shalla list off

sebden

Anyone else have the Squidguard running wild since using the capitole list?

After one update of the new list, the squidguard starts around 20-24 processes and the UI runs slow to almost unusable. I have 3 Boxes testet and 2 are unable to use the list. Happens with pf 2.5.2 and after update to 2.6.0 too.

Are there other trustfull lists out there for testing?

JonathanLee

@sebden someone just recommended this list

http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

Waqar.UK

@jonathanlee

Anyone tried this link?

JonathanLee

@waqar-uk Not me want to test it out first???? Please??? I do not want to reimage the firmware if it fails again.

Waqar.UK

@jonathanlee

I understand. Reinstalled ver 2.60 - to get a ZFS file system. Took about 10 minutes. Suricata and PfgBlocker next. So far so good.

Tried that link: got this message

Hmm. We’re having trouble finding that site.

We can’t connect to the server at dsi.ut-capitole.fr.

JonathanLee

@waqar-uk Dang The original version I used I had to reimage after it installed it broke my system. I got this link from someone else I have not tested it yet because its exam week

stephenw10

@jonathanlee said in shalla list off:

http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

The file downloads fine for me. I haven't tried it in Squid.

Waqar.UK

@stephenw10 said in shalla list off:

http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

Now it works for me. I wonder why before it did not?

Does it work in Suricata?

JonathanLee

@waqar-uk

This works!!!
I just tested this after the summer semester has been completed!!

(Image: Blacklist loading)

(Image: Blacklist Loaded)

(Image: SquidGuard Catagories restored

nimrod

@jonathanlee said in shalla list off:

@waqar-uk

This works!!!
I just tested this after the summer semester has been completed!!

(Image: Blacklist loading)

(Image: Blacklist Loaded)

(Image: SquidGuard Catagories restored

UT1 is not working in pfBlockerNG because its using this link:

 ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz

First i thought its the issue with pfBlockerNG, but if i try to manually download this file from my desktop machine by using wget, this is what i get:

 wget ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz
--2022-08-03 20:27:53--  ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz
           => ‘blacklists.tar.gz’
Resolving ftp.ut-capitole.fr (ftp.ut-capitole.fr)... 193.49.48.249
Connecting to ftp.ut-capitole.fr (ftp.ut-capitole.fr)|193.49.48.249|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done.  ==> CWD (1) /pub/reseau/cache/squidguard_contrib ... done.
==> SIZE blacklists.tar.gz ... 30615325
==> PASV ...

And thats where its stuck. I edited /usr/local/pkg/pfblockerng/ut1_global_usage and changed the link to point to

https://dsi.ut-capitole.fr/blacklists/download/blacklists.tar.gz

It gets downloaded without any issues, but it fails to install. I downloaded blacklists.tar.gz manually and unpacked it with tar, and there is another tar archive inside. pfBlockerNG extracts the content of the archive and expects folders containing category lists, but instead, its just another archive and thats where it fails.

I can extract the initial archive, and upload extracted tar file somewhere else, and update the link in ut1_global_usage file, and that works. But that needs to be done very time there is a update.

Is it safe to say that both Shallalist and UT1 are dead on pfBlockerNG ?

JonathanLee

@nimrod http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

Try this it works for me and I have lists again inside of squid guard. The website has support I have emailed to have URLs added and they add them also.

This was the same issue I had it would download and not install, this list works it ends with reducted. Yes shalla list is gone, I wanted to save the last list that was available but I didn't get to in time.

Squidguard is different than PfblockerNG

nimrod

@jonathanlee said in shalla list off:

@nimrod http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

Try this it works for me and I have lists again inside of squid guard. The website has support I have emailed to have URLs added and they add them also.

This was the same issue I had it would download and not install, this list works it ends with reducted. Yes shalla list is gone, I wanted to save the last list that was available but I didn't get to in time.

Squidguard is different than PfblockerNG

I know.

But i dont use Squidguard. I use pfBlockerNG. And these lists are not working in pfBlockerNG. That was the whole pont of my post.

JonathanLee

@nimrod this list states PfSense

nimrod

@jonathanlee said in shalla list off:

@nimrod this list states PfSense

Yes. And that can be anything from pfBlocker, to Snort, Suricata or Squidguard.

