DNS Blacklist, New Package! Check it out.
-
Does it have any effect when in that order???
-
The order for the Rules does not matter.
-
i like the idea of a block list built into pfsense, but i don't like the idea of a pfsense blocklist, if you could just create the interface so that you can make your own lists that would be great.
thanks.
- have not tried the package yet..
-
The next release will contain the ability to create your own black/white-list within the web configuration.
We will also have the ability to let users upload their own compiled blacklists into the script, or use the one prebuilt with the application.
-
Hi,
I am new to PfSense, I tried using DNS Blacklist and tried to block, Adult Porn and Online Gaming but I beleive it blocks all sites, if I try accessing any site it redirects to Google. For eg I tried indiatimes.com; yahoo.co; rediff.com and our Company website but it all gets redirected to Google, not sure if I am going wrong somewhere or do I need to work on the scripts. -
Highlighted in RED.
The order for the Rules does not matter.
Unless something has changed drastically, the order is critical as pfsense rules are evaluated from the top down. The first rule in your example would match, and pfsense will handle the packet accordingly. I'm not trying to pick on you, but that's a major nuance of pfsense and m0n0wall.
On a completely different note, when I use the DNS Blacklist with the Adult category selected, www.pandora.com is blocked, even though it is not in the domain list for the adult category as obtained from http://cri.univ-tlse1.fr/blacklists/index_en.php . Any idea as to why this is happening?
Thanks for the great package!
-
a very small bug i noticed when on the dnsblacklist.php it has no title and when clicking on the pfsense logo it redirects to a 404.
it redirects to https://domain/packages/dnsblacklist/index.php
instead of https://domain/index.php
works great though, thanks
-
So for instance, if you have facebook.com added to the category of denied hosts, then if anyone tried to resolve the forementioned host name then it would resolve to the IP I currently have set in the config, which is a Google IP.
Hi xa0z. Is there any way to simply return nothing instead of resolving to Google's IP?
-
A very good start, userfriendly. Here are some comments.
- agree with Rezin, or redirect to a configurable error page.
- So is there any LOG showing which URL match which RULES ?
- Once I checked the "Adult", then I cannot visit hk.yahoo.com. I have digged into /usr/local/www/packages/dnsblacklist/blacklists/adult and there are quite a lot of stuffs related to yahoo.
-
Hi,
i've installed pfsense yesterday and try DNS Blacklist, but it seems it doesn't block any site.
i've tried from lan and opt1 interface
each time, the only dns for the client is pfsense
dnsblacklist is activated, and i've checked many categories as adult, games, gamble, etc…
but no success
any idea ?
thanks in advance for your help -
Omichaux,
- Did you have all the LAN client's DNS server changed to the pfSense LAN's IP (the one you used to manage pfSense)
- Did you enable the DNS Forwarder in pfSense which forward all the DNS request to your original DNS server ?
- Did you enable Squid, if so did you changed the DNS server to the pfSense LAN's IP ? Also, it seem every changes made in DNS Blacklist require restart of Squid to made it take effect.
Those are my experience and not sure it fit you case.
-
Thanks for your answer…
but i've already done all of your suggests.
my DNS clients are IP LAN of pfSense
i've reinstall pfsense in version 1.2.3
and reinstall package dns blakclist
squid is not install, but i'm not sure i need it.but no success
-
when is the new updated DNS Blacklist going to be available thanks.
-
Hey guys…
I've not been working on this project as much lately as some other things have come up. I plan to get the next release done before November 8th. Hopefully...
As for people wanting to use a CUSTOM ERROR PAGE, Using dnsmasq, you can only make the hostname they try to resolve into an IP, and then the browser tries to load that IP. For example if you block something like yahoo.com, that means it will make yahoo.com's dns lookup resolve to 74.125.45.100 for example… And then the browser will try to load http://74.125.45.100/ and if that IP doesn't have anything to show the page is blacklisted, then it will only show an error that the request wasn't found. We don't use proxies like Squid. Using this method is faster, but it is kind of limited in that aspect.
All of your comments, and opinions are taken seriously and any requests for fixes, and add-ons are welcome.
-
First off thank you for this excellent package submission.
