Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!

    Scheduled Pinned Locked Moved
    pfBlockerNG
    27
    94
    73.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by BBcan177

      pfBlockerNG-devel v3.0.0

      No longer bound by Unbound - DNSBL Unbound Python Integration Released

      Continue to follow in the pfSense forum and on Twitter [ u/bbcan177 ], Reddit [ r/pfBlockerNG ]
      and Patreon ( https://www.patreon.com/pfBlockerNG ) for pfBlockerNG news and support.

      Thank you for the Support!

      The package is now available for pfSense 2.4.5, and will be available in pfSense 2.5 when the next builds are updated by the pfSense devs.

      UPDATE 1:29pm-EST:

      There seems to be a permissions issue in Unbound with this update. working with the pfSense devs for a solution.

      In the meantime, change the /var/unbound folder permissions with the following cmd:

      chown unbound:unbound /var/unbound

      UPDATE 1:32pm-EST:

      There is a fix to the package plist file to set the proper folder permissions for the /var/unbound folder:

      https://github.com/pfsense/FreeBSD-ports/commit/94c2f1063b94d5336bf7bc446fcc4f13153fa4a2#diff-41af7ba58ac46421a63b5d35c25c270f0a422f4c7de0e74a30de78ed3cf7a696

      Update to v3.0.0_1

      Thanks for all your patience!

      CHANGELOG:

      • DNSBL - Python Mode Integration ( This mode is only available for pfSense v2.4.5 and above )

      • TOP1M - Add Tranco as the default TOP1M Whitelist [ https://tranco-list.eu/ ]

      • DNSBL VIP Type = CARP (High Availability Sync) improvements

      • XMLRPC Sync Tab - Remove the CARP HA Skew from being sync'd

      • Add Localhost at the default DNSBL Listening interface
        (Suggest all existing users change to this interface)

      • DNSBL Web Server is now bound to localhost instead of 0.0.0.0

      • Widget - Packet counters are more accurate, however, the Clear counter option will now clear all pfSense counters.

      • Widget - Tooltip Improvements

      • Widget - Add IDN/Regex/TLD Allow entries

      • DNSBL SQLite statistic databases are now located in the /var/unbound folder

      • DNSBL IPv6 blocking

      • Wizard - Add IPv6 checkbox

      • Wizard - Add DNSBL Whitelist checkbox to allow users to disable the default DNSBL Whitelist.

      • Alerts/Reports tab - Timeline Bar graph charts (via d3Pie)

      • Alerts/Reports tab - Pause Icon added to halt the page refresh on each table.

      • Alerts/Reports tab - Several new Settings to refine the Reports page output

      • Alerts/Reports tab - Page refresh timer now starts after page has been fully loaded.

      • Alerts/Reports tab - Add port lookup tool

      • DNSBL Block page - Screen resolution improvements for device screen sizes

      • ASN - Database updated

      • DNSBL TLD database updated

      • Add the DNSBL SafeSearch menu option to the User Privileges page

      • CURL - Download speed improvements (CURLOPT_TCP_FASTOPEN, CURLOPT_TCP_NODELAY)

      • DNSBL Web Server certificate improvements (by PiBa)

      • DNSBL Restore Resolver DNS cache option on Cron/Force Update/Force Reloads

      • DNSBL improvements to the Stop and Start of Unbound

      • DNSBL Null Blocking mode with or without logging

      • Add Threat Page lookups - GreyNoise, Shodan and Stop Forum Spam

      • Improvement to pfblockerng.log messages

      • Feeds added/removed/edit

      • Several improvements to the Alerts/Reports Tab

      • Several other under-the-hood improvements

      CAUTIONS:

      The DNS Resolver (Unbound) DHCP Registration option is not compatible with DNSBL Python mode. The pfSense devs are aware and changes are required to be made to the dhcpleases binary to stop/start Unbound instead of sending a SIGHUP. The use of this option and the Unbound Python mode will cause an Unbound crash.
      If DHCP Registration is enabled in Unbound Python mode, or DHCP Registration enabled after Unbound Python mode is enabled, Unbound Python mode will be downgraded to Unbound mode to prevent Unbound from crashing.

