PfBlockerNG v2.0 w/DNSBL
-
@webtyro:
@BBcan177
First I wanted to thank you for the work you have put into this and as usual no real problems. I just wanted to ask about the gif image being pushed to the browser. When I browse to the VIP address I get a 1x1 pixel image. Is this image a placecard holder that would be populated with info or should it be in a different scale. I run my browser locked down as much as possible so not having seen the image is not on my priority list. I can ping and browse to it but was wondering about the single pixel size. If this is normal unpopulated size no worries but if not where do you hide it and what size is the default.Where is this 1x1 Pixel option? I don't see it anywhere.
Some details here:
https://forum.pfsense.org/index.php?topic=120253.msg665063#msg665063With the current version its not practical since you will get this image instead of the 1x1 for blocked ADs also…
The next version has functionality to push a blocked page if the blocked page was say www.example.com... And if the blocked page was an AD, then it gets the 1x1 pixel instead...
The Blocked page is also customizable to what ever you want to add to it...
-
I set up pfBlockerNG using this guide https://www.tecmint.com/install-configure-pfblockerng-dns-black-listing-in-pfsense/. I saw it mentioned (somewhere around page 45ish) that one of the reasons why I might not be see any sort of output on the alerts or blocking in general was because I am running Squid (transparent mode, wpad, ssl filtering (splice all)) on LAN and loopback interfaces. Do I need to adjust Squid to also filter on WAN interface as well to get these two packages to play with one another or is it something else entirely?
I'm able to browse and ping the VIP address with no problems. I attempted to ping and nslookup something off of the yoyo list which I have added on my feeds and both went through okay.
-
I have new hardware with a new installation.
I restore de backup file.
But on the new installation pfblockerNG geoIP is missing.>>> Installing pfSense-pkg-pfBlockerNG... Updating pfSense-core repository catalogue... pfSense-core repository is up to date. Updating pfSense repository catalogue... pfSense repository is up to date. All repositories are up to date. Checking integrity... done (0 conflicting) The following 9 package(s) will be affected (of 0 checked): New packages to be INSTALLED: pfSense-pkg-pfBlockerNG: 2.1.2_1 [pfSense] lighttpd: 1.4.45_1 [pfSense] lua52: 5.2.4 [pfSense] whois: 5.2.17 [pfSense] GeoIP: 1.6.11 [pfSense] grepcidr: 2.0 [pfSense] aggregate: 1.6_1 [pfSense] pecl-intl: 3.0.0_10 [pfSense] icu: 59.1,1 [pfSense] Number of packages to be installed: 9 The process will require 47 MiB more space. [1/9] Installing lua52-5.2.4... [1/9] Extracting lua52-5.2.4: ......... done [2/9] Installing icu-59.1,1... [2/9] Extracting icu-59.1,1: .......... done [3/9] Installing lighttpd-1.4.45_1... [3/9] Extracting lighttpd-1.4.45_1: .......... done [4/9] Installing whois-5.2.17... [4/9] Extracting whois-5.2.17: .......... done [5/9] Installing GeoIP-1.6.11... [5/9] Extracting GeoIP-1.6.11: .......... done [6/9] Installing grepcidr-2.0... [6/9] Extracting grepcidr-2.0: ..... done [7/9] Installing aggregate-1.6_1... [7/9] Extracting aggregate-1.6_1: .... done [8/9] Installing pecl-intl-3.0.0_10... [8/9] Extracting pecl-intl-3.0.0_10: .......... done [9/9] Installing pfSense-pkg-pfBlockerNG-2.1.2_1... [9/9] Extracting pfSense-pkg-pfBlockerNG-2.1.2_1: .......... done Saving updated package information... done. Loading package configuration... done. Configuring package components... Loading package instructions... Custom commands... Executing custom_php_install_command()... Downloading MaxMind GeoIP databases. This may take a minute... GeoIP.dat... cURL Error: 60. cURL Error: 60. cURL Error: 60. Failed! MaxMind download Failed! Fetching MaxMind archive from pfSense package repo... /tmp/countrycodes.tar.bz2 0 B 0 Bps Fetch done. Converting MaxMind GeoIP databases for pfBlockerNG. This may take a few minutes... Country code update Start [ 11/13/17 22:00:44 ] [ MAXMIND UPDATE FAIL, Language File Missing, using previous Country code database ] Creating pfBlockerNG Continent XML files... Creating pfBlockerNG Continent XML files IPv4 Africa IPv6 Africa [ 11/13/17 22:00:45 ] IPv4 Antarctica grep: /usr/local/share/GeoIP/cc/Antarctica_v4.txt: No such file or directory IPv6 Antarctica grep: /usr/local/share/GeoIP/cc/Antarctica_v6.txt: