Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!

    pfBlockerNG
    27
    94
    78.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by BBcan177

      To enable the new DNSBL python integration, goto the DNSBL Tab, and change the "DNSBL Mode" from "Unbound mode" to "Unbound Python mode", then select the Python integration options below that you want to use. Click on the blue infoblock icons for details about each feature.

      Follow that with a Force Reload-DNSBL. Then check to ensure that the Unbound service is running, and that there are no errors reported in the pfBlockerNG widget. If there are any issues, you can easily revert back to the "Unbound mode" followed by a Force Reload-DNSBL.

      You do not need to touch any Unbound python mode settings in the DNS Resolver. Those are handled automatically by the package.

      To clear the DNSBL Python log/Dashboard widget warning, goto the "Logs" Tab, Select the log type as "Log Files", select "py_error.log" and click the trashcan Icon.

      If you experience any issues, report back with what version of pfSense you use, and as much detail as possible about the issue.

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 1
      • M
        mcury
        last edited by

        Hello BBcan177, thanks for the new version.
        My unbound is not starting, can you help me?

        DHCP Registration disabled
        Static DHCP disabled
        DNS Query Forwarding disabled
        DNSSEC enabled
        Network Interfaces ALL
        Outgoing Network Interfaces WAN
        Enable SSL/TLS Service disabled
        Python Module disabled

        System:
        SG-3100 running 2.4.5p1
        Updated from pfBlockerNG-devel from 2.2.5_37 to this version.

        System logs:

        Nov 24 13:25:49	php		[pfBlockerNG] Restarting firewall filter daemon
Nov 24 13:25:49	php		/etc/rc.packages: Successfully installed package: pfBlockerNG-devel.
Nov 24 13:25:49	pkg-static		pfSense-pkg-pfBlockerNG-devel upgraded: 2.2.5_37 -> 3.0.0
Nov 24 13:25:51	check_reload_status		Reloading filter
Nov 24 13:25:51	check_reload_status		Starting packages
Nov 24 13:25:52	php-fpm	35129	/rc.start_packages: Restarting/Starting all packages.
<clipped>
Nov 24 13:25:56	lighttpd_pfb		[pfBlockerNG] DNSBL Webserver started

        Unbound logs:

        Nov 24 13:23:48	unbound	74847:0	fatal error: could not open autotrust file for writing, /root.key.74847-0-20e70140: Permission denied
Nov 24 13:25:40	unbound	2477:0	warning: unbound is already running as pid 74847.
Nov 24 13:25:47	unbound	3440:0	notice: init module 0: validator
Nov 24 13:25:47	unbound	3440:0	notice: init module 1: iterator
Nov 24 13:25:47	unbound	3440:0	info: start of service (unbound 1.10.1).
Nov 24 13:25:48	unbound	3440:1	info: generate keytag query _ta-4f66. NULL IN
Nov 24 13:25:48	unbound	3440:1	fatal error: could not open autotrust file for writing, /root.key.3440-1-20c16e60: Permission denied
Nov 24 13:28:59	unbound	31878:0	notice: init module 0: validator
Nov 24 13:28:59	unbound	31878:0	notice: init module 1: iterator
Nov 24 13:28:59	unbound	31878:0	info: start of service (unbound 1.10.1).
Nov 24 13:29:02	unbound	31878:1	info: generate keytag query _ta-4f66. NULL IN
Nov 24 13:29:02	unbound	31878:1	fatal error: could not open autotrust file for writing, /root.key.31878-1-20e70140: Permission denied
Nov 24 14:35:52	unbound	5005:0	notice: init module 0: validator
Nov 24 14:35:52	unbound	5005:0	notice: init module 1: iterator
Nov 24 14:35:52	unbound	5005:0	info: start of service (unbound 1.10.1).
Nov 24 14:35:53	unbound	5005:0	info: generate keytag query _ta-4f66. NULL IN
Nov 24 14:35:53	unbound	5005:0	fatal error: could not open autotrust file for writing, /root.key.5005-0-20e70140: Permission denied

        Unbound Custom Options:

        server:
do-ip6:no
    access-control-view: 192.168.10.0/24 bypass
    access-control-view: 192.168.20.0/24 dnsbl
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
    include: /var/unbound/pfb_dnsbl.*conf

        dead on arrival, nowhere to be found.

