pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!

mcury

Hello BBcan177, thanks for the new version.
My unbound is not starting, can you help me?

DHCP Registration disabled
Static DHCP disabled
DNS Query Forwarding disabled
DNSSEC enabled
Network Interfaces ALL
Outgoing Network Interfaces WAN
Enable SSL/TLS Service disabled
Python Module disabled

System:
SG-3100 running 2.4.5p1
Updated from pfBlockerNG-devel from 2.2.5_37 to this version.

System logs:

Nov 24 13:25:49	php		[pfBlockerNG] Restarting firewall filter daemon
Nov 24 13:25:49	php		/etc/rc.packages: Successfully installed package: pfBlockerNG-devel.
Nov 24 13:25:49	pkg-static		pfSense-pkg-pfBlockerNG-devel upgraded: 2.2.5_37 -> 3.0.0
Nov 24 13:25:51	check_reload_status		Reloading filter
Nov 24 13:25:51	check_reload_status		Starting packages
Nov 24 13:25:52	php-fpm	35129	/rc.start_packages: Restarting/Starting all packages.
<clipped>
Nov 24 13:25:56	lighttpd_pfb		[pfBlockerNG] DNSBL Webserver started

Unbound logs:

Nov 24 13:23:48	unbound	74847:0	fatal error: could not open autotrust file for writing, /root.key.74847-0-20e70140: Permission denied
Nov 24 13:25:40	unbound	2477:0	warning: unbound is already running as pid 74847.
Nov 24 13:25:47	unbound	3440:0	notice: init module 0: validator
Nov 24 13:25:47	unbound	3440:0	notice: init module 1: iterator
Nov 24 13:25:47	unbound	3440:0	info: start of service (unbound 1.10.1).
Nov 24 13:25:48	unbound	3440:1	info: generate keytag query _ta-4f66. NULL IN
Nov 24 13:25:48	unbound	3440:1	fatal error: could not open autotrust file for writing, /root.key.3440-1-20c16e60: Permission denied
Nov 24 13:28:59	unbound	31878:0	notice: init module 0: validator
Nov 24 13:28:59	unbound	31878:0	notice: init module 1: iterator
Nov 24 13:28:59	unbound	31878:0	info: start of service (unbound 1.10.1).
Nov 24 13:29:02	unbound	31878:1	info: generate keytag query _ta-4f66. NULL IN
Nov 24 13:29:02	unbound	31878:1	fatal error: could not open autotrust file for writing, /root.key.31878-1-20e70140: Permission denied
Nov 24 14:35:52	unbound	5005:0	notice: init module 0: validator
Nov 24 14:35:52	unbound	5005:0	notice: init module 1: iterator
Nov 24 14:35:52	unbound	5005:0	info: start of service (unbound 1.10.1).
Nov 24 14:35:53	unbound	5005:0	info: generate keytag query _ta-4f66. NULL IN
Nov 24 14:35:53	unbound	5005:0	fatal error: could not open autotrust file for writing, /root.key.5005-0-20e70140: Permission denied

Unbound Custom Options:

server:
do-ip6:no
    access-control-view: 192.168.10.0/24 bypass
    access-control-view: 192.168.20.0/24 dnsbl
view:
    name: "bypass"
    view-first: yes
view:
    name: "dnsbl"
    view-first: yes
    include: /var/unbound/pfb_dnsbl.*conf

BBcan177

I am checking with the pfSense devs if something changed for the Unbound folder permissions.

Try to run this cmd and try it:

chown unbound:unbound /var/unbound

torluda

@BBcan177 I can confirm that Unbound restarted successfully after I ran the command you provided.

BBcan177

@torluda
Update to v3.0.0_1 which should fix this issue.

torluda

@BBcan177 Updated to 3.0.0_1 and Unbound restart confirmed. Thank you.

mcury

@BBcan177 Thanks BBCan177, I can confirm the same as torluda, Unbound started.

three

I just moved to new HW. When I recovered my settings also pfBlockerNG was installed, v3.0.0 ... and I got trapped by this unbound permissions error.

Without knowing, I wiped everything again, recovered my settings, and v3.0.0_1 was installed, which now works as before

That's called timing ... hehe

Thanx @BBcan177 ... this is a great peace of software !!!

gabacho4

Had a working installation of 3.0. updated to 3.0_1 and it hangs. Pfsense package manager tells me I still can upgrade to the latest but, as best I can tell, pfblocker is no longer installed as I have nothing in the firewall section. I've rebooted the router to no avail. Output from the upgrade attempt is:

Package Reinstallation

Upgrading pfSense-pkg-pfBlockerNG-devel...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
pfSense-pkg-pfBlockerNG-devel: 3.0.0 -> 3.0.0_1 [pfSense]

Number of packages to be upgraded: 1
[1/1] Upgrading pfSense-pkg-pfBlockerNG-devel from 3.0.0 to 3.0.0_1...
[1/1] Extracting pfSense-pkg-pfBlockerNG-devel-3.0.0_1: .......... done
Removing pfBlockerNG-devel components...
Menu items... done.
Services... done.
Loading package instructions...
Removing pfBlockerNG...cat: /var/unbound/pfb_py_zone.txt: No such file or directory
All customizations/data will be retained... done.