No such file or directory IPv4 Asia IPv6 Asia IPv4 Europe IPv6 Europe [ 11/13/17 22:00:48 ] IPv4 North America IPv6 North America [ 11/13/17 22:00:49 ] IPv4 Oceania IPv6 Oceania [ 11/13/17 22:00:50 ] IPv4 South America IPv6 South America IPv4 Proxy and Satellite grep: /usr/local/share/GeoIP/cc/Proxy_and_Satellite_v4.txt: No such file or directory IPv6 Proxy and Satellite grep: /usr/local/share/GeoIP/cc/Proxy_and_Satellite_v6.txt: No such file or directory IPv4 TOP 20 grep: /usr/local/share/GeoIP/cc/Top_20_v4.info: No such file or directory IPv6 TOP 20 grep: /usr/local/share/GeoIP/cc/Top_20_v6.info: No such file or directory pfBlockerNG Reputation Tab Country Code Update Ended Adding pfBlockerNG Widget to the Dashboard... done. Remove any existing and create link for DNSBL lighttpd executable... done. Creating DNSBL web server start-up script... done. Upgrading Adv. Inbound firewall rule settings ... no changes required ... done. Custom commands completed ... done. Executing custom_php_resync_config_command()...done. Menu items... done. Services... done. Writing configuration... done. Message from lua52-5.2.4: ===> NOTICE: The lua52 port currently does not have a maintainer. As a result, it is more likely to have unresolved issues, not be up-to-date, or even be removed in the future. To volunteer to maintain this port, please create an issue at: https://bugs.freebsd.org/bugzilla More information about port maintainership is available at: https://www.freebsd.org/doc/en/articles/contributing/ports-contributing.html#maintain-port Message from GeoIP-1.6.11: GeoIP does not ship with the actual data files. You must download them yourself! Please run: # /usr/local/bin/geoipupdate.sh Message from pecl-intl-3.0.0_10: **************************************************************************** The following line has been added to your /usr/local/etc/php/ext-20-intl.ini configuration file to automatically load the installed extension: extension=intl.so **************************************************************************** >>> Cleaning up cache... done. Success
Is there anything else I can do in the pfBlockerNG settings to sort this out?
-
From your logs… Something is blocking the MaxMind download... So need to see what is causing that...
Downloading MaxMind GeoIP databases. This may take a minute... GeoIP.dat... cURL Error: 60. cURL Error: 60. cURL Error: 60. Failed! MaxMind download Failed! Fetching MaxMind archive from pfSense package repo... /tmp/countrycodes.tar.bz2
The backup archive that is located on pfSense's servers is a little out of date… I should fix that.
Here is one of the files that you can test with to see why its failing to download:
https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zipMaxMind does rate-limit if you attempt too many downloads in a day...
-
So, I don't wanna be one the one to ask this, but I am so eager to try 3.0. Any update when this will be released? I just did a clean install of the newest pfSense and like the changes and fixes in place but I didn't think to save all my config etc before I did it. (I know, really dumb of me). Would this of worked anyway? It's really tedious going through and looking for the lists again, so I'm feeling hopeful here it's coming soon as I really love pfBlockerNG and the work you do BBCan177!!! :)
-
@StylesNZ:
So, I don't wanna be one the one to ask this, but I am so eager to try 3.0. Any update when this will be released? I just did a clean install of the newest pfSense and like the changes and fixes in place but I didn't think to save all my config etc before I did it. (I know, really dumb of me). Would this of worked anyway? It's really tedious going through and looking for the lists again, so I'm feeling hopeful here it's coming soon as I really love pfBlockerNG and the work you do BBCan177!!! :)
Thanks, I am hoping to get this out shortly… Just trying to clean up a couple loose ends.... Stay tuned!
-
Thanks, I am hoping to get this out shortly… Just trying to clean up a couple loose ends.... Stay tuned!
maybe as a cristmas gift @bbcan ? ::) ::)
really look forward to your release -
-
Hi,
I have a custom IPV4 Denny List
On Custom Address(es) I have 9 IPs but only 7 off them are been loaded
5.9.110.236
54.207.50.1
187.17.111.97
169.45.117.93
96.6.123.19
104.16.84.55
104.16.83.55
162.243.102.114
187.61.117.226These two are not loading, I try to change order, set "Update Custom List" on drop down, etc.