        1 Reply Last reply Reply Quote 2
        • BBcan177B
          BBcan177 Moderator
          last edited by

          I am checking with the pfSense devs if something changed for the Unbound folder permissions.

          Try to run this cmd and try it:

          chown unbound:unbound /var/unbound

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          T 1 Reply Last reply Reply Quote 1
          • T
            torluda @BBcan177
            last edited by

            @BBcan177 I can confirm that Unbound restarted successfully after I ran the command you provided.

            BBcan177B 1 Reply Last reply Reply Quote 1
            • BBcan177B
              BBcan177 Moderator @torluda
              last edited by

              @torluda
              Update to v3.0.0_1 which should fix this issue.

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              T M 2 Replies Last reply Reply Quote 4
              • T
                torluda @BBcan177
                last edited by torluda

                @BBcan177 Updated to 3.0.0_1 and Unbound restart confirmed. Thank you.

                1 Reply Last reply Reply Quote 1
                • M
                  mcury @BBcan177
                  last edited by

                  @BBcan177 Thanks BBCan177, I can confirm the same as torluda, Unbound started.

                  dead on arrival, nowhere to be found.

                  1 Reply Last reply Reply Quote 0
                  • T
                    three
                    last edited by

                    I just moved to new HW. When I recovered my settings also pfBlockerNG was installed, v3.0.0 ... and I got trapped by this unbound permissions error.

                    Without knowing, I wiped everything again, recovered my settings, and v3.0.0_1 was installed, which now works as before 😂

                    That's called timing ... hehe

                    Thanx @BBcan177 ... this is a great peace of software !!!

                    1 Reply Last reply Reply Quote 0
                    • G
                      gabacho4 Rebel Alliance
                      last edited by

                      Had a working installation of 3.0. updated to 3.0_1 and it hangs. Pfsense package manager tells me I still can upgrade to the latest but, as best I can tell, pfblocker is no longer installed as I have nothing in the firewall section. I've rebooted the router to no avail. Output from the upgrade attempt is:

                      Package Reinstallation

                      Upgrading pfSense-pkg-pfBlockerNG-devel...
                      Updating pfSense-core repository catalogue...
                      pfSense-core repository is up to date.
                      Updating pfSense repository catalogue...
                      pfSense repository is up to date.
                      All repositories are up to date.
                      Checking integrity... done (0 conflicting)
                      The following 1 package(s) will be affected (of 0 checked):

                      Installed packages to be UPGRADED:
                      pfSense-pkg-pfBlockerNG-devel: 3.0.0 -> 3.0.0_1 [pfSense]

                      Number of packages to be upgraded: 1
                      [1/1] Upgrading pfSense-pkg-pfBlockerNG-devel from 3.0.0 to 3.0.0_1...
                      [1/1] Extracting pfSense-pkg-pfBlockerNG-devel-3.0.0_1: .......... done
                      Removing pfBlockerNG-devel components...
                      Menu items... done.
                      Services... done.
                      Loading package instructions...
                      Removing pfBlockerNG...cat: /var/unbound/pfb_py_zone.txt: No such file or directory
                      All customizations/data will be retained... done.

                      BBcan177B 1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator @gabacho4
                        last edited by

                        @gabacho4
                        Run this cmd:
                        chown unbound:unbound /var/unbound
                        And restart Unbound

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • G
                          gabacho4 Rebel Alliance
                          last edited by

                          That worked as far as getting the package to show that it's at the latest version. I still don't have pfblocker to config or view in mt Firewall tab. Any further steps to follow? Should I just uninstall and reinstall? Thanks for the quick assistance!

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            Re-install v3.0.0_1 and see how that goes

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            G 1 Reply Last reply Reply Quote 0
                            • G
                              gabacho4 Rebel Alliance @BBcan177
                              last edited by

                              @BBcan177 that appears to have taken. Phew! Thanks again!