      The DNS Resolver Unbound "Views" feaure it not currently compatable with DNSBL Python mode. The "Views" feature will be incorporated into the new Python Mode in future.

      FEEDS:

      Feodo Tracker - URL Changed, Add new Feed options
      URLhaus - Add new Feed options
      ISC - Changed URL from dshield.org to isc.sans.eu
      ISC Low/Med/High - These feeds are currently "Suspended" by ISC, so it is blank. Will monitor if this changes.
      https://isc.sans.edu/suspicious_domains.html
      ISC - Add TOR Feed to TOR IP Group
      ISC - Add Onyphe Feed
      Talos-Snort - Changed URL
      Add more DoH feeds to "DoH" Group
      Bambenek (BBC) Feeds now require Registration and the URLs are changed. Moved from PR1 rto PRI3.
      https://docs.google.com/forms/d/1rcLFEfSmo09lPQM8YT4VU3ixTwZ-1lK_0G5R3wk5oJY/
      https://www.reddit.com/r/pfBlockerNG/comments/i139ob/fyi_bambenek_feeds_gone_commercial/
      EasyList Privacy new URL (Note: other Easylist URLs may change in future)
      Easylist Lithuanian - URL Changed
      Easylist - Adware Filter - URL changed, not sure if this feed is still supported?
      Krisk Intel Feeds - New Feeds
      MalTrail Feed - New Feed
      BadIPs - Seems to be down - Will monitor if this changes.
      Blocklist.de - Added donate link
      Blocklist.de - Added new Feed Option
      AzORult Tracker - New Feed
      Added new IP "SCANNERS" Group
      Public-dns.info - Add second Feed option (IPv4/6)
      myip.ms - Add second Feed option (IPv4/6)
      Antisocial Engineer - Moved from Malicious Group to Malicious2 Group. This feed is UK Centric and can cause FPs.
      Removed discontinued Sysctl Feeds
      Removed discontinued Heuristic Security DoH Feed

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      A 1 Reply Last reply Reply Quote 10
      • BBcan177B
        BBcan177 Moderator
        last edited by BBcan177

        To enable the new DNSBL python integration, goto the DNSBL Tab, and change the "DNSBL Mode" from "Unbound mode" to "Unbound Python mode", then select the Python integration options below that you want to use. Click on the blue infoblock icons for details about each feature.

        Follow that with a Force Reload-DNSBL. Then check to ensure that the Unbound service is running, and that there are no errors reported in the pfBlockerNG widget. If there are any issues, you can easily revert back to the "Unbound mode" followed by a Force Reload-DNSBL.

        You do not need to touch any Unbound python mode settings in the DNS Resolver. Those are handled automatically by the package.

        To clear the DNSBL Python log/Dashboard widget warning, goto the "Logs" Tab, Select the log type as "Log Files", select "py_error.log" and click the trashcan Icon.

        If you experience any issues, report back with what version of pfSense you use, and as much detail as possible about the issue.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 1
        • M
          mcury
          last edited by

          Hello BBcan177, thanks for the new version.
          My unbound is not starting, can you help me?

          DHCP Registration disabled
          Static DHCP disabled
          DNS Query Forwarding disabled
          DNSSEC enabled
          Network Interfaces ALL
          Outgoing Network Interfaces WAN
          Enable SSL/TLS Service disabled
          Python Module disabled

          System:
          SG-3100 running 2.4.5p1
          Updated from pfBlockerNG-devel from 2.2.5_37 to this version.