5.9.110.236
162.243.102.114Any ideas?
Thanks
-
Did you ran a Force Update and a Force Reload IP ?
Look at the pfblockerng.log, error.log to see what is happening when that Table is loaded?
Does these IPs get whitelisted? -
Hi,
I found that on log:
[ Denny_list_custom ] Downloading update . completed ..
–----------------------------
Original Master Final
------------------------------
9 7 7 [ Pass ]I realize that the IP 162.243.102.114 are included in another entry as member of AS14061
But not find any conflict on the IP 5.9.110.236
Thanks.
-
Maybe it's already in another Table
grep "5.9.110.236" /var/db/pfblockerng/deny/*
or using a different range
grep "5.9.110" /var/db/pfblockerng/deny/* grep "5.9.11" /var/db/pfblockerng/deny/* grep "5.9.1" /var/db/pfblockerng/deny/* grep "5.9." /var/db/pfblockerng/deny/*
-
Bingo
I find it on: /var/db/pfblockerng/deny/IBlock_Proxy.txt:5.9.110.236exi
But I have one server communicating on port 123 with that IP, believe are one NTP server.
Why are not blocking it?
-
I'm having problems with iOS 11.3 BETA. It seems that safari can't go to 0.0.0.0 and pages can't load. Solution was to reinstall package and use the VIP address, as I was using the certificate hack and 0.0.0.0.
EDIT: Sorry, wrong version. I'm on 2.1.
-
earlier this month 1.1.1.1 (DNS server) was announced.
I noticed I can use their backup server 1.0.0.1 but cannot use 1.1.1.1I have read that it is because of pfblockerNG, I tried the suggested edit from shell
https://www.reddit.com/r/PFSENSE/comments/88wg6g/issue_with_pfblockerng_dnsbl_and_cloudflares_1111/
sed -i '' 's/1.1.1.1/1.1.1.2/g' /usr/local/pkg/pfblockerng/pfblockerng.sh
but it does not seem to have worked, any help is appreciated.
-
You have to do a Force Reload All when you change this IP.
-
Did charting make it into this release? I can't seem to find it.
https://forum.pfsense.org/index.php?topic=144733.msg787832#msg787832
-
I've just set this up, and the blocker is indeed very effective!
At the moment I'm using the DNSBL part only but so far it's impressive.The only thing missing at the moment is the DNS blocking for IPv6 content. For example on Youtube.
As I understand this would be a new future for the upcoming 3.0 release, if so then I'm eager to try it out.Thanks for your work on pfBlockerNG and your support, it's a must have for PfSense.
Cheers.
Edit:
I should have posted this in the pfBlockerNG 2.1 topic, that's the actual version installed on my pfsense box. -
Hi do you have any guide or tutorial for the new version of pfblockerng w/ dnsbl.
Kindly please share.Thanks
-
@labradorg13 https://www.linuxincluded.com/block-ads-malvertising-on-pfsense-using-pfblockerng-dnsbl/
-
Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()
Help??? -
@sashazt said in PfBlockerNG v2.0 w/DNSBL:
Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()
Help???Strange error... Looks like it didn't install properly... Do you have enough hard drive space? Try to remove/reinstall the package.
-
It looks like a PHP Opcache issue. Simply reboot pfsense after upgrade. Then it works.
-
@sashazt said in PfBlockerNG v2.0 w/DNSBL:
Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()
Can you confirm if you are on pfSense 2.4.3? or 2.4.4?
Also did this occur when you upgraded pfBlockerNG-devel? or was this a new installation of pfBlockerNG-devel?
-
@bbcan177 I'm running pfsense 2.4.3-RELEASE-p1 and upgraded from pfBlockerNG 2.1.4_9 to 2.2.5_11 (dev). There are no installation errors but it looks like that the PHP files are cached due opcache.
$ php -v PHP 5.6.34 (cli) (built: Mar 16 2018 16:55:46) Copyright (c) 1997-2016 The PHP Group Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies with Suhosin v0.9.38, Copyright (c) 2007-2015, by SektionEins GmbH
-
@overloader is your php using
opcache.validate_timestamps=0
?
If it doesn't opcache should be able to check the modified timestamp and regenerate the cache.
I found out a little issue with a feed blocking it's own IP, funny.