                              1 Reply Last reply Reply Quote 0
                              • M
                                mcury
                                last edited by

                                Is anyone using the Unbound Python Mode in pfBlockerng?
                                Do I need to enable the Python Module in DNS Resolver to use it?

                                If someone is using this python mode, what really changes despite of the RAM usage?
                                Any feedback about it?

                                dead on arrival, nowhere to be found.

                                RonpfSR 1 Reply Last reply Reply Quote 0
                                • RonpfSR
                                  RonpfS @mcury
                                  last edited by RonpfS

                                  @mcury You only enable it in DNSBL, then run a Force Update and a Force Reload ALL to be on the safe side.

                                  You will get more features, Cron update are faster and unbound start in a matter of seconds, so less DNS services interruption.

                                  2.4.5-RELEASE-p1 (amd64)
                                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                  M 1 Reply Last reply Reply Quote 1
                                  • M
                                    mcury @RonpfS
                                    last edited by

                                    @RonpfS Thanks, enabled and ran the force reload all, it's already running :)

                                    dead on arrival, nowhere to be found.

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      HieuLe
                                      last edited by

                                      After upgrading to new version, i cannot exclude 1 IP address in DNSBL

                                      Custom Option:
                                      server:
                                      access-control-view: 172.16.10.0/24 bypass
                                      access-control-view: 172.16.200.0/24 dnsbl
                                      access-control-view: 172.16.200.1/32 bypass
                                      access-control-view: 172.16.100.0/24 dnsbl
                                      view:
                                      name: "bypass"
                                      view-first: yes
                                      view:
                                      name: "dnsbl"
                                      view-first: yes

                                      1 Reply Last reply Reply Quote 0
                                      • RonpfSR
                                        RonpfS
                                        last edited by 

                                        CAUTIONS:

2.
The DNS Resolver Unbound "Views" feaure it not currently compatable with DNSBL Python mode. The "Views" feature will be incorporated into the new Python Mode in future.

                                        2.4.5-RELEASE-p1 (amd64)
                                        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mlines
                                          last edited by

                                          I'm trying to apply the update but the Package Reinstallation is hanging: Please wait while the update system initializes. I've waited over 30 minutes and tried rebooting the SG-1100 without success. Any ideas?

                                          1 Reply Last reply Reply Quote 0
                                          • ?
                                            A Former User
                                            last edited by

                                            Thank you for the update and the effort you put into this project. This add-on is one of the main reasons I stick with pfSense.

                                            We have a bunch of remote Sites running non-pfSense VPN Router with integrated DSL Modem. This remotes Sites are connected to our Data Centers by routed IPsec VPN, terminate on the pfSense where the DNS-Resolver with pfb enabled is hosted. Each site has a local resolver and forwards all queries for public domains to the pfSense in the Data Center over the VPN Tunnel.

                                            @BBcan177 said in pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!:

                                            DNSBL Web Server is now bound to localhost instead of 0.0.0.0

                                            Unfortunately this change breaks the usage of pfBlockerNG over IPsec for good. I cannot get the web server to reply to connections which come in over VPN.
                                            Out of the box it doesn't work at all but with a custom NAT config it can be make functional.
                                            When the Web Server is bounded on all Interfaces it was possible make this work by placing NAT Rules before the system generated rules to redirect the Traffic to the High Ports of the DNSBL VIP.

                                            rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = http -> 10.255.255.12 port 8081
rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = https -> 10.255.255.12 port 8443

                                            This was enough to get it working for Policy based VPN. If using VTIs for IPsec an addition floating rule with no state is necessary to allow the return traffic.

                                            pass out quick on enc0 inet proto tcp from 10.255.255.12 to <net_vpn_all> port >= 1024 no state label "USER_RULE: Allow Stateless Replies from DNSBL VIP"

                                            I do understand that this is a limitation of pfSense/FreeBSD VPN and not a pfBlockerNG problem. Anyway it is possible to make the binding of Web Server to all interface or loopback a configurable option for future release?
                                            If not - does anybody have an idea how to get this work when the service is bound to a loopback?

                                            BBcan177B 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.