PfBlockerNG v2.0 w/DNSBL

trinidadrancheria

I was thinking about using the new features of pfBlockerNG 2.0 to stop spam at the firewall since the current version of PostFix does not yet support DNSBL out of the box…
I was thinking of setting the list action to alias, then putting the firewall rules in to block all incoming from the sites. Problem I think is that the SpamHaus DNS list is a live list (query).... Is this supported?

Panja

I have installed pfBlockerNG v2.01 on my APU1D4 pfSense 2.2.5

I'm blocking a few countries for inbound traffic.
I also setup DNSBL as per post: https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943

I'm using OpenDNS in General Setup and DNS Resolver is enabled with the following options:
Enable Forwarding Mode (this is needed for my OpenDNS filtering)
Register DHCP leases in the DNS Resolver
Register DHCP static mappings in the DNS Resolver

All is working, ads are being blocked.
Only problem is when I reboot my box the Unbound Service is not started automatically (or is being stopped).
So with every reboot I do, I have to manually start the Unbound Service.

What could be the problem?

hda

@Panja:

…
So with every reboot I do, I have to manually start the Unbound Service.

What could be the problem?

You lost the pfb_dnsbl.conf, in Unbound(Advanced) conf, due to /var in RAM ?
Delete that line and do a pfB Force Update.

Panja

Nope… The line was there:
server:include: /var/unbound/pfb_dnsbl.conf

But I removed it, did a force update and rebooted.
Same problem.
Unbound is stopped when the reboot is done.

BBcan177

Try to set the Resolver without the two DHCP registration checkboxs enabled… See the first post in this thread :)

Panja

I have read that post. :)

Disable the two "DHCP registrations" checkboxes, unless you really require those options.

I really require those, thats the reason I left them checked… 8)
Will uncheck them and check if it fixes things for me.

Panja

It indeed works now. ;D
I will leave the two checkboxes unchecked and live without them.

Btw many thanks for bringing this awesome package to us BBcan177.
Much appreciated!

AndrewZ

@BBcan177:

This warning indicates that the masterfile is out of sync with the files in the /deny folder. This is a new feature that was added to v2.0 to warn users about this issue. Usually running a 'Force Reload' is sufficient to fix that warning; however, clearing out all the files and starting fresh might be needed in certain conditions. If this is still an issue, please review the pfblockerng.log file for other clues.

Re-installed and re-configured from scratch, nothing helps, the warning is still there.
No error in the log.
/var/db/pfblockerng/deny is empty (I have permit aliases only).

Panja

I'm having another problem.
All is working on my LAN interface but I have created a WIFI_GUEST interface.
On the WIFI_GUEST interface it's not working. Some sites won't load at all.
I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

WIFI_GUEST firewall rules:

Jamerson

Thank you so much,
any suggestions how to configure this ?
on the list of action, have to use disable or deny inbound ?

I've configured deny inbound and enabled alexa list but the webserver isn't starting at all
pfBlockerNG DNSBL Web Server is not started yet .

what I am doing wrong ?

Hugovsky

@Panja:

I'm having another problem.
All is working on my LAN interface but I have created a WIFI_GUEST interface.
On the WIFI_GUEST interface it's not working. Some sites won't load at all.
I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

WIFI_GUEST firewall rules:

You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.

trinidadrancheria

Does this only work with lists, or will it work with live dnsbl queries?

doktornotor

@trinidadrancheria:

will it work with live dnsbl queries?

No.

ha11oga11o

Dear BBcan177 i just want to express my huge gratitude to you incorporating DNSBL. Im using it for couple of days so far. It is insane how god is behave on my network. It is really insane how good it is. It simply work and it blocks so much garbage that is almost impossible to believe.

THANK YOU!

Jamerson

cant get it to work,
the service is not starting." pfBlockerNG DNSBL Web Server "

rebooted the box, remove the package , reinstall it, no vail

please advise

Panja

@Hugovsky:

You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.

Thanks! It's working now. Created an alias for port 8081 + 8443 and added it to a rule to allow to 127.0.0.1
It was the "Block access to firewall" rule that prevented it to work, right?

This is the setup now, which is working. :)

doktornotor

I think you guys are missing this (on the DNSBL tab) with multiple LANs:

Panja

Nope, did not miss that.
As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

So I checked both interfaces (LAN + WIFI_GUEST) on the DNSBL tab.
And after that I went to the floating rule and both interfaces were marked in that rule.

doktornotor

@Panja:

Nope, did not miss that.
As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

Have hard time seeing how's that screenshot showing anything floating.

Panja