          System logs:

          Nov 24 13:25:49	php		[pfBlockerNG] Restarting firewall filter daemon
Nov 24 13:25:49	php		/etc/rc.packages: Successfully installed package: pfBlockerNG-devel.
Nov 24 13:25:49	pkg-static		pfSense-pkg-pfBlockerNG-devel upgraded: 2.2.5_37 -> 3.0.0
Nov 24 13:25:51	check_reload_status		Reloading filter
Nov 24 13:25:51	check_reload_status		Starting packages
Nov 24 13:25:52	php-fpm	35129	/rc.start_packages: Restarting/Starting all packages.
<clipped>
Nov 24 13:25:56	lighttpd_pfb		[pfBlockerNG] DNSBL Webserver started

          Unbound logs:

          Nov 24 13:23:48	unbound	74847:0	fatal error: could not open autotrust file for writing, /root.key.74847-0-20e70140: Permission denied
Nov 24 13:25:40	unbound	2477:0	warning: unbound is already running as pid 74847.
Nov 24 13:25:47	unbound	3440:0	notice: init module 0: validator
Nov 24 13:25:47	unbound	3440:0	notice: init module 1: iterator
Nov 24 13:25:47	unbound	3440:0	info: start of service (unbound 1.10.1).
Nov 24 13:25:48	unbound	3440:1	info: generate keytag query _ta-4f66. NULL IN
Nov 24 13:25:48	unbound	3440:1	fatal error: could not open autotrust file for writing, /root.key.3440-1-20c16e60: Permission denied
Nov 24 13:28:59	unbound	31878:0	notice: init module 0: validator
Nov 24 13:28:59	unbound	31878:0	notice: init module 1: iterator
Nov 24 13:28:59	unbound	31878:0	info: start of service (unbound 1.10.1).
Nov 24 13:29:02	unbound	31878:1	info: generate keytag query _ta-4f66. NULL IN
Nov 24 13:29:02	unbound	31878:1	fatal error: could not open autotrust file for writing, /root.key.31878-1-20e70140: Permission denied
Nov 24 14:35:52	unbound	5005:0	notice: init module 0: validator
Nov 24 14:35:52	unbound	5005:0	notice: init module 1: iterator
Nov 24 14:35:52	unbound	5005:0	info: start of service (unbound 1.10.1).
Nov 24 14:35:53	unbound	5005:0	info: generate keytag query _ta-4f66. NULL IN
Nov 24 14:35:53	unbound	5005:0	fatal error: could not open autotrust file for writing, /root.key.5005-0-20e70140: Permission denied

          Unbound Custom Options:

          server:
do-ip6:no
    access-control-view: 192.168.10.0/24 bypass
    access-control-view: 192.168.20.0/24 dnsbl
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
    include: /var/unbound/pfb_dnsbl.*conf
          1 Reply Last reply Reply Quote 2
          • BBcan177B
            BBcan177 Moderator
            last edited by

            I am checking with the pfSense devs if something changed for the Unbound folder permissions.

            Try to run this cmd and try it:

            chown unbound:unbound /var/unbound

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            T 1 Reply Last reply Reply Quote 1
            • T
              torluda @BBcan177
              last edited by

              @BBcan177 I can confirm that Unbound restarted successfully after I ran the command you provided.

              BBcan177B 1 Reply Last reply Reply Quote 1
              • BBcan177B
                BBcan177 Moderator @torluda
                last edited by

                @torluda
                Update to v3.0.0_1 which should fix this issue.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                T M 2 Replies Last reply Reply Quote 4
                • T
                  torluda @BBcan177
                  last edited by torluda

                  @BBcan177 Updated to 3.0.0_1 and Unbound restart confirmed. Thank you.

                  1 Reply Last reply Reply Quote 1
                  • M
                    mcury @BBcan177
                    last edited by

                    @BBcan177 Thanks BBCan177, I can confirm the same as torluda, Unbound started.

                    1 Reply Last reply Reply Quote 0
                    • T
                      three
                      last edited by

                      I just moved to new HW. When I recovered my settings also pfBlockerNG was installed, v3.0.0 ... and I got trapped by this unbound permissions error.

                      Without knowing, I wiped everything again, recovered my settings, and v3.0.0_1 was installed, which now works as before 😂

                      That's called timing ... hehe

                      Thanx @BBcan177 ... this is a great peace of software !!!

