• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

REGEX blocking

Scheduled Pinned Locked Moved pfBlockerNG
48 Posts 8 Posters 9.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C
    Cool_Corona @Gertjan
    last edited by Cool_Corona Oct 22, 2022, 12:58 PM Oct 22, 2022, 12:56 PM

    @gertjan Yes and thats why a GUI would be great for the noobs like me 😆

    Should I use

    def pfb_regex_match(**facebook.com**):
        global regexDB
    
        if q_name:
            for k,r in regexDB.items():
                if r.search(q_name):
                    return k
        return False
    
    

    And then facebook is blocked?

    G 1 Reply Last reply Oct 24, 2022, 5:57 AM Reply Quote 0
    • G
      Gertjan @Cool_Corona
      last edited by Oct 24, 2022, 5:57 AM

      @cool_corona said in REGEX blocking:

      And then facebook is blocked?

      Noop.
      you should add "facebook.com" to the regex list.

      An facebook example is present in the list @Uglybrian has shown.

      No "help me" PM's please. Use the forum, the community will thank you.
      Edit : and where are the logs ??

      C 1 Reply Last reply Oct 24, 2022, 8:41 AM Reply Quote 0
      • C
        Cool_Corona @Gertjan
        last edited by Oct 24, 2022, 8:41 AM

        @gertjan Thanks :)

        I cant find Regex under DNSBL tab despite using unbound python mode....

        G 1 Reply Last reply Oct 24, 2022, 8:46 AM Reply Quote 0
        • G
          Gertjan @Cool_Corona
          last edited by Oct 24, 2022, 8:46 AM

          @cool_corona

          41a5cc5f-667f-4fe5-85b5-61661149df1f-image.png

          and then :

          bfdd633c-6255-4d37-949d-e20ea91e2c9e-image.png

          and then the list get available :

          b82ff1ed-2601-426e-99ba-da94a786504f-image.png

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          C 2 Replies Last reply Oct 24, 2022, 8:49 AM Reply Quote 0
          • C
            Cool_Corona @Gertjan
            last edited by Oct 24, 2022, 8:49 AM

            @gertjan Got it 👍 Thanks man!

            1 Reply Last reply Reply Quote 0
            • C
              Cool_Corona @Gertjan
              last edited by Cool_Corona Oct 24, 2022, 9:34 PM Oct 24, 2022, 9:33 PM

              @gertjan Sometimes it works...sometime it doesnt.

              Kind of annoying....

              
              ^ad([sxv]?[0-9]*|system)[_.-]([^.[:space:]]+\.){1,}|[_.-]ad([sxv]?[0-9]*|system)[_.-]
              ^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-]
              ^(.+[_.-])?telemetry[_.-]
              ^adim(age|g)s?[0-9]*[_.-]
              ^adtrack(er|ing)?[0-9]*[_.-]
              ^advert(s|is(ing|ements?))?[0-9]*[_.-]
              ^aff(iliat(es?|ion))?[_.-]
              ^analytics?[_.-]
              ^banners?[_.-]
              ^beacons?[0-9]*[_.-]
              ^count(ers?)?[0-9]*[_.-]
              ^mads\.
              ^pixels?[-.]
              ^stat(s|istics)?[0-9]*[_.-]
              # ^(.+[_.-])?(facebook|fb(cdn|sbx)?|tfbnw)\.[^.]+$
              

              Facebook block only works sometimes and it makes DNS horribly slow. (its intentional that I commented it out in the current config).

              G 1 Reply Last reply Oct 25, 2022, 6:59 AM Reply Quote 0
              • G
                Gertjan @Cool_Corona
                last edited by Oct 25, 2022, 6:59 AM

                @cool_corona

                I'm not sure you can comment it out with a #. I advise you to remove it.
                This is regex, not some script ;)

                Btw :
                See line 1451 in /var/unbound/pfb_unbound.py
                as long as there are items on the regex list, the pfb_regex_match(q_name) function is called.
                The main advantage of regex is : is 'blindingly' fast (way faster as what PHP could have done, python is far superior). When I activated that rule, my browser instantaneously showed

                9b3ccba4-ad33-4d29-9ef0-6f077a8277bd-image.png

                when I entered www.facebook.com in the URL bar.

                The DNSBL Python logs :

                8127dec6-8456-47d0-a98a-6b911135a931-image.png

                Regex blocking is as fast as it can gets, way faster as the parsing needed for all the main DNSBL list, compiled from all your DNBL feeds.

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                G 1 Reply Last reply Oct 25, 2022, 8:23 AM Reply Quote 0
                • G
                  Gertjan @Gertjan
                  last edited by Oct 25, 2022, 8:23 AM

                  WTF ....

                  I added a 'facebook' regex above so I could collect some DNSBL log lines - see image above.

                  I also saw :

                  2611c22e-aae9-4881-a83b-96b3da600c98-image.png

                  and, as 'facebook' is in the hostname, all looks fine.

                  I removed the facebook regex, and reloaded pfBlockerng.

                  Still, Whatsapp didn't work (on my phone).
                  And wtf, when I deactivated wifi on my phone, still Whatsapp "doesn't work".

                  Facebook did it again : they have managed to shut themselves, whatsapp this time, out of the Internet. Probably on a planetary level 👍

                  No "help me" PM's please. Use the forum, the community will thank you.
                  Edit : and where are the logs ??