BBcan177

@gabacho4
Run this cmd:
chown unbound:unbound /var/unbound
And restart Unbound

gabacho4

That worked as far as getting the package to show that it's at the latest version. I still don't have pfblocker to config or view in mt Firewall tab. Any further steps to follow? Should I just uninstall and reinstall? Thanks for the quick assistance!

BBcan177

Re-install v3.0.0_1 and see how that goes

gabacho4

@BBcan177 that appears to have taken. Phew! Thanks again!

mcury

Is anyone using the Unbound Python Mode in pfBlockerng?
Do I need to enable the Python Module in DNS Resolver to use it?

If someone is using this python mode, what really changes despite of the RAM usage?
Any feedback about it?

RonpfS

@mcury You only enable it in DNSBL, then run a Force Update and a Force Reload ALL to be on the safe side.

You will get more features, Cron update are faster and unbound start in a matter of seconds, so less DNS services interruption.

mcury

@RonpfS Thanks, enabled and ran the force reload all, it's already running :)

HieuLe

After upgrading to new version, i cannot exclude 1 IP address in DNSBL

Custom Option:
server:
access-control-view: 172.16.10.0/24 bypass
access-control-view: 172.16.200.0/24 dnsbl
access-control-view: 172.16.200.1/32 bypass
access-control-view: 172.16.100.0/24 dnsbl
view:
name: "bypass"
view-first: yes
view:
name: "dnsbl"
view-first: yes

RonpfS

CAUTIONS:

2.
The DNS Resolver Unbound "Views" feaure it not currently compatable with DNSBL Python mode. The "Views" feature will be incorporated into the new Python Mode in future.

mlines

I'm trying to apply the update but the Package Reinstallation is hanging: Please wait while the update system initializes. I've waited over 30 minutes and tried rebooting the SG-1100 without success. Any ideas?

A Former User

Thank you for the update and the effort you put into this project. This add-on is one of the main reasons I stick with pfSense.

We have a bunch of remote Sites running non-pfSense VPN Router with integrated DSL Modem. This remotes Sites are connected to our Data Centers by routed IPsec VPN, terminate on the pfSense where the DNS-Resolver with pfb enabled is hosted. Each site has a local resolver and forwards all queries for public domains to the pfSense in the Data Center over the VPN Tunnel.

@BBcan177 said in pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!:

DNSBL Web Server is now bound to localhost instead of 0.0.0.0

Unfortunately this change breaks the usage of pfBlockerNG over IPsec for good. I cannot get the web server to reply to connections which come in over VPN.
Out of the box it doesn't work at all but with a custom NAT config it can be make functional.
When the Web Server is bounded on all Interfaces it was possible make this work by placing NAT Rules before the system generated rules to redirect the Traffic to the High Ports of the DNSBL VIP.

rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = http -> 10.255.255.12 port 8081
rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = https -> 10.255.255.12 port 8443

This was enough to get it working for Policy based VPN. If using VTIs for IPsec an addition floating rule with no state is necessary to allow the return traffic.

pass out quick on enc0 inet proto tcp from 10.255.255.12 to <net_vpn_all> port >= 1024 no state label "USER_RULE: Allow Stateless Replies from DNSBL VIP"

I do understand that this is a limitation of pfSense/FreeBSD VPN and not a pfBlockerNG problem. Anyway it is possible to make the binding of Web Server to all interface or loopback a configurable option for future release?
If not - does anybody have an idea how to get this work when the service is bound to a loopback?

BBcan177

@Artes

I can add this as an option in the next release as time permits.

In the meantime, you can edit the code to revert to 0.0.0.0.

Edit the file:
/usr/local/pkg/pfblockerng/pfblockerng.inc

At line #1097 there is a function that builds the Lighttpd configuration file:

function pfb_create_lighttpd() {
}

In that function you can change the lines with "127.0.0.1" to "0.0.0.0"

and change "::1" to "::/0" for IPv6. (haven't tested that myself, so hoping that this is the correct IPv6 address)

In the same file:

Edit line #1308:

From:
'target' => '127.0.0.1',
To:
'target' => '0.0.0.0',

Edit line #1322:

From:
'target' => '::1',
To:
'target' => '::/0',

Hope this works for you, Thanks for using the package, and and any support is appreciated.