PfBlockerNG v2.1 w/TLD
-
Trying to figure out pfblocker on CARP….
I've used this extensively on single installs but not via CARP. Are there any considerations I should take into account? I was told by pfsense support when I first installed that firewalls should mirror (ie. have pfblocker installed on both, etc.)
Am I ok to configure FW1 on 10.0.10.1 with whatever pfblocker stuff I want then simply sync to 10.0.10.2 (FW2?) I don't have to worry about the CARP interface or sync issues between this package and that right (let's say CARP interface is on 10.0.10.250) -
Trying to figure out pfblocker on CARP….
I've used this extensively on single installs but not via CARP. Are there any considerations I should take into account? I was told by pfsense support when I first installed that firewalls should mirror (ie. have pfblocker installed on both, etc.)
Am I ok to configure FW1 on 10.0.10.1 with whatever pfblocker stuff I want then simply sync to 10.0.10.2 (FW2?) I don't have to worry about the CARP interface or sync issues between this package and that right (let's say CARP interface is on 10.0.10.250)Hi blueduckdock,
You can use CARP/HA in pfSense without issue. The package has an XMLRPC sync Tab that allows for the configuration of the package to be sync'd to other boxes… But with the current DNSBL code, this will cause issues with the DNSBL VIP, as both pfSense boxes will have the same DNSBL VIP address..
I had one user several months ago ask if this could be addressed and I did create a patch to get this addressed... If you are able to test it out, shoot me a PM if that works for you...
-
Trying to figure out pfblocker on CARP….
I've used this extensively on single installs but not via CARP. Are there any considerations I should take into account? I was told by pfsense support when I first installed that firewalls should mirror (ie. have pfblocker installed on both, etc.)
Am I ok to configure FW1 on 10.0.10.1 with whatever pfblocker stuff I want then simply sync to 10.0.10.2 (FW2?) I don't have to worry about the CARP interface or sync issues between this package and that right (let's say CARP interface is on 10.0.10.250)Hi blueduckdock,
You can use CARP/HA in pfSense without issue. The package has an XMLRPC sync Tab that allows for the configuration of the package to be sync'd to other boxes… But with the current DNSBL code, this will cause issues with the DNSBL VIP, as both pfSense boxes will have the same DNSBL VIP address..
I had one user several months ago ask if this could be addressed and I did create a patch to get this addressed... If you are able to test it out, shoot me a PM if that works for you...
Yeah, I saw that post about DNSBL. Sucks because that's a big part of what I'm looking for with this.
Unfortunately I cannot test on that (it's prod.) If I get to it, I'll try to set either my home up with CARP (was thinking about doing it in the future between proxmox and physical anyway) or at least two pfsense VMs in my homelab.
I will let you know as I'd like to test it and help out. I've used pfblocker for so long it's the least I can do.
Thanks BBcan
-
Yeah, I saw that post about DNSBL. Sucks because that's a big part of what I'm looking for with this.
Unfortunately I cannot test on that (it's prod.) If I get to it, I'll try to set either my home up with CARP (was thinking about doing it in the future between proxmox and physical anyway) or at least two pfsense VMs in my homelab.
I will let you know as I'd like to test it and help out. I've used pfblocker for so long it's the least I can do.
Thanks BBcan
Thanks, if/when you have a test environement setup, shoot me a PM and we can go from there!
I've used pfblocker for so long it's the least I can do.
Thanks, I appreciate that! ;)
-
Running the latest 2.1.1_4
When force updates via the GUI all control is lost but I can see the updates. The only way to get it back is to ssh and reset using 11 and 16, or close the browser and wait a while before login back in. If I run the updates via console do not have the same issue, I think it's has something to do with the live logs.
Thanks
Tony -
Running the latest 2.1.1_4
When force updates via the GUI all control is lost but I can see the updates. The only way to get it back is to ssh and reset using 11 and 16, or close the browser and wait a while before login back in. If I run the updates via console do not have the same issue, I think it's has something to do with the live logs.
Your back from the netherworld ;)
With the change to NGINX, the "View" button in the Update Tab is not working 100% …. I have that on the list of things to fix, but it might be removed from future releases as I don't think there is a good resolution for that one...
-
Running the latest 2.1.1_4
When force updates via the GUI all control is lost but I can see the updates. The only way to get it back is to ssh and reset using 11 and 16, or close the browser and wait a while before login back in. If I run the updates via console do not have the same issue, I think it's has something to do with the live logs.
Thanks
TonyIt's just your browser that is sometimes unable to open any connections to the FW FQDN when you run Force Update. You can still access the FW in another tab using the FW IP, or with another browser, or from another computer.