                  C A 3 Replies Last reply Oct 25, 2022, 9:13 AM Reply Quote 0
                  • C
                    Cool_Corona @Gertjan
                    last edited by Oct 25, 2022, 9:13 AM

                    @gertjan Thats exactly my issue.... that other apps are affected because they are all mining on each others data og dns records.

                    Kind of annoying...

                    1 Reply Last reply Reply Quote 0
                    • C
                      Cool_Corona @Gertjan
                      last edited by Oct 25, 2022, 11:07 AM

                      @gertjan https://www.independent.co.uk/tech/whatsapp-down-not-working-status-b2209835.html?utm_content=Echobox&utm_medium=Social&utm_campaign=Main&utm_source=Twitter#Echobox=1666682232

                      G 1 Reply Last reply Oct 25, 2022, 12:29 PM Reply Quote 0
                      • G
                        Gertjan @Cool_Corona
                        last edited by Oct 25, 2022, 12:29 PM

                        @cool_corona Twitter ?
                        Also on CNN, MSNBC, Foxnews, BBC, all major (local) french tv news, and soon many Youtube "facebook did it again" videos.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        J 1 Reply Last reply Oct 26, 2022, 8:45 PM Reply Quote 0
                        • J
                          jc1976 @Gertjan
                          last edited by Oct 26, 2022, 8:45 PM

                          @gertjan so i guess a really slick feature to pfblockerng-devel would be the ability to add regex lists from pihole, like how suricata can use snort lists.

                          1 Reply Last reply Reply Quote 0
                          • P
                            pfsjap
                            last edited by Oct 30, 2022, 3:41 PM

                            At the bottom of Python Regex List section reads "Changes to this option will require a Force Update to take effect" but actually Reload is required.

                            1 Reply Last reply Reply Quote 1
                            • F
                              Forumis
                              last edited by Forumis Feb 1, 2023, 2:44 PM Feb 1, 2023, 2:43 PM

                              This post is deleted!
                              1 Reply Last reply Reply Quote 0
                              • A
                                Antibiotic @Uglybrian
                                last edited by May 13, 2024, 7:50 PM

                                @Uglybrian Is it still working?

                                pfSense plus 24.11 on Topton mini PC
                                CPU: Intel N100
                                NIC: Intel i-226v 4 pcs
                                RAM : 16 GB DDR5
                                Disk: 128 GB NVMe
                                Brgds, Archi

                                1 Reply Last reply Reply Quote 0
                                • A
                                  Antibiotic @Gertjan
                                  last edited by May 13, 2024, 8:07 PM

                                  @Gertjan Hello, are you still using regex blocking in pfblockerng?

                                  pfSense plus 24.11 on Topton mini PC
                                  CPU: Intel N100
                                  NIC: Intel i-226v 4 pcs
                                  RAM : 16 GB DDR5
                                  Disk: 128 GB NVMe
                                  Brgds, Archi

                                  G 1 Reply Last reply May 14, 2024, 6:03 AM Reply Quote 0
                                  • U
                                    Uglybrian
                                    last edited by May 13, 2024, 9:29 PM

                                    Yes Antibotic, its still working and I am still using the same list. so far so good.

                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      Gertjan @Antibiotic
                                      last edited by May 14, 2024, 6:03 AM

                                      @Antibiotic

                                      yes :

                                      0795fca1-4275-4cd0-b6b8-7e0cb66bdf99-image.png

                                      It's pretty powerful.
                                      Be aware : regex !

                                      Read it like this : if any of the text in the lines (the requested host name) matches the regex list, the request gets blocked.

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      A 1 Reply Last reply May 14, 2024, 10:13 AM Reply Quote 0
                                      • A
                                        Antibiotic @Gertjan
                                        last edited by May 14, 2024, 10:13 AM

                                        @Gertjan Can you please post your regex in text format? I will copy

                                        pfSense plus 24.11 on Topton mini PC
                                        CPU: Intel N100
                                        NIC: Intel i-226v 4 pcs
                                        RAM : 16 GB DDR5
                                        Disk: 128 GB NVMe
                                        Brgds, Archi

                                        G 1 Reply Last reply May 14, 2024, 10:19 AM Reply Quote 0
                                        • G
                                          Gertjan @Antibiotic
                                          last edited by May 14, 2024, 10:19 AM

                                          @Antibiotic

                                          ^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-] #test RGX1
                                          ^(.+[_.-])?telemetry[_.-] #test RGX2
                                          ^adim(age|g)s?[0-9]*[_.-] #test RGX4
                                          ^adtrack(er|ing)?[0-9]*[_.-] #test RGX5
                                          ^advert(s|is(ing|ements?))?[0-9]*[_.-] #test RGX6
                                          ^aff(iliat(es?|ion))?[_.-] #test RGX7
                                          ^analytics?[_.-] #test RGX8
                                          ^banners?[_.-] #test RGX9
                                          ^beacons?[0-9]*[_.-] #test RGX10
                                          ^count(ers?)?[0-9]*[_.-] #test RGX11
                                          ^pixels?[-.] #test RGX12
                                          ^stat(s|istics)?[0-9]*[_.-] #test RGX13
                                          ^stat(s|istics)?[0-9]*[_.-] #test RGX14
                                          

                                          No "help me" PM's please. Use the forum, the community will thank you.
                                          Edit : and where are the logs ??

                                          A LarryFahnoeL 3 Replies Last reply May 14, 2024, 10:20 AM Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            [[user:consent.lead]]
                                            [[user:consent.not_received]]