Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    REGEX blocking

    Scheduled Pinned Locked Moved pfBlockerNG
    48 Posts 8 Posters 8.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Cool_CoronaC
      Cool_Corona @Gertjan
      last edited by

      @gertjan Thats exactly my issue.... that other apps are affected because they are all mining on each others data og dns records.

      Kind of annoying...

      1 Reply Last reply Reply Quote 0
      • Cool_CoronaC
        Cool_Corona @Gertjan
        last edited by

        @gertjan https://www.independent.co.uk/tech/whatsapp-down-not-working-status-b2209835.html?utm_content=Echobox&utm_medium=Social&utm_campaign=Main&utm_source=Twitter#Echobox=1666682232

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @Cool_Corona
          last edited by

          @cool_corona Twitter ?
          Also on CNN, MSNBC, Foxnews, BBC, all major (local) french tv news, and soon many Youtube "facebook did it again" videos.

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          J 1 Reply Last reply Reply Quote 0
          • J
            jc1976 @Gertjan
            last edited by

            @gertjan so i guess a really slick feature to pfblockerng-devel would be the ability to add regex lists from pihole, like how suricata can use snort lists.

            1 Reply Last reply Reply Quote 0
            • P
              pfsjap
              last edited by

              At the bottom of Python Regex List section reads "Changes to this option will require a Force Update to take effect" but actually Reload is required.

              1 Reply Last reply Reply Quote 1
              • F
                Forumis
                last edited by Forumis

                This post is deleted!
                1 Reply Last reply Reply Quote 0
                • A
                  Antibiotic @Uglybrian
                  last edited by

                  @Uglybrian Is it still working?

                  pfSense plus 24.11 on Topton mini PC
                  CPU: Intel N100
                  NIC: Intel i-226v 4 pcs
                  RAM : 16 GB DDR5
                  Disk: 128 GB NVMe
                  Brgds, Archi

                  1 Reply Last reply Reply Quote 0
                  • A
                    Antibiotic @Gertjan
                    last edited by

                    @Gertjan Hello, are you still using regex blocking in pfblockerng?

                    pfSense plus 24.11 on Topton mini PC
                    CPU: Intel N100
                    NIC: Intel i-226v 4 pcs
                    RAM : 16 GB DDR5
                    Disk: 128 GB NVMe
                    Brgds, Archi

                    GertjanG 1 Reply Last reply Reply Quote 0
                    • U
                      Uglybrian
                      last edited by

                      Yes Antibotic, its still working and I am still using the same list. so far so good.

                      1 Reply Last reply Reply Quote 0
                      • GertjanG
                        Gertjan @Antibiotic
                        last edited by

                        @Antibiotic

                        yes :

                        0795fca1-4275-4cd0-b6b8-7e0cb66bdf99-image.png

                        It's pretty powerful.
                        Be aware : regex !

                        Read it like this : if any of the text in the lines (the requested host name) matches the regex list, the request gets blocked.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        A 1 Reply Last reply Reply Quote 0
                        • A
                          Antibiotic @Gertjan
                          last edited by

                          @Gertjan Can you please post your regex in text format? I will copy

                          pfSense plus 24.11 on Topton mini PC
                          CPU: Intel N100
                          NIC: Intel i-226v 4 pcs
                          RAM : 16 GB DDR5
                          Disk: 128 GB NVMe
                          Brgds, Archi

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @Antibiotic
                            last edited by

                            @Antibiotic

                            ^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-] #test RGX1
                            ^(.+[_.-])?telemetry[_.-] #test RGX2
                            ^adim(age|g)s?[0-9]*[_.-] #test RGX4
                            ^adtrack(er|ing)?[0-9]*[_.-] #test RGX5
                            ^advert(s|is(ing|ements?))?[0-9]*[_.-] #test RGX6
                            ^aff(iliat(es?|ion))?[_.-] #test RGX7
                            ^analytics?[_.-] #test RGX8
                            ^banners?[_.-] #test RGX9
                            ^beacons?[0-9]*[_.-] #test RGX10
                            ^count(ers?)?[0-9]*[_.-] #test RGX11
                            ^pixels?[-.] #test RGX12
                            ^stat(s|istics)?[0-9]*[_.-] #test RGX13
                            ^stat(s|istics)?[0-9]*[_.-] #test RGX14
                            

