pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!

gabacho4

Had a working installation of 3.0. updated to 3.0_1 and it hangs. Pfsense package manager tells me I still can upgrade to the latest but, as best I can tell, pfblocker is no longer installed as I have nothing in the firewall section. I've rebooted the router to no avail. Output from the upgrade attempt is:

Package Reinstallation

Upgrading pfSense-pkg-pfBlockerNG-devel...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
pfSense-pkg-pfBlockerNG-devel: 3.0.0 -> 3.0.0_1 [pfSense]

Number of packages to be upgraded: 1
[1/1] Upgrading pfSense-pkg-pfBlockerNG-devel from 3.0.0 to 3.0.0_1...
[1/1] Extracting pfSense-pkg-pfBlockerNG-devel-3.0.0_1: .......... done
Removing pfBlockerNG-devel components...
Menu items... done.
Services... done.
Loading package instructions...
Removing pfBlockerNG...cat: /var/unbound/pfb_py_zone.txt: No such file or directory
All customizations/data will be retained... done.

BBcan177

@gabacho4
Run this cmd:
chown unbound:unbound /var/unbound
And restart Unbound

gabacho4

That worked as far as getting the package to show that it's at the latest version. I still don't have pfblocker to config or view in mt Firewall tab. Any further steps to follow? Should I just uninstall and reinstall? Thanks for the quick assistance!

BBcan177

Re-install v3.0.0_1 and see how that goes

gabacho4

@BBcan177 that appears to have taken. Phew! Thanks again!

mcury

Is anyone using the Unbound Python Mode in pfBlockerng?
Do I need to enable the Python Module in DNS Resolver to use it?

If someone is using this python mode, what really changes despite of the RAM usage?
Any feedback about it?

RonpfS

@mcury You only enable it in DNSBL, then run a Force Update and a Force Reload ALL to be on the safe side.

You will get more features, Cron update are faster and unbound start in a matter of seconds, so less DNS services interruption.

mcury

@RonpfS Thanks, enabled and ran the force reload all, it's already running :)

HieuLe

After upgrading to new version, i cannot exclude 1 IP address in DNSBL

Custom Option:
server:
access-control-view: 172.16.10.0/24 bypass
access-control-view: 172.16.200.0/24 dnsbl
access-control-view: 172.16.200.1/32 bypass
access-control-view: 172.16.100.0/24 dnsbl
view:
name: "bypass"
view-first: yes
view:
name: "dnsbl"
view-first: yes

RonpfS

CAUTIONS:

2.
The DNS Resolver Unbound "Views" feaure it not currently compatable with DNSBL Python mode. The "Views" feature will be incorporated into the new Python Mode in future.

mlines

I'm trying to apply the update but the Package Reinstallation is hanging: Please wait while the update system initializes. I've waited over 30 minutes and tried rebooting the SG-1100 without success. Any ideas?

A Former User

Thank you for the update and the effort you put into this project. This add-on is one of the main reasons I stick with pfSense.

We have a bunch of remote Sites running non-pfSense VPN Router with integrated DSL Modem. This remotes Sites are connected to our Data Centers by routed IPsec VPN, terminate on the pfSense where the DNS-Resolver with pfb enabled is hosted. Each site has a local resolver and forwards all queries for public domains to the pfSense in the Data Center over the VPN Tunnel.

@BBcan177 said in pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!:

DNSBL Web Server is now bound to localhost instead of 0.0.0.0

Unfortunately this change breaks the usage of pfBlockerNG over IPsec for good. I cannot get the web server to reply to connections which come in over VPN.
Out of the box it doesn't work at all but with a custom NAT config it can be make functional.
When the Web Server is bounded on all Interfaces it was possible make this work by placing NAT Rules before the system generated rules to redirect the Traffic to the High Ports of the DNSBL VIP.

rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = http -> 10.255.255.12 port 8081
rdr pass on enc0 inet proto tcp from any to 10.255.255.12 port = https -> 10.255.255.12 port 8443

This was enough to get it working for Policy based VPN. If using VTIs for IPsec an addition floating rule with no state is necessary to allow the return traffic.

pass out quick on enc0 inet proto tcp from 10.255.255.12 to <net_vpn_all> port >= 1024 no state label "USER_RULE: Allow Stateless Replies from DNSBL VIP"

I do understand that this is a limitation of pfSense/FreeBSD VPN and not a pfBlockerNG problem. Anyway it is possible to make the binding of Web Server to all interface or loopback a configurable option for future release?
If not - does anybody have an idea how to get this work when the service is bound to a loopback?

BBcan177

@Artes

I can add this as an option in the next release as time permits.

In the meantime, you can edit the code to revert to 0.0.0.0.

Edit the file:
/usr/local/pkg/pfblockerng/pfblockerng.inc

At line #1097 there is a function that builds the Lighttpd configuration file:

function pfb_create_lighttpd() {
}

In that function you can change the lines with "127.0.0.1" to "0.0.0.0"

and change "::1" to "::/0" for IPv6. (haven't tested that myself, so hoping that this is the correct IPv6 address)

In the same file:

Edit line #1308:

From:
'target' => '127.0.0.1',
To:
'target' => '0.0.0.0',

Edit line #1322:

From:
'target' => '::1',
To:
'target' => '::/0',

Hope this works for you, Thanks for using the package, and and any support is appreciated.

Cool_Corona

I get to this...and then it takes forever...

[ DoH ] Downloading update [ 11/25/20 20:02:51 ] . cURL Error: 35
OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to heuristicsecurity.com:443 Retry in 5 seconds...
. cURL Error: 35
OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to heuristicsecurity.com:443 Retry in 5 seconds...
. cURL Error: 35
OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to heuristicsecurity.com:443 Retry in 5 seconds...
.. unknown http status code | 0

[ DNSBL_DoH - DoH ] Download FAIL [ 11/25/20 20:03:06 ]
Firewall and/or IDS (Legacy mode only) are not blocking download.

Restoring previously downloaded file

No Domains Found! Ensure only domain based Feeds are used for DNSBL!

Assembling DNSBL database...... completed [ 11/25/20 20:03:19 ]
TLD:
TLD analysis.............................. completed [ 11/25/20 20:08:33 ]
TLD finalize.......................

RonpfS

From the CHANGELOG :

FEEDS:
        Removed discontinued Heuristic Security DoH Feed

Remove this URL. Use the Feeds tab to update your Groups

vjizzle

Hi,

Do we have CNAME blocking now? Thanks and as always amazing job!

BBcan177

@vjizzle
Yes its there in the DNSBL Tab with the other Unbound Python mode features.

A Former User

@BBcan177 said in pfBlockerNG-devel v3.0.0 - No longer bound by Unbound!:

Edit the file:
/usr/local/pkg/pfblockerng/pfblockerng.inc
At line #1097 there is a function that builds the Lighttpd configuration file:
function pfb_create_lighttpd() {
}

Editing this function works fine for me. There is no need to edit lines #1308 and #1322 - These are for the NAT Rules and should stay as they are.

Thank you!

mlines

This post is deleted!

SachaH

First of all, great job on this release!

I'm currently running 3.0.0_1 with 'Unbound python mode' enabled in DNSBL.
While viewing the Reports tab I saw that the If and Source columns show 'Unknown' within the DNSBL Python alert entry's.

Any suggestion how the fix this?