Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!

    Scheduled Pinned Locked Moved pfBlockerNG
    94 Posts 27 Posters 88.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mcury Rebel Alliance @RonpfS
      last edited by

      @RonpfS Thanks, enabled and ran the force reload all, it's already running :)

      dead on arrival, nowhere to be found.

      1 Reply Last reply Reply Quote 0
      • H
        HieuLe
        last edited by

        After upgrading to new version, i cannot exclude 1 IP address in DNSBL

        Custom Option:
        server:
        access-control-view: 172.16.10.0/24 bypass
        access-control-view: 172.16.200.0/24 dnsbl
        access-control-view: 172.16.200.1/32 bypass
        access-control-view: 172.16.100.0/24 dnsbl
        view:
        name: "bypass"
        view-first: yes
        view:
        name: "dnsbl"
        view-first: yes

        1 Reply Last reply Reply Quote 0
        • RonpfSR
          RonpfS
          last edited by 

          CAUTIONS:

2.
The DNS Resolver Unbound "Views" feaure it not currently compatable with DNSBL Python mode. The "Views" feature will be incorporated into the new Python Mode in future.
          1 Reply Last reply Reply Quote 0
          • M
            mlines
            last edited by

            I'm trying to apply the update but the Package Reinstallation is hanging: Please wait while the update system initializes. I've waited over 30 minutes and tried rebooting the SG-1100 without success. Any ideas?

            1 Reply Last reply Reply Quote 0
            • ?
              A Former User
              last edited by

              Thank you for the update and the effort you put into this project. This add-on is one of the main reasons I stick with pfSense.

              We have a bunch of remote Sites running non-pfSense VPN Router with integrated DSL Modem. This remotes Sites are connected to our Data Centers by routed IPsec VPN, terminate on the pfSense where the DNS-Resolver with pfb enabled is hosted. Each site has a local resolver and forwards all queries for public domains to the pfSense in the Data Center over the VPN Tunnel.

              @BBcan177 said in pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!:

              DNSBL Web Server is now bound to localhost instead of 0.0.0.0

              Unfortunately this change breaks the usage of pfBlockerNG over IPsec for good. I cannot get the web server to reply to connections which come in over VPN.
              Out of the box it doesn't work at all but with a custom NAT config it can be make functional.
              When the Web Server is bounded on all Interfaces it was possible make this work by placing NAT Rules before the system generated rules to redirect the Traffic to the High Ports of the DNSBL VIP.

              rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = http -> 10.255.255.12 port 8081
rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = https -> 10.255.255.12 port 8443

              This was enough to get it working for Policy based VPN. If using VTIs for IPsec an addition floating rule with no state is necessary to allow the return traffic.

              pass out quick on enc0 inet proto tcp from 10.255.255.12 to <net_vpn_all> port >= 1024 no state label "USER_RULE: Allow Stateless Replies from DNSBL VIP"

              I do understand that this is a limitation of pfSense/FreeBSD VPN and not a pfBlockerNG problem. Anyway it is possible to make the binding of Web Server to all interface or loopback a configurable option for future release?
              If not - does anybody have an idea how to get this work when the service is bound to a loopback?

              BBcan177B 1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator @A Former User
                last edited by

                @Artes

                I can add this as an option in the next release as time permits.

                In the meantime, you can edit the code to revert to 0.0.0.0.

                Edit the file:
                /usr/local/pkg/pfblockerng/pfblockerng.inc

                At line #1097 there is a function that builds the Lighttpd configuration file:

                function pfb_create_lighttpd() {
                }

                In that function you can change the lines with "127.0.0.1" to "0.0.0.0"

                and change "::1" to "::/0" for IPv6. (haven't tested that myself, so hoping that this is the correct IPv6 address)

                In the same file:

                Edit line #1308:

                From:
                'target' => '127.0.0.1',
                To:
                'target' => '0.0.0.0',

                Edit line #1322:

                From:
                'target' => '::1',
                To:
                'target' => '::/0',

                Hope this works for you, Thanks for using the package, and and any support is appreciated.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                ? 1 Reply Last reply Reply Quote 0
                • Cool_CoronaC
                  Cool_Corona
                  last edited by

                  I get to this...and then it takes forever...