-
Malvertising in Action:
Published on Sep 1, 2016
Exploit kits are a class of threat that indiscriminately attempt to compromise all users. Malicious advertisements, or malvertising, are a common vector adversaries use to try and redirect users to an exploit kit.
https://www.youtube.com/watch?v=-E56rSF01no&feature=youtu.be
-
Hi all
I am looking for some IP/DNSBL blocklist / blacklist with very small false positive and was wondering from your experience with using different block lists which one would you recommend.Thanks in advance for taking the time to respond.
-
can someone help me on that:
i bave many firewall log entries likeSep 26 11:05:04 LAN 10.0.0.80:45511 127.0.0.1:8443
why is it blocked by pfblock rule?
and why 127.0.0.1?? -
can someone help me on that:
i bave many firewall log entries likeSep 26 11:05:04 LAN 10.0.0.80:45511 127.0.0.1:8443
why is it blocked by pfblock rule?
and why 127.0.0.1??Goto the General tab, and enable "Suppression", the Force Reload - All…. This will remove all RFC1918 and loopback addresses...
-
Okay thank you. Did that 8)
-
Is it possible to use some of the paid databases from Maxmind with pfBlockerNG ? (other than GeoLite2)
And if possible, how ?
-
Is it possible to use some of the paid databases from Maxmind with pfBlockerNG ? (other than GeoLite2)
And if possible, how ?
Hi, I have not tested it, but if you do have a paid subscription, I would think that they would give you an API key that could be added to the MaxMind URL…
You could manually edit the URL in /usr/local/www/pfblockerng/pfblockerng.php
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/www/pfblockerng/pfblockerng.php#L52
And adjust the MaxMind cron task to run once a week (I think thats the update freq. of the paid subscription database).
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/pkg/pfblockerng/pfblockerng.inc#L5303
-
http://10.10.10.1:8443 return a gif
It should be https://10.10.10.1:443 but that doesn't return and doesn't it log to dnsbl.log either.
Sorry guys if this is dumb, or I missed something obvious. I am power reading as much as I can possibly stand (eyes starting to hurt) about PFBNG, and I came across this and from my understanding from previous reading, this site should be blocked via all of the settings I have… I think?
I navigated to https://10.10.10.1:443 in chrome and got the "Your connection is not private" warning, not a Gif. This tells me something isn't working correct. I am not even sure where to start with my question, so I will start at the obvious:
This does mean something isn't working, correct? If so, what exactly may that be?
Once again, just trying to get my feet wet and start actually using pfsense for what its worth, I have had my box deployed for about a month now with no packages running, and for better or worse this was my first package to try!
Edit
Also, is there a list somewhere of all of the available DNSBL Feeds? I have read through lots of pages and have input all of BBCan's lists that I have found, I didn't document them.... and I am not sure how to printout a list of all that are currently running on my pfsense box. Like I said, pretty noob, but very interested in learning :)
I guess to this same question, like I said, I haven't kept a list, would it be an issue to have the same feed in multiple groups? I don't think this has happened, but without keeping valiant records of what I have added, it would be hard to even figure this out unless there is a way to show what all has been loaded and running (I assume there is a way to do this).
And what I have seen BBCan117 write SO MANY times is, its better not to block the world, still trying to figure out exactly how to do that...
Also, what I can say, I am somewhat happy I started using this, finally using the 8 GBs of RAM I put in this box! Up to almost 70% utalization, before PFBNG I was at ~2% LOL!
-
See the following:
https://forum.pfsense.org/index.php?topic=119954.msg663601#msg663601 -
See the following:
https://forum.pfsense.org/index.php?topic=119954.msg663601#msg663601Ok. Well, maybe it is ok. I pulled up 10.10.10.1:443 on my iPad s and just allowed it to show the website. The iPad tab in chrome did say "1x1 pixel". So I am thinking this means it actually is working, I doubt the chrome tab would say 1x1 pixel on its own lol.
-
Edited, I think I have figured out my issue, it was a dumb question in the first place :-[
-
I just wanted to ask if I can (ab)use the GeoIP data in PFBlocker.
I'm currently using it to drop outbound traffic to certain countries.
I'd also like to set up multiple aliases, so I can route traffic to certain other countries via a designated interface.Is this possible?
-
I just wanted to ask if I can (ab)use the GeoIP data in PFBlocker.
I'm currently using it to drop outbound traffic to certain countries.
I'd also like to set up multiple aliases, so I can route traffic to certain other countries via a designated interface.Is this possible?
You can goto the IPv4/6 Tab and create any combination of GeoIP aliases… Click the blue infoblock icons for further details... You can also use "Alias type" settings which will allow you to manually create your firewall rules and add the GeoIP Aliases as required.
