Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    blocked domain not by pfblocker

    Scheduled Pinned Locked Moved DHCP and DNS
    16 Posts 4 Posters 1.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DaddyGoD
      DaddyGo @Gertjan
      last edited by

      @gertjan said in blocked domain not by pfblocker:

      edited the title

      yes, this is worth doing 😉

      Cats bury it so they can't see it!
      (You know what I mean if you have a cat)

      1 Reply Last reply Reply Quote 0
      • S
        scorpoin @Gertjan
        last edited by scorpoin

        @gertjan Now again same block issuewith

        seal.verisign.com

        and I've check in report then filter no use could not find it . I've checked all log files in /var/log/pfblocker/ as well , I could not find it there. Why this strange behavior am I missing some thing. Or it is kind of a bug or something.

        Regards

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @scorpoin
          last edited by

          @scorpoin said in blocked domain not by pfblocker:

          Or it is kind of a bug or something.

          Why wondering ?

          All you need is a keyboard and type on your PC :

          C:\Users\Gauche>nslookup seal.verisign.com
Serveur :   pfsense.brit-hotel-fumel.net
Address:  2001:470:1f13:5c0:2::1

Réponse ne faisant pas autorité :
Nom :    e19.e2.akamaiedge.net
Address:  96.7.226.30
Aliases:  seal.verisign.com
          seal.verisign.com.edgekey.net

          About pfBlockerNg : the "program" ; when you install it, it does nothing at all.
          It actually starts when the admin start filling it up. The main question is : with what - what's in these list ??
          If pfBlockerNG was blocking, you would see this :

          C:\Users\Gauche>nslookup seal.verisign.com
Serveur :   pfsense.brit-hotel-fumel.net
Address:  2001:470:1f13:5c0:2::1

Nom :    seal.verisign.com
Address:  10.10.10.1

          Note : that is, if 10.10.10.1 is the default pfBlockerNG web server and you kept related settings to default.

          @scorpoin said in blocked domain not by pfblocker:

          I've checked all log files in /var/log/pfblocker/ as well , I could not find it there

          Look again : Firewall > pfBlockerNG > Log Browser and look at the dns_reply.log :

          5336f6a6-f1c6-46a1-afa1-c9465c5ebf30-image.png

          Btw : I'm using the newer Python mode - not the older Unbound mode.
          This is checked :
          166840aa-6b10-4cbb-8ea0-e0b2d731cc2e-image.png

          And one sure thing : I'm using the resolver with (close to) default settings.

          You are using pfBlockerNG-devel 3.0.0_8, right ?

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          S 1 Reply Last reply Reply Quote 0
          • S
            scorpoin @Gertjan
            last edited by

            @gertjan said in blocked domain not by pfblocker:

            @scorpoin said in blocked domain not by pfblocker:

            Or it is kind of a bug or something.

            Why wondering ?

            All you need is a keyboard and type on your PC :

            C:\Users\Gauche>nslookup seal.verisign.com
Serveur :   pfsense.brit-hotel-fumel.net
Address:  2001:470:1f13:5c0:2::1

Réponse ne faisant pas autorité :
Nom :    e19.e2.akamaiedge.net
Address:  96.7.226.30
Aliases:  seal.verisign.com
          seal.verisign.com.edgekey.net

            About pfBlockerNg : the "program" ; when you install it, it does nothing at all.
            It actually starts when the admin start filling it up. The main question is : with what - what's in these list ??
            If pfBlockerNG was blocking, you would see this :

            C:\Users\Gauche>nslookup seal.verisign.com
Serveur :   pfsense.brit-hotel-fumel.net
Address:  2001:470:1f13:5c0:2::1

Nom :    seal.verisign.com
Address:  10.10.10.1

            Note : that is, if 10.10.10.1 is the default pfBlockerNG web server and you kept related settings to default.

            @scorpoin said in blocked domain not by pfblocker:

            I've checked all log files in /var/log/pfblocker/ as well , I could not find it there

            Look again : Firewall > pfBlockerNG > Log Browser and look at the dns_reply.log :

            5336f6a6-f1c6-46a1-afa1-c9465c5ebf30-image.png

            Btw : I'm using the newer Python mode - not the older Unbound mode.
            This is checked :
            166840aa-6b10-4cbb-8ea0-e0b2d731cc2e-image.png

            And one sure thing : I'm using the resolver with (close to) default settings.