JonathanLee

@nimrod

Hello, this list is different, and does in fact work for Squidguard inside of a Netgate 2100 Max running PfSense software version 22.05. I just tested URL shorteners and it shows blacklist blocked. I understand that you are only using PfBlockNG. However I noticed the items your testing show a different blacklist URL over the URL that I have provided. Please note, "Squidguard in Pfsense has a problem with the size of the database. pfblockerNG (a specific package or pfsense) might be the solution: an explanation" (Per BlackList Website).

I am sorry I thought this URL would also work for the other package as it is not branded as a specific package, only branded as PfSense and marked as reduced for home firewalls to provide a fix for the size of the database issue.

URLs that you showed for your post are that do not work for me also:
https://dsi.ut-capitole.fr/blacklists/download/blacklists.tar.gz

ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz

The above URLs also did not work on my Pfsense with Squidguard, they would not load because of the database size issue.

URL that works for my Pfsense:

http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

I thought it was worth posting this URL as it might work for your package PfBlockNG. This is a different URL.

Screen Shot 2022-08-03 at 6.09.11 PM.png

(Image: URL Blacklist running successful blocks for websites by category blocks provided by the URL above)

nimrod

@jonathanlee said in shalla list off:

@nimrod

Hello, this list is different, and does in fact work for Squidguard inside of a Netgate 2100 Max running PfSense software version 22.05. I just tested URL shorteners and it shows blacklist blocked. I understand that you are only using PfBlockNG. However I noticed the items your testing show a different blacklist URL over the URL that I have provided. Please note, "Squidguard in Pfsense has a problem with the size of the database. pfblockerNG (a specific package or pfsense) might be the solution: an explanation" (Per BlackList Website).

I am sorry I thought this URL would also work for the other package as it is not branded as a specific package, only branded as PfSense and marked as reduced for home firewalls to provide a fix for the size of the database issue.

URLs that you showed for your post are that do not work for me also:
https://dsi.ut-capitole.fr/blacklists/download/blacklists.tar.gz

ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz

The above URLs also did not work on my Pfsense with Squidguard, they would not load because of the database size issue.

URL that works for my Pfsense:

http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

I thought it was worth posting this URL as it might work for your package PfBlockNG. This is a different URL.

(Image: URL Blacklist running successful blocks for websites by category blocks provided by the URL above)

None of those files in that web folder will will work with pfBlockerNG because they are all tar archives inside the tar archive. Such format is not supported.

dauhee

@nimrod said in shalla list off:

http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

http://dsi.ut-capitole.fr does not appear to be alive any more

JonathanLee

@dauhee It seems to be working still for me in California

Screenshot 2023-01-02 at 4.55.01 PM.png
(Image: Testing blacklist)

Screenshot 2023-01-02 at 4.56.39 PM.png
(Image: Download complete)

Email: fabrice.prigent@ut-capitole.fr
he manages this blacklist if you are having issues, I recently emailed a update for DoH addresses to add to the blacklist he is returning to check emails Jan 3rd I think the auto response said.

JonathanLee

@dauhee said in shalla list off:

http://dsi.ut-capitole.fr

Screenshot 2023-01-02 at 5.01.45 PM.png

It seems to be working email that email address if you want to add URL items.

I recently emailed to add DoH

JonathanLee

@dauhee

https://forum.netgate.com/topic/176693/dns-over-443/6?_=1672707245355

I was having major issues with DoH bypassing my DNS and just doing whatever it wanted port hopping to DNS on HTTPS. If you want, I can send you that blacklist and you just have to use an Apache server to download it on pfSense.

Link to a working url blacklist for pfsense squidguard package:

Squidguard Package: I saved the download of the open-source software just in case zip of tar gz file
squidGuard-1.3.tar.zip

Google Drive Link to a working URL blacklist for Pfsense Squidguard package that I use for a 2100 Max:
https://drive.google.com/file/d/1KsE8H5Q_wa7cT2knU0iQynCQ_A_xPIVc/view?usp=share_link

The official source of the blacklist listed above:
http://dsi.ut-capitole.fr/blacklists/index_en.php

Keep in mind the list above is the pfsense reducted version for lower memory firewalls:
http://dsi.ut-capitole.fr/blacklists/download/blacklists_for_pfsense_reducted.tar.gz

Loading this, you could load this blacklist on the Linux box. Just type at a prompt:

service apache2 start

make sure you copy the blacklist over to /var/www/foldernamehere
store that blacklist inside that folder.

now use the ip address of the linux box with http://192.168.1.10/foldernamehere/blacklistfile

Now download it into the firewall box with your custom apache server.