As for people wanting to use a CUSTOM ERROR PAGE, Using dnsmasq, you can only make the hostname they try to resolve into an IP, and then the browser tries to load that IP. For example if you block something like yahoo.com, that means it will make yahoo.com's dns lookup resolve to 74.125.45.100 for example… And then the browser will try to load http://74.125.45.100/ and if that IP doesn't have anything to show the page is blacklisted, then it will only show an error that the request wasn't found. We don't use proxies like Squid. Using this method is faster, but it is kind of limited in that aspect.
However the device could be forced to redirect to another destination. Could even be locally as pfSense's WebGUI is running on a local webserver.
I believe it is Lighttpd.fwrite($fh2, "address=/" .$line. "/74.125.45.100". "\n");
That block of code tells the system as you said that has been blocked where to resolve to. This can be seen in dnsmasq.blacklist.conf file. Each blacklist domain is subsequently followed by the /74.125.45.100 url.
Next I have noticed an issue with dnsmasq.
Not sure if I am doing this wrong either so correct me if I am wrong. I followed this forum thread to fix DNSMasq not restarting without a reboot.
(http://forum.pfsense.org/index.php/topic,11159.0.html)If I have a custom config at /usr/local/etc/dnsmasq.conf it gets overridden by dnsblacklist. The actual config that is written itself is broken:
conf-file=/usr/local/etc/dnsmasq.blacklist.confetc/resolv.confis the result.
Anyways look forward to the update keep up the good work.
With Regards,
Preston -
Hi - firstly thanks for adding this.
Secondly. In case it helps anyone else and saves them the puzzlement it did me, some feedback. I know this kinda repeats some of the above wrt google and facebook, but posting for googlers as the cert thing is new afaik.
Added fine through gui, selected a bunch of likely looking rules and left it running.
User reported "strange messages when trying to login to facebook". Checked.
facebook.com - login screen displayed normally. User enters email address and password and clicks submit;
Firefox displays the wrong cert error;
Secure Connection Failed
login.facebook.com uses an invalid security certificate.
The certificate is only valid for the following names:
google.com , *.google.com(Error code: ssl_error_bad_cert_domain)
(Client running Vista, Error repeats on IE8. Error also repeated on Firefox 3.5 on my Ubuntu machine)
Note google's domain, not facebook. If I forced it to accept, on submitting correct login details to facebook, user was redirected to google.com instead of facebook.
After some fiddling around, I established the problem went away if Dns Blacklist was disabled through the webgui (just the tickbox at the top of it's own settings page).
After some further fiddling, I established that the problem stayed away if I turned on Dns Blacklist, BUT DID NOT SELECT the topmost "Adult (X)" ruleset.
So I can only conclude that something in that particular ruleset is causing this somewhat bizarre certification issue to surface during https or ssl on at least facebook.com (Might happen on other sites, just this was the first)
I hope that's enough to help point towards the problem, and help anyone else encountering this.
-
Fist off I want to say this is a great package! Thanks for all of your work! Sorry if this has already been mentioned, but I would like to see GEO location block options. So for example, if I wanted to block all traffic from URL's ending with *.RU or *.CN, etc.
TNR
-
I would like very much to see this project continue on. Is it in the maybe stage still or will this project be further developed upon? All in all I want to say thank you for the work you have put into this. I've found it useful and would like to see it advanced further to become even better.
-
Hey guys… I'm really glad to hear all the good comments about this package. As almost everyone knows, the issue with this package continuing is the Block List. I would LOVE to make a new release, but until I can compile my OWN list, it just won't happen. I have started on a list, but it's not very big and all of the categories are so large.
As soon as I can get my OWN list compiled and separated then we will be back in business. mcrane has been majorly swamped with his FusionPBX project so I've not even bothered him with this one.
Just everyone who uses this Add-on, hold tight and don't give up on us.
Next release features will include
+Ability to add custom entries
+Ability to bypass individual entries in a blocked category.
+Ability to load local error page (on pfSense)
+Ability to view/edit/modify categories within the GUI (memory intensive) -
Look forward to seeing that :)
Remember to put an country IP blacklist as well….Many an admin would like to see China, Russia and Korea go away...:D
-
Hi,
I am new to PfSense, I tried using DNS Blacklist and tried to block, Adult Porn and Online Gaming but I beleive it blocks all sites, if I try accessing any site it redirects to Google. For eg I tried indiatimes.com; yahoo.co; rediff.com and our Company website but it all gets redirected to Google, not sure if I am going wrong somewhere or do I need to work on the scripts.I have the same issue.
