Default Website Blocked Message not showing

TFTQKX

I am not getting the default web site blocked message on my Pfsense while using pfBlockerNG. I would like to get it back. What is wrong? Sample shown. . Please help me.

johnpoz

And what site is suppose to be blocked where that is not coming up? Is it http or https that your trying to go too?

TFTQKX

@johnpoz It is for both

johnpoz

And what version of pfsense are you on and what version of pfblocker are you using..

Give an example site that you feel should give you that block page. You sure your browser is not using proxy or doh for its dns.. Both of which would stop pfblocker from working, or your machine using a different dns even.

Are you saying the site is blocked you just don't get the block page?

TFTQKX

Pfsense Version Used is- 2.4.4-RELEASE-p2 (arm64)
pfBlockerNG-devel Version- 2.2.5_22
Porn Sites that I have blocked manually by adding to list or that matter any blocked site gets "The connection was reset" message.

johnpoz

But they resolve to 10.10.10.1

Lefuneste

Same issue here, trying to setup pfBlockerNG:

Same versions :
-pfSense 2.4.4-RELEASE-p2
-pfBlockerNG-devel Version- 2.2.5_22 (did try the stable version beforehand, which had the same behaviour)

Listed websites in DNSBL Feed (PiHole lists) do get trapped, and redirected to the blocking VIP (10.10.10.1).

Chrome browser displays ERR_EMPTY_RESPONSE

The VIP can be pinged properly

PING 10.10.10.1 (10.10.10.1) 56(84) bytes of data.
64 bytes from 10.10.10.1: icmp_seq=1 ttl=64 time=0.249 ms
64 bytes from 10.10.10.1: icmp_seq=2 ttl=64 time=0.222 ms
64 bytes from 10.10.10.1: icmp_seq=3 ttl=64 time=0.216 ms

Curl shows that the website published by this address is indeed empty althought there is a reply :

~ > curl -v http://adk2.com/

Trying 10.10.10.1...
TCP_NODELAY set
Connected to adk2.com (10.10.10.1) port 80 (#0)

GET / HTTP/1.1
Host: adk2.com
User-Agent: curl/7.58.0
Accept: /

Empty reply from server
Connection #0 to host adk2.com left intact
curl: (52) Empty reply from server

The web server publishing the blocking page seems to have a problem pushing a content.

Grimson

The lighttpd package in the pfSense repo has recently been updated from version 1.4.49 to 1.4.51. Version 1.4.50 contains the following change:

[mod_rewrite] require rewrite result to begin ‘/’

This is why the blocked page is no longer showing for some ppl. To (temporary) fix it you can open edit " /var/unbound/pfb_dnsbl_lighty.conf" there find all occurrences of:

url.rewrite-once = ( ".*" => "index.php" )

and change them to:

url.rewrite-once = ( ".*" => "/index.php" )

after that restart the pfBlockerNG DNSBL service.

You'll probably have to redo the fix after changing DNSBL related settings or updates of the pfBlockerNG-devel package until @BBcan177 has properly fixed the package.

TFTQKX

Thanks.... It worked. Thank you Grimson.

Lefuneste

Wow thanks Grimson !! You deserve a beer !

johnpoz

Agreed for sure that @BBcan177 should by him a beer or even 2 ;)

RonpfS

@Grimson said in Default Website Blocked Message not showing:

edit " /var/unbound/pfb_dnsbl_lighty.conf"

The pfb_dnsbl_lighty.conf file is created during installation or when the file is missing.

To make a more permanent change you have to edit /usr/local/pkg/pfblockerng/pfblockerng.inc and change 2 occurrences of url.rewrite-once = ( ".*" => "index.php" ) in function pfb_create_lighttpd() around line 1065

// Function to create DNSBL Lighttpd configuration file
function pfb_create_lighttpd() {
	global $pfb;

	$pfb_conf = '';
	$pfb_conf = <<<EOF
#
#pfBlockerNG DNSBL Lighttpd configuration file

...


}
	$pfb_conf .= <<<EOF

\$HTTP["scheme"] == "http" {
	url.rewrite-once = ( ".*" => "/index.php" )
}

\$HTTP["remoteip"] =~ ".*" {

...

	$pfb_conf .= <<<EOF

	\$HTTP["host"] =~ ".*" {
		url.rewrite-once = ( ".*" => "/index.php" )
	}
}

EOF;
	return $pfb_conf;

xparanoik

@RonpfS I asked BBcan177 on reddit if he recommends this instead, as the next fix I believe will not be out for a while. Maybe BBcan177 could chime in on this thread?

Regardless, thanks for fix!

EDIT: per BBcan177: I have a PR to fix this and its waiting on the pfSense devs to approve and merge. So either way will work until the next version is available.