Wildcard Blocking, Python-or-not, devel-pkg?

opticalc

OK So a number of questions.

Some dude on YT suggested we should be using pfblockerng-devel as the "old" one isnt getting updates. is that right?

And the TLD blocking, seems not possible or else you need multiple gigs of RAM for this? that seems like a massive gap/risk?

and whats the benefit in running in "python mode"? How do you even enabled this? As best I can tell there are 2 steps, select it from the checkbox in pgblocker's config page, and there also seems to be a place to configure it in the DNS Resolver settings called "python module" is that it?

tinfoilmatt

Some dude on YT suggested we should be using pfblockerng-devel as the "old" one isnt getting updates. is that right?

No.

And the TLD blocking, seems not possible or else you need multiple gigs of RAM for this? that seems like a massive gap/risk?

TLD Allow confers considerable DNSBL beyond explicit domain feeds. The only way to know if your system has enough RAM to make use of it (which it likely does) is to try it out.

and whats the benefit in running in "python mode"?

Unbound Python Mode was a massive improvement over the predecessor Unbound Mode. There's no use case where operating in the latter mode is preferable to the former.

As best I can tell there are 2 steps, select it from the checkbox in pgblocker's config page, and there also seems to be a place to configure it in the DNS Resolver settings called "python module" is that it?

Yes.

opticalc

@tinfoilmatt wow great stuff thanks so much I guess Im all set now. very appreciated!

Gertjan

@opticalc said in Wildcard Blocking, Python-or-not, devel-pkg?:

And the TLD blocking, seems not possible or else you need multiple gigs of RAM for this? that seems like a massive gap/risk?

Gigs ?
List of Internet top-level domains tells me there are about 1600 TLD's.
TLS are dot com dot org dot net dot us dot nl etc etc, so so rather small.

@tinfoilmatt said in Wildcard Blocking, Python-or-not, devel-pkg?:

There's no use case where operating in the latter mode is preferable to the former.

And yet, there are pfSense-pfBlockerng users out there that use "Unbound mode" and didn't switch over to Python mode.
Because :
Unbound mode wasn't a thing in the past, so not an option to chose from. pfBlockerng could modify DDNBL files, and if that happened, it restarts unbound.
With the later (couple of years) added Python mode, this section was created :

to explain the user (admin) what this choice is all about.
( not a hard choice if you take the time to read (and understand) it ^^ )
Upon upgrading, pfSense (pfBlockerng) will not make config changes, it can modify or add options, but the admin has to make the final choice. Default is : nothing changed. So, that explain why there are many pfBlockerng users out there that that still use unbound mode because they don't know they use that mode, that is has become a config 'choice'.

This "unbound versus Python mode" choice was very extensively discussed on this forum, as users with huge DSNSBL lists took a huge penalty when rebuilding DNSBL lists, and restating unbound forced unbound to read back in the list, which could be Megas or or bigger. The results were predictable : PHP Memory overran, or system RAM went to zero, so unbound got oomed.
Unbound has it's own popular restart condition : restart when a new DHCP lease came in and the supplied host name in the lease needed to be registered in the DNS ..... things went downhill fast. This issue was solved by rewriting the DHCP server (entering kea) as that version has notification support.

opticalc

ah very cook thanks much for all this from the historical perspective, this really helps a lot.

Now from the wildcard TLD blocking though, I believe that isnt simple blocking of specific TLDs. I did some tests with this enabled and not enabled.

me@Home:/usr/local/share/ca-certificates$ host wwwwawerdg.doubleclick.com
wwwwawerdg.doubleclick.com has address 10.10.10.1
Host wwwwawerdg.doubleclick.com not found: 2(SERVFAIL)
Host wwwwawerdg.doubleclick.com not found: 2(SERVFAIL)
me@home:/usr/local/share/ca-certificates$ host wwwwawerdg.doubleclick.com
Host wwwwawerdg.doubleclick.com not found: 3(NXDOMAIN)
me@home:/usr/local/share/ca-certificates$

that first host command there was with the wildcard tld blocking enabled, I just randomly picked that host. the second was with that option turned off. so it looks like this function will let you treat an entire domain of an "abuser" as blocked