                      1 Reply Last reply Reply Quote 0
                      • G
                        gabacho4 Rebel Alliance
                        last edited by

                        Had a working installation of 3.0. updated to 3.0_1 and it hangs. Pfsense package manager tells me I still can upgrade to the latest but, as best I can tell, pfblocker is no longer installed as I have nothing in the firewall section. I've rebooted the router to no avail. Output from the upgrade attempt is:

                        Package Reinstallation

                        Upgrading pfSense-pkg-pfBlockerNG-devel...
                        Updating pfSense-core repository catalogue...
                        pfSense-core repository is up to date.
                        Updating pfSense repository catalogue...
                        pfSense repository is up to date.
                        All repositories are up to date.
                        Checking integrity... done (0 conflicting)
                        The following 1 package(s) will be affected (of 0 checked):

                        Installed packages to be UPGRADED:
                        pfSense-pkg-pfBlockerNG-devel: 3.0.0 -> 3.0.0_1 [pfSense]

                        Number of packages to be upgraded: 1
                        [1/1] Upgrading pfSense-pkg-pfBlockerNG-devel from 3.0.0 to 3.0.0_1...
                        [1/1] Extracting pfSense-pkg-pfBlockerNG-devel-3.0.0_1: .......... done
                        Removing pfBlockerNG-devel components...
                        Menu items... done.
                        Services... done.
                        Loading package instructions...
                        Removing pfBlockerNG...cat: /var/unbound/pfb_py_zone.txt: No such file or directory
                        All customizations/data will be retained... done.

                        BBcan177B 1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator @gabacho4
                          last edited by

                          @gabacho4
                          Run this cmd:
                          chown unbound:unbound /var/unbound
                          And restart Unbound

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • G
                            gabacho4 Rebel Alliance
                            last edited by

                            That worked as far as getting the package to show that it's at the latest version. I still don't have pfblocker to config or view in mt Firewall tab. Any further steps to follow? Should I just uninstall and reinstall? Thanks for the quick assistance!

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              Re-install v3.0.0_1 and see how that goes

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              G 1 Reply Last reply Reply Quote 0
                              • G
                                gabacho4 Rebel Alliance @BBcan177
                                last edited by

                                @BBcan177 that appears to have taken. Phew! Thanks again!

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mcury
                                  last edited by

                                  Is anyone using the Unbound Python Mode in pfBlockerng?
                                  Do I need to enable the Python Module in DNS Resolver to use it?

                                  If someone is using this python mode, what really changes despite of the RAM usage?
                                  Any feedback about it?

                                  RonpfSR 1 Reply Last reply Reply Quote 0
                                  • RonpfSR
                                    RonpfS @mcury
                                    last edited by RonpfS

                                    @mcury You only enable it in DNSBL, then run a Force Update and a Force Reload ALL to be on the safe side.

                                    You will get more features, Cron update are faster and unbound start in a matter of seconds, so less DNS services interruption.

                                    2.4.5-RELEASE-p1 (amd64)
                                    Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                    Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                    M 1 Reply Last reply Reply Quote 1
                                    • M
                                      mcury @RonpfS
                                      last edited by

                                      @RonpfS Thanks, enabled and ran the force reload all, it's already running :)

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        HieuLe
                                        last edited by

                                        After upgrading to new version, i cannot exclude 1 IP address in DNSBL

                                        Custom Option:
                                        server:
                                        access-control-view: 172.16.10.0/24 bypass
                                        access-control-view: 172.16.200.0/24 dnsbl
                                        access-control-view: 172.16.200.1/32 bypass
                                        access-control-view: 172.16.100.0/24 dnsbl
                                        view:
                                        name: "bypass"
                                        view-first: yes
                                        view:
                                        name: "dnsbl"
                                        view-first: yes

                                        1 Reply Last reply Reply Quote 0
                                        • RonpfSR
                                          RonpfS
                                          last edited by 

                                          CAUTIONS:

2.
The DNS Resolver Unbound "Views" feaure it not currently compatable with DNSBL Python mode. The "Views" feature will be incorporated into the new Python Mode in future.

                                          2.4.5-RELEASE-p1 (amd64)
                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mlines
                                            last edited by

                                            I'm trying to apply the update but the Package Reinstallation is hanging: Please wait while the update system initializes. I've waited over 30 minutes and tried rebooting the SG-1100 without success. Any ideas?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post