                  [ DoH ] Downloading update [ 11/25/20 20:02:51 ] . cURL Error: 35
                  OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to heuristicsecurity.com:443 Retry in 5 seconds...
                  . cURL Error: 35
                  OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to heuristicsecurity.com:443 Retry in 5 seconds...
                  . cURL Error: 35
                  OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to heuristicsecurity.com:443 Retry in 5 seconds...
                  .. unknown http status code | 0

                  [ DNSBL_DoH - DoH ] Download FAIL [ 11/25/20 20:03:06 ]
                  Firewall and/or IDS (Legacy mode only) are not blocking download.

                  Restoring previously downloaded file

                  No Domains Found! Ensure only domain based Feeds are used for DNSBL!

                  Assembling DNSBL database...... completed [ 11/25/20 20:03:19 ]
                  TLD:
                  TLD analysis.............................. completed [ 11/25/20 20:08:33 ]
                  TLD finalize.......................

                  1 Reply Last reply Reply Quote 0
                  • RonpfSR
                    RonpfS
                    last edited by

                    From the CHANGELOG :

                    FEEDS:
        Removed discontinued Heuristic Security DoH Feed

                    Remove this URL. Use the Feeds tab to update your Groups

                    1 Reply Last reply Reply Quote 0
                    • V
                      vjizzle
                      last edited by

                      Hi,

                      Do we have CNAME blocking now? Thanks and as always amazing job!

                      BBcan177B 1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator @vjizzle
                        last edited by

                        @vjizzle
                        Yes its there in the DNSBL Tab with the other Unbound Python mode features.

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • ?
                          A Former User @BBcan177
                          last edited by

                          @BBcan177 said in pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!:

                          Edit the file:
                          /usr/local/pkg/pfblockerng/pfblockerng.inc
                          At line #1097 there is a function that builds the Lighttpd configuration file:
                          function pfb_create_lighttpd() {
                          }

                          Editing this function works fine for me. There is no need to edit lines #1308 and #1322 - These are for the NAT Rules and should stay as they are.

                          Thank you!

                          1 Reply Last reply Reply Quote 0
                          • M
                            mlines
                            last edited by

                            This post is deleted!
                            1 Reply Last reply Reply Quote 0
                            • S
                              SachaH
                              last edited by

                              First of all, great job on this release!

                              I'm currently running 3.0.0_1 with 'Unbound python mode' enabled in DNSBL.
                              While viewing the Reports tab I saw that the If and Source columns show 'Unknown' within the DNSBL Python alert entry's.

                              Any suggestion how the fix this?

                              RonpfSR 1 Reply Last reply Reply Quote 0
                              • RonpfSR
                                RonpfS @SachaH
                                last edited by

                                @SachaH said in pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!:

                                Reports tab I saw that the If and Source columns show 'Unknown' within the DNSBL Python alert entry's.

                                https://forum.netgate.com/topic/158597/interface-and-source-is-unknown-running-devel-3-0-1/5

                                S 1 Reply Last reply Reply Quote 1
                                • S
                                  SachaH @RonpfS
                                  last edited by

                                  @RonpfS Thanks 👍 😊

                                  1 Reply Last reply Reply Quote 0
                                  • RonpfSR
                                    RonpfS
                                    last edited by

                                    also https://www.reddit.com/r/pfBlockerNG/comments/k1137y/reports_dnsbl_python_unknown/

                                    RonpfSR 1 Reply Last reply Reply Quote 1
                                    • RonpfSR
                                      RonpfS @RonpfS
                                      last edited by RonpfS

                                      This post is deleted!
                                      1 Reply Last reply Reply Quote 0
                                      • RonpfSR
                                        RonpfS
                                        last edited by

                                        and https://www.patreon.com/posts/nov-update-43770381

                                        1 Reply Last reply Reply Quote 1
                                        • H
                                          HuskerDu
                                          last edited by

                                          Thanks BBcan177 for your great work,

                                          For info, get yellow icon for DNSBL widget due to following error.

                                          2020-11-27 21:33:25,736|ERROR| [pfBlockerNG]: Failed get_q_name_qinfo: in method '_get_qname', argument 1 of type 'struct query_info *'
                                          BBcan177B 1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator @HuskerDu
                                            last edited by

                                            @HuskerDu
                                            Do you have any of these options enabled in the DNS Resolver?

                                            DHCP Registration:

                                            • Static DHCP
                                            • OpenVPN Clients

                                            If so, disable those options, clear the py_error log and Force Reload - DNSBL and see if the error returns.

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            H 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.