                      last edited by

                      @UWLane said in pfBlockerNG not working:

                      I am having an issue where my local machine is not redirecting all dns traffic to local host. I have the firewall rules in place as per instructions to catch all other outbound dns requests other than local dns but it doesn't block. Just wondering if you can assist?

                      What's that to do with pfBlocker? If your local machine is not "redirecting" all dns traffic to localhost(? what do you mean by that?) - there's nothing pfsense or pfblocker can do.

                      You can catch DNS and DoT requests with the firewall and redirect it to pfsense so unbound is used but if your client uses some sort of DoH (DNS over HTTPS) there's nothing pfsense, pfblocker or anyone can do besides you stop your client using that application/setting.

                      Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                      If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan
                        last edited by

                        This :

                        ff45e2af-9ca0-470f-83a0-498cc33e574d-image.png

                        conflicts with this :
                        Please read again the "fine print" :

                        d2dec082-0ca0-4558-a8e9-c51fa6a28c75-image.png

                        Also :

                        303c2e29-6960-497b-9aea-40caed8ea9d6-image.png

                        which opens the way to :
                        A DNS request that exists on ("in") pfSEnse can go to 127.0.0.1 - Unbound or Dnsmas (the forwarder), who ever is servering DNS,
                        Or
                        to 185............. (why did you hide this IP ?)
                        or
                        to 195............. (why did you hide this IP ?)

                        185........ and 195...... do also DNSBL for you ? If so, do you control 'them' ?

                        @malf0rmedZ said in pfBlockerNG not working:

                        I followed this setup guide.

                        Re read this :

                        5ea9c6f2-9af7-4353-ada4-bcbdb75d8ed6-image.png

                        I guess you understand know what this means ;)
                        @malf0rmedZ said in pfBlockerNG not working:

                        In my tests yesterday, some websites were blocked and some that are clearly in the lists were not.

                        What web sites ?
                        Which feeds ?

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        malf0rmedZM 2 Replies Last reply Reply Quote 0
                        • malf0rmedZM
                          malf0rmedZ @Gertjan
                          last edited by malf0rmedZ

                          @Gertjan, thanks for pointing out my misconfigurations, do note that my DNS clients are pointing to the domain controller which uses pfSense as the DNS forwarder (see Windows DNS server screenshot).

                          I guess I don't fully understand what I should do so if you could please advise that would be much appreciated. Thanks!

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan
                            last edited by

                            Check your DHCP sever.
                            Does it hand out the correct DNS info to the (your) LAN network clients ?
                            If needed, check all these clients, see what DNS they use.

                            Read this : Home > pfSenseยฎ Software > DHCP and DNS the very first thread "Be aware of Trusted Recursive Resolver (TRR) in Firefox" knowing that it's not only Firefox that can do "DoT" .... most browser - and other applications (!) can do DoT these days.
                            Which means that "the phone of your kid" can have Apps that don't bother with your "pfBlockerNG - DNSBL", they surpass it completely.
                            It's like https traffic that can not be intercepted,. This includes the CIA, NSA and KGB (or what ever they call themselves these days).
                            Blocking outgoing port 853, TCP and UDP might help here, and even forcing to use your DNS ** - not some one else's DNS.

                            ** see them pfSense manual.

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            malf0rmedZM 1 Reply Last reply Reply Quote 0
                            • malf0rmedZM
                              malf0rmedZ @Gertjan
                              last edited by malf0rmedZ

                              Yes my DHCP clients are getting the correct DNS server address (domain controller with pfSense as the forwarder).

                              From your response I still donโ€™t understand what I need to correct in my settings. I sent detailed screenshots so all the configuration information is there. โ€œDo 1...2...3....โ€ type instructions would be ideal, I canโ€™t be that far off from the correct settings I would think.