-
Hi,
I am new to PfSense, I tried using DNS Blacklist and tried to block, Adult Porn and Online Gaming but I beleive it blocks all sites, if I try accessing any site it redirects to Google. For eg I tried indiatimes.com; yahoo.co; rediff.com and our Company website but it all gets redirected to Google, not sure if I am going wrong somewhere or do I need to work on the scripts.I have the same issue.
I also have the same issue and even if I uninstall the dns blacklist the DNS redirector is jacked up now and no dns redirection works.
-
Am I missing something or is this like running Squid and Squidguard? And if so, why at the beginning of the thread did the developers make reference to DNS Blacklist (eventually) running in conjunction with a proxy server? Seems like DNS Blacklist is a great idea for those who don't employ proxy servers and redundant to those who do (along with Squidguard).
Please…show me the error in my thinking.
-
I agre, what is the difference with Squid-Squid guard
I have good squit guard setup should i consider this instead
What are the advantaged or disadvantagesThank you!
-
The DNS Blacklist is what its name implies. Its a DNS Domain name black list. Domains that are on the list are detoured to an alternate address in this way it blocks the website. Simple concept effective and doesn't require a proxy. To be completely effective you need to block other DNS Servers.
-
did any one ask? Ive heard of pay services providing free services to projects like this.
-
Hi,
is there a possibility that the DNS Blacklist is valid only for some clients in the network?
What i mean is: Can i set permissions within the DNS Blacklist for some clients.And thank you for your work on this package!
-
Wow… i've tried this.. unbelivble...it's simple. Thanksss Guys....it's really2 work .. \m/
-
This is a great package, using it very well great work!
I do have 1 issue. When i turn on Adult option, it starts blocking sites that aren't even in the blacklist (specifically all of my personal domains). limesg.com, and naveoss.com. I did a grep in the blacklist directory and on the original sites blacklist files and my domains are not in any list. Any advice?
-
Any news of this???
-
Just to chime in a bit:
- Great package. Anything to help with granular site-blocking is a win to me.
- Wondering if perhaps the option to add this list http://www.mvps.org/winhelp2002/hosts.txt might be possible ? …GREAT list to use if you're serious about ad-blocking.
- for anyone having trouble with the blacklist opening a page that you think should be blocked, you might have to clear your DNS cache - from the Windows command line: ipconfig /flushdns
-
DigitalJer the list you linked to seems to be free to use and I like the idea of an ad block category so I will add it as time permits. Main problem with granular control is some of these lists are very large so large we can't just display them in a textarea without killing the browser I've been thinking about a way to page through the list of domains.
-
@mcrane:
… the list you linked to seems to be free to use and I like the idea of an ad block category so I will add it as time permits.
Sweet! tyvm - looking forward to it :)
-
I really like the package. Thank you.
-
@DigitalJer
i've been using MVPS hosts file for years too :) i've installed pfsense yesterday and i'm trying new stuff currently :) i just included the MVPS list (domains only) to the "/usr/local/www/packages/dnsblacklist/blacklists/ads/domains" file and it works fine.furthermore i've changed redirection to localhost/127.0.0.1 in dnsblacklist.php because i really don't like sending any information more than necessary to google :)
is it also possible to use pfsense's /etc/hosts file for blocking those domains? i guess it wouldn't eat that much memory (correct me if i'm wrong) because dnsmasq simply looks up the /etc/hosts file and sees the localhost redirection entries and forwards that to the client instead of holding everything in memory (which is limited on my alix board).
i'm new to pfsense and simple editing /etc/hosts didn't work because something always overwrites the file (i guess it is the "Register DHCP leases in DNS forwarder" setting).
[edit]
just found /etc/inc/system.inc and changed function system_hosts_generate() to append my host list to /etc/hosts :) skipping DNS blacklist package.
[/edit] -
@0x00:
@DigitalJer
i've been using MVPS hosts file for years too :)Yeah, it's maintained sooo well :)
I take it you've been using it with a Linksys WRT or something? Tomato / DD-WRT? That's how I found it.