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            A LarryFahnoeL 3 Replies Last reply Reply Quote 0
                            • A
                              Antibiotic @Gertjan
                              last edited by

                              @Gertjan Thank you

                              pfSense plus 24.11 on Topton mini PC
                              CPU: Intel N100
                              NIC: Intel i-226v 4 pcs
                              RAM : 16 GB DDR5
                              Disk: 128 GB NVMe
                              Brgds, Archi

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @Antibiotic
                                last edited by

                                @Antibiotic

                                Keep an eye on it :

                                57cb2bd3-ae9e-4a48-809b-42b97b12c284-image.png

                                33306f66-7def-442a-a910-cbe6ffcf37da-image.png

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                A 1 Reply Last reply Reply Quote 0
                                • A
                                  Antibiotic @Gertjan
                                  last edited by

                                  @Gertjan Are you block for incoming?
                                  What the reason, firewall block itself all in?

                                  pfSense plus 24.11 on Topton mini PC
                                  CPU: Intel N100
                                  NIC: Intel i-226v 4 pcs
                                  RAM : 16 GB DDR5
                                  Disk: 128 GB NVMe
                                  Brgds, Archi

                                  GertjanG 1 Reply Last reply Reply Quote 0
                                  • GertjanG
                                    Gertjan @Antibiotic
                                    last edited by

                                    @Antibiotic said in REGEX blocking:

                                    Are you block for incoming?

                                    My LANs of course.

                                    5ab0902a-71b5-4617-a070-07545a8825e7-image.png

                                    That's where the original DNS requests come from, and I want to 'disable' some of them like "incoming.telemetry.mozilla.org" (probably from my browser).
                                    I don't know what beacons.gtv2.com is, the request came from my captive portal.

                                    @Antibiotic said in REGEX blocking:

                                    What the reason, firewall block itself all in?

                                    The regex has nothing to with the/a firewall.
                                    A DNS request came in "what is the A of incoming.telemetry.mozilla.org ?"
                                    The regex filter found it, so pfBlockerng told unbound to tell the LAN client : it's 0.0.0.0.
                                    When the LAN clients receives 0.0.0.0 it can't connect to "incoming.telemetry.mozilla.org" because it has no valid IP to connect to.
                                    This is how DNSBL works.

                                    I don't need (want) a firewall that blocks "Internet" IPs. My LAN firewall is wide open - the portal a bit less, though.

                                    No "help me" PM's please. Use the forum, the community will thank you.
                                    Edit : and where are the logs ??

                                    A 1 Reply Last reply Reply Quote 0
                                    • A
                                      Antibiotic @Gertjan
                                      last edited by

                                      @Gertjan are you using firefox?

                                      pfSense plus 24.11 on Topton mini PC
                                      CPU: Intel N100
                                      NIC: Intel i-226v 4 pcs
                                      RAM : 16 GB DDR5
                                      Disk: 128 GB NVMe
                                      Brgds, Archi

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @Antibiotic
                                        last edited by

                                        @Antibiotic

                                        The better part of my live, and for the moment, yeah....

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        A 1 Reply Last reply Reply Quote 0
                                        • A
                                          Antibiotic @Gertjan
                                          last edited by Antibiotic

                                          @Gertjan Idk, which platform you are using for firefox, linux or freebsd, but under windows firefox is disaster

                                          pfSense plus 24.11 on Topton mini PC
                                          CPU: Intel N100
                                          NIC: Intel i-226v 4 pcs
                                          RAM : 16 GB DDR5
                                          Disk: 128 GB NVMe
                                          Brgds, Archi

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @Antibiotic
                                            last edited by

                                            @Antibiotic said in REGEX blocking:

                                            but under windows firefox is disaster

                                            Works fine for me, I only have Microsoft GUIs here.
                                            Other OSs here have no GUI, only command line acces, and lynx if needed.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            A 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.