PfBlockerNG

serialdie

@serialdie:

I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list. Once I regain my IP list I can see my updates.

Hi serialdie,

How many pfBNG Aliases did you configure? I think you hit another bug that I haven't merged into the release… If you only have one, create a second Alias and use a list like Spamhaus drop. I think creating a second alias will fix this issue for you... (2 bugs for you in one day :) )

https://www.spamhaus.org/drop/drop.txt

HAHAHA! I get a cookie? :P
Yes I do have one list setup only so looks like you nailed it with this one.
I will try that and report back.

Thanks!

cyberbot

I have asked this before but didn't get a answer
is there is a possibility to use PFblockerNG to block porns like proxy server ?

f34rinc

@cyberbot:

is there is a possibility to use PFblockerNG to block porns like proxy server ?

Once pfBlockerNG 2.0 is ready it will have DNSBL available which could be used to block porn. Ive had good success using the DansGuardian formatted lists from http://www.squidblacklist.org

![2015-08-30 18_19_25.png](/public/imported_attachments/1/2015-08-30 18_19_25.png)
![2015-08-30 18_19_25.png_thumb](/public/imported_attachments/1/2015-08-30 18_19_25.png_thumb)

BBcan177

pfBlockerNG v1.10 - Pull Request has been posted -

Changelog:
https://github.com/pfsense/pfsense-packages/pull/1033

taryezveb

@BBcan177:

IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)

Unfortunately did not have the time to test, sorry.

@BBcan177:

I am contemplating adding a feature to allow auto updating the Lists/Feeds for a future release. I am finalizing v2.0 which has DNSBL domain name blocking via Unbound Resolver and hope to get that released soon…

Looking forward to try this.

Thank You

tonymorella

@BBcan177:

@tonymorella:

It seems logical to have detail allow rules followed by pfBlockerNG block rules before allowing destination ANY rules, did I miss an option to have it work in this order?

If I am reading your request correctly, you are asking to sort the pfSense (Permit/Match) rules to be placed before and after the pfBNG rules… I would think it would be rather cumbersome and not sure if others would use it? For more complex setups, that is where the "Alias" type Rules are better utilized. If I have read this incorrectly, please let me know.

Yes, you are reading this correctly. Figured out how to get floating rules working the way I needed then changed settings to pfBlockerNG block > pfSence Allow and it fixed my set .

Thanks

tonymorella

Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6


http://bgp.he.net/search?search%5Bsearch%5D=facebook&com

Another option is a script, ugly I know :)


whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'

It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.

Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:

nmap -R -sL 64.98.161.0/24 | grep ting.com

Is there any way of doing this in pfBlockerNG?

Thanks
Tony

musicwizard

@tonymorella:

Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&com
Another option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'
It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.

Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.com
Is there any way of doing this in pfBlockerNG?

Thanks
Tony

Pfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.

BBcan177

@BBcan177:

pfBlockerNG v1.10 - Pull Request has been posted -

Changelog:
https://github.com/pfsense/pfsense-packages/pull/1033
**Pull request has been merged. Following this update, please execute a "Force Reload".

Thanks!**

pfcode

a small bug: After a pfBlockerNG upgrade, All the rules prior to original pfBlokerNG rules were put at the bottom in the floating rules page. I have to move them to the top.

tonymorella

@Music:

@tonymorella:
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&com
Another option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'
It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.

Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.com
Is there any way of doing this in pfBlockerNG?

Thanks
Tony
Pfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.

Not trying to block, want to allow any host for a domain :) I have been beta testing 2.0, at the moment have not seen any way to do via the GUI
Thanks
Tony

BBcan177

If you are trying to suppress a domain, you can click the "+" icon in the Alerts Tab which will remove the domain instantly and not allow that domain to be added again. ‎ You can also add a domain to the "DNSBL" suppression list box but that will only take effect when the feeds are downloaded again or on a "Force Reload".

tonymorella

@tonymorella:

@Music:
@tonymorella:
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&com
Another option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'
It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.

Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.com
Is there any way of doing this in pfBlockerNG?

Thanks
Tony
Pfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.
Not trying to block, want to allow any host for a domain :) I have been beta testing 2.0, at the moment have not seen any way to do via the GUI
Thanks
Tony

I found what I was looking for :) https://hackertarget.com/find-dns-host-records/ using the api can create a list of all the hosts for a domain and get a formated lists!

http://api.hackertarget.com/hostsearch/?q=ting.com

Found two more useful tools for dns enumeration:

https://github.com/TheRook/subbrute
https://github.com/darkoperator/dnsrecon

scotthosiermail.com

I am currently blocking Asia and have hired a developer in India. How can I exclude his subnet and still have the rest of India blocked.
I have India( CTRL + CLICK to unselect countries) at the moment so he has access.

tonymorella

@scott@hosiermail.com:

I am currently blocking Asia and have hired a developer in India. How can I exclude his subnet and still have the rest of India blocked.
I have India( CTRL + CLICK to unselect countries) at the moment so he has access.

Just create a new floating rule and add his subnet as the source for incoming traffic for your WAN interface.

Tony

pfcode

HI,

I have found that if I'm using RAMDisk, After a pfSense start/restart, the pfBlockerNG Alerts page list 'No match' on all alerts until I manually do a force update. I thought the lists should be all loaded after a root/start. Obviously it didn't when using RAMDisk. No issue when not using RAM Disk. This is annoying. Am I missing something?

BBcan177

@pfcode:

HI,

I have found that if I'm using RAMDisk, After a pfSense start/restart, the pfBlockerNG Alerts page list 'No match' on all alerts until I manually do a force update. I thought the lists should be all loaded after a root/start. Obviously it didn't when using RAMDisk. No issue when not using RAM Disk. This is annoying. Am I missing something?

Well this is the issue with RamDisk installations… On a reboot the /var folder is wiped out… That would include any other packages that store data there...

I have added a workaround to copy the final "/var/db/aliastables/pfB_*" files… and restore those after a reboot so that the tables and firewall rules don't have any issues...

However, the rest of the files are gone, and the only way to recover is with a "Force Reload" or wait for the next Cron task to execute. The issue with a RamDisk is always size, so Its not appropriate to try and archive all the files and restore them... Not to mention that any time Cron ran, or you used a "Force" command, it would archive the files and take some time (I assume) depending on how many Lists you use... Whats the benefit to use a Ramdisk anyways?

pfcode

@BBcan177:

@pfcode:

HI,

I have found that if I'm using RAMDisk, After a pfSense start/restart, the pfBlockerNG Alerts page list 'No match' on all alerts until I manually do a force update. I thought the lists should be all loaded after a root/start. Obviously it didn't when using RAMDisk. No issue when not using RAM Disk. This is annoying. Am I missing something?

Well this is the issue with RamDisk installations… On a reboot the /var folder is wiped out… That would include any other packages that store data there...

I have added a workaround to copy the final "/var/db/aliastables/pfB_*" files… and restore those after a reboot so that the tables and firewall rules don't have any issues...

However, the rest of the files are gone, and the only way to recover is with a "Force Reload" or wait for the next Cron task to execute. The issue with a RamDisk is always size, so Its not appropriate to try and archive all the files and restore them... Not to mention that any time Cron ran, or you used a "Force" command, it would archive the files and take some time (I assume) depending on how many Lists you use... Whats the benefit to use a Ramdisk anyways?

Thanks for the clarification. My pfSense box is using SSD, and 16GB RAM, lots of memory, so I thought why not use RAM Disk.

The cosmic gate

Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .

Or is the only way to solve this, to create floating rules ?

doktornotor

If you need a particular sorting, then use one of the Alias actions and create the rules manually, instead of using Block/Reject.