@0x00:
i've installed pfsense yesterday and i'm trying new stuff currently :) i just included the MVPS list (domains only) to the "/usr/local/www/packages/dnsblacklist/blacklists/ads/domains" file and it works fine.
…so you added it to pfsense manually, and it works? I haven't had a chance to try it out yet :(
-
I take it you've been using it with a Linksys WRT or something? Tomato / DD-WRT? That's how I found it.
no, i've been using it locally only. i've recently upgraded my firewall laptop to an alix board and now installed pfsense instead of smoothwall. i never bothered to install the hosts file on smoothwall :)
…so you added it to pfsense manually, and it works? I haven't had a chance to try it out yet :(
yes, it works fine. before hacking the /etc/hosts file (which doesn't seem to bring many memory advantages in comparison to the blacklist package, i guess i have to test this more when i got time) i just adjusted the MVPS hosts file like this with vi:
- removed all lines with comments (#)
- removed every "127.0.0.1 " (including spaces) string
the remaining lines in the file are then just the domain names you want to block. i added this file to the ads blacklist as mentioned in my previous post (and did a sort/uniq). afterwards the webGUI of pfsense shows me ~15400 domains for the "ads" category instead of something like 700 domains.
-
question, i been reading and keeping up with the progress and I have to say the current DNS black list thing I use just kicks butt, is this the same thing or is this going to be different? also if this is the same (even if its not) is there any future plans to have the ability to white list sites that are on the black listed DNS (IE I black list porn and other adult sites, but a car forum gets blocked also) is there going or at least planned for the future a way to still black list adult sites but have a way to allow (white list?) certain sites like Nissanclub[dot]com or gaming clan sites? by either the IP and/or site address?? and (not sure how possible this could be) to set it up so only certain computers on the local network can access the white listed sites with out allowing every computer to access it?
Not sure if this makes sense, if needed I can try to explain it better…
-
Wow, haven't been around for a while so I dunno what updates mcrane made, but any of you whom I've not personally spoke with should note. I made many plans to add many new features, I re-did the web interface, and made a few php scripting fixes, added a whitelist, etc…. But the problem I had came down to the fact that mcrane did not want to use my blacklist in the package.
I started this package to help you guys, but in the end, it came down to what mcrane wanted since I couldn't submit the package myself, and if I didn't do it his way, he wouldn't submit it either, so we were limited to using an old, smaller, cheaper blacklist.
I have an entirely new package ready to go, with everything I wanted in the newest release, but it still comes down to the fact that the lists I gathered and spent MANY days sorting into categories from many various websites, just can't be used because 2 of the lists are not FREE, even though all of the URLs in the list can be gathered by anyone, or duplicated by anyone, the work/time that the seller of the two lists is what costs money, and even if I buy just one copy for myself, distributing it to everyone on here would be against the TOS from the sellers of the catagorized lists.
In the end, I gave up, I told mcrane the project is his, and to do what he wants. There is no point in me doing something like this, and having less than 50% control of it.
Sorry, but that is how it is.
-
That sucks like hell!!!
To be honest…......
Wow, haven't been around for a while so I dunno what updates mcrane made, but any of you whom I've not personally spoke with should note. I made many plans to add many new features, I re-did the web interface, and made a few php scripting fixes, added a whitelist, etc…. But the problem I had came down to the fact that mcrane did not want to use my blacklist in the package.
I started this package to help you guys, but in the end, it came down to what mcrane wanted since I couldn't submit the package myself, and if I didn't do it his way, he wouldn't submit it either, so we were limited to using an old, smaller, cheaper blacklist.
I have an entirely new package ready to go, with everything I wanted in the newest release, but it still comes down to the fact that the lists I gathered and spent MANY days sorting into categories from many various websites, just can't be used because 2 of the lists are not FREE, even though all of the URLs in the list can be gathered by anyone, or duplicated by anyone, the work/time that the seller of the two lists is what costs money, and even if I buy just one copy for myself, distributing it to everyone on here would be against the TOS from the sellers of the catagorized lists.
In the end, I gave up, I told mcrane the project is his, and to do what he wants. There is no point in me doing something like this, and having less than 50% control of it.
Sorry, but that is how it is.