            You are using pfBlockerNG-devel 3.0.0_8, right ?

            Yes you are right. is there any problem with that version?. I've added that URL into whitelist now waiting for an other surprise :D.

            Regards

            GertjanG 1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @scorpoin
              last edited by

              @scorpoin said in blocked domain not by pfblocker:

              I've added that URL into whitelist

              Or remove the feed that blocks a domain name like "verisign.com", as we would all agree that blocking Verisign would be plain stupid. Consider this feed as hacked.

              Btw : IP's like 8.8.8.8 were recently seen on some IP lists. Although I can somewhat understand that one, you can image that that really hurts all those 'ignorants' that use 8.8.8.8 for dpinger Monitoring IP which is of course a big "don't do that". Now they know why.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              S 1 Reply Last reply Reply Quote 0
              • S
                scorpoin @Gertjan
                last edited by

                @gertjan I agreed but issue is I was unable to find that in any list of feed thats strange , even I looked up logs files of pfblocker

                fgrep "verisign" /var/log/pfblocker -R

                nothing found so far

                J 1 Reply Last reply Reply Quote 0
                • J
                  jdeloach @scorpoin
                  last edited by jdeloach

                  This post is deleted!
                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @jdeloach
                    last edited by

                    Hmmmmmm

                    [2.4.5-RELEASE][root@pfsense.brit-hotel-fumel.net]/root: grep "verisign" /var/db/pfblockerng/dnsbl/*.txt /var/db/pfblockerng/dnsblorig/*.orig /var/unbound/pfb_dnsbl.conf /usr/local/pkg/pfblockerng/dnsbl_tld
/var/db/pfblockerng/dnsblorig/MVPS.orig:0.0.0.0 verisignwildcard.112.2o7.net #[sitefinder.verisign.com]
/var/db/pfblockerng/dnsblorig/OISD.orig:0.0.0.0 oracleverisign.com
/var/db/pfblockerng/dnsblorig/OISD.orig:0.0.0.0 verisign.bfast.com
/var/db/pfblockerng/dnsblorig/OISD.orig:0.0.0.0 verisign.tt.omtrdc.net
/var/db/pfblockerng/dnsblorig/OISD.orig:0.0.0.0 verisignwildcard.112.2o7.net
/var/db/pfblockerng/dnsblorig/OISD.orig:0.0.0.0 www.oracleverisign.com
/var/db/pfblockerng/dnsblorig/SWC.orig:#127.0.0.1 sitefinder.verisign.com       # Verisign has joined the game
/var/db/pfblockerng/dnsblorig/SWC.orig:#127.0.0.1 sitefinder-idn.verisign.com   # of trying to hijack mistyped
/var/db/pfblockerng/dnsblorig/SWC.orig:127.0.0.1 verisignwildcard.112.2o7.net
/var/db/pfblockerng/dnsblorig/oisd_nl.orig:verisign.bfast.com
/var/db/pfblockerng/dnsblorig/oisd_nl.orig:verisign.tt.omtrdc.net
/var/db/pfblockerng/dnsblorig/oisd_nl.orig:verisignwildcard.112.2o7.net

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    S 2 Replies Last reply Reply Quote 0
                    • S
                      scorpoin @Gertjan
                      last edited by

                      This post is deleted!
                      1 Reply Last reply Reply Quote 0
                      • S
                        scorpoin @Gertjan
                        last edited by scorpoin

                        This post is deleted!
                        1 Reply Last reply Reply Quote 0
                        • S
                          scorpoin
                          last edited by scorpoin

                          @gertjan well strange after moving to latested 3.0.0.8 pfblockerng-devel . Things have chagned .

                          nslookup facebook.com
Server:  pfSense.local.landomain
Address:  172.16.159.254

Name:    facebook.com
Addresses:  ::10.10.10.1
          10.10.10.1

                          When accessing it via brower Im able to broser facebook , youtube etc. which have been blocked in older version :/ . Do I need any extra cnfig to make it work. I'm using unresolver as DNS should I disable it?

                          Stopping Unbound Resolver..............................
Additional mounts (DNSBL python):
  No changes required.
Starting Unbound Resolver.
DNSBL enabled FAIL  *** Fix error(s) and a Force Reload required! ***


====================

[1610791470] unbound[39902:0] error: bind: address already in use
[1610791470] unbound[39902:0] fatal error: could not open ports

                          Now revert back the setting to unbound from python.
                          Regards

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.