                              If someone could please assist that would be much appreciated :)

                              1 Reply Last reply Reply Quote 0
                              • RonpfSR
                                RonpfS @malf0rmedZ
                                last edited by RonpfS

                                @malf0rmedZ said in pfBlockerNG not working:

                                https://i.imgur.com/FOf0DWd.png

                                You should click on the Infoblock to get the right settings : The " + " isn't allowed in group name

                                GroupName.png

                                2.4.5-RELEASE-p1 (amd64)
                                Intel Core2 Quad CPU Q8400 @ 2.66GHzย 8GB
                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                1 Reply Last reply Reply Quote 0
                                • malf0rmedZM
                                  malf0rmedZ
                                  last edited by

                                  Thanks RonpfS

                                  @bmeeks your unique explanation abilities will be mightily appreciated - if you can assist in distilling the above comments into clear steps I need to take that will be a huge help. Thanks in advance

                                  1 Reply Last reply Reply Quote 0
                                  • malf0rmedZM
                                    malf0rmedZ @Gertjan
                                    last edited by

                                    @Gertjan said in pfBlockerNG not working:

                                    This :

                                    ff45e2af-9ca0-470f-83a0-498cc33e574d-image.png

                                    conflicts with this :
                                    Please read again the "fine print" :

                                    d2dec082-0ca0-4558-a8e9-c51fa6a28c75-image.png

                                    Can you please explain how these settings conflict? To me having both enabled makes total sense since this enables query forwarding which is required.

                                    Also :

                                    303c2e29-6960-497b-9aea-40caed8ea9d6-image.png

                                    which opens the way to :
                                    A DNS request that exists on ("in") pfSEnse can go to 127.0.0.1 - Unbound or Dnsmas (the forwarder), who ever is servering DNS,
                                    Or
                                    to 185............. (why did you hide this IP ?)
                                    or
                                    to 195............. (why did you hide this IP ?)

                                    185........ and 195...... do also DNSBL for you ? If so, do you control 'them' ?

                                    Can you please explain here what your recommendation is?

                                    @malf0rmedZ said in pfBlockerNG not working:

                                    I followed this setup guide.

                                    Re read this :

                                    5ea9c6f2-9af7-4353-ada4-bcbdb75d8ed6-image.png

                                    I guess you understand know what this means ;)

                                    As mentioned, my clients point to the domain controller which has pfsense configured as the only forwarder, therefore this requirement is satisifed.

                                    @malf0rmedZ said in pfBlockerNG not working:

                                    In my tests yesterday, some websites were blocked and some that are clearly in the lists were not.

                                    What web sites ?
                                    Which feeds ?

                                    The websites in these tests were pornhub and reddit. Please note the screenshots I provided are post this problem (i.e., at that point it was suddenly working as you'll see in the dnsbl log screenshot)

                                    GertjanG 1 Reply Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @malf0rmedZ
                                      last edited by

                                      @malf0rmedZ said in pfBlockerNG not working:

                                      these settings conflict?

                                      Unbound should work as a resolver, not a forwarder. You are forwarding.

                                      @malf0rmedZ said in pfBlockerNG not working:

                                      recommendation

                                      Remove 185.... and 195 ....

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      malf0rmedZM 1 Reply Last reply Reply Quote 0
                                      • malf0rmedZM
                                        malf0rmedZ @Gertjan
                                        last edited by

                                        @Gertjan
                                        Thank you, but if I remove those servers from System/General which upstream forwarders will Unbound use?

                                        malf0rmedZM 1 Reply Last reply Reply Quote 0
                                        • GertjanG
                                          Gertjan
                                          last edited by Gertjan

                                          Ready to learn what a resolver actually is ? ;)
                                          See here https://en.wikipedia.org/wiki/Domain_Name_System#DNS_resolvers - the last phrase.

                                          .... For example, a possible resolution of www.example.com would query a global root server, then a "com" server, and finally an "example.com" server.

                                          Internet uses IP's and doesn't know anything about domain names.
                                          When humans use endless lists of numbers, things bcome messy, so domain names and host names are invented.

                                          These 13 servers https://en.wikipedia.org/wiki/Root_name_server are hardcoded in each resolvers. One of them is used, and the host name is resolved as shown.

                                          A resolver can look up zone details without the need to ask some other DNS system.
                                          For example, you could forward all your DNS request to 8.8.8.8 - 8.8.8.8 is a resolver.

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          malf0rmedZM 1 Reply Last reply Reply Quote 0
                                          • malf0rmedZM
                                            malf0rmedZ @Gertjan
                                            last edited by malf0rmedZ

                                            Thank you, I'm always ready to learn :) In this case I know exactly what a resolver is. Please note using root hints as resolvers is not recommended, using ISP DNS servers is the best choice as this provides caching and reduces the load on root hints. Also, using Google DNS servers equals totally giving up on your privacy which defeats the whole purpose of this exercise...

                                            Therefore, I am wondering if there's a way to use my ISP servers and not root hints with this setup?

                                            GertjanG 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.