Info regarding the feed
PRI4 - CCT_IP - https[:]//cybercrime-tracker[.]net/fuckerz.php - 213.186.33.3I'll drop an email and report it directly to the list owner, till here easy.
However the main gateway is still able to connect and download from that IP.
pfSense gateway - pfBlockerNG Reports
Sep 4 10:00:47 WIFI pfB_PRI4_v4 (1770006077) 192.168.20.103:44188 213.186.33.3:443 cluster015.ovh.net TCP:S
pfSense test box on WIFI vlan - 192.168.20.103 - pfBlockerNG error.log
[ pfB_PRI4_v4 - CCT_IP_v4 ] Download FAIL [ 09/04/18 10:00:53 ] Firewall and/or IDS (Legacy mode only) are not blocking download.
Inbound interface is WAN
- Advanced inbound on OpenPorts alias
- Advanced outbound any any - as default
- Floating rules deny both directions
Outbound interfaces, all including WAN
- Advance inbound/outbound as default
- Floating rules denying both directions
Pinging the IP from WAN correctly fails so pfB rules are working, but why is it still able to download, or is pfBlockerNG able to circumvent it's own block lists.
I was only able to found out the feed blocking it's own IP only because I was synching to the client.
Cheers
-
I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.
Thanks.
-
@ibbetsion said in PfBlockerNG v2.0 w/DNSBL:
I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.
https://forum.netgate.com/topic/135708/is-pfblockerng-devel-stable
-
@bbcan177 said in PfBlockerNG v2.0 w/DNSBL:
@ibbetsion said in PfBlockerNG v2.0 w/DNSBL:
I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.
https://forum.netgate.com/topic/135708/is-pfblockerng-devel-stable
Thank you.
-
I love it and it even has the BBC in the list lol
I am I dying to get more Anti corp lists like what you see on filterlist.com because of spying but I get a lot of :[ pfB_PRI1_v4 - BBC_C2_Agr_v4 ] Download FAIL [ 02/03/19 11:04:34 ]
[ pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL [ 02/03/19 11:04:19 ]
[ pfB_PRI1_v4 - CINS_army_v4 ] Download FAIL [ 02/03/19 11:04:02 ]
[ pfB_PRI1_v4 - BBC_C2_v4 ] Download FAIL [ 02/03/19 11:03:46 ]
[ DNSBL_NSA - NSAblocklist1 ] Download FAIL [ 02/03/19 11:03:30 ]
[ DNSBL_facebook - FB2 ] Download FAIL [ 02/03/19 11:03:15 ]and this
[ BBC_C2_Agr_v4 ] Downloading update . cURL Error: 60
SSL certificate problem: self signed certificate Retry in 5 seconds...
. cURL Error: 60
SSL certificate problem: self signed certificate Retry in 5 seconds...
. cURL Error: 60
SSL certificate problem: self signed certificate Retry in 5 seconds...
.. unknown http status code | 0[ pfB_PRI1_v4 - BBC_C2_Agr_v4 ] Download FAIL [ 02/03/19 11:04:34 ]
[ osint.bambenekconsulting.com ] Domain listed in DNSBLThe Following List has been REMOVED [ BBC_C2_Agr_v4 ]
and I have no idea if I'm doing something wrong or it's just the site?
or its because it's not in the right format?
But its still going great and so much simpler to use.
Great work.I do wonder if this is 0.0.0.0 example.com is ok to put as a list?
I could just ake my own list but then they would not get updated.I want to block all companies like google, apple, Microsoft, NSA Government, and so on.
I just use a paiid vpn to reach the outside world. -
@anttechs edit filerlist to filterlists ;)
About the failed downloads, if i remember right some list does include other list' IP, so if you have WAN as Outbound interface in pfBlockerNG these IPs are going to be blocked. The same should apply for the SSL error.
-
Many thanks ;)
I'm still learning everyday lol
mines on LAN Outbound Firewall Rules reject.
but Wan is set to defaultI think I get it
I disabled TLD because I had .com and most of the others in there, I may be going over the top lol
-
@anttechs said in PfBlockerNG v2.0 w/DNSBL:
Many thanks ;)
You're welcome
I disabled TLD because I had .com and most of the others in there
Yeap, that would be it!
Cheers
-
can a dev confirm whether or not snort/suricata are available in the 2.5 dev? they are installable but not listed in services or showing in top
-
Was using the non-devel package and began seeing the crashes.
Uninstalled and installed the Devel package (2.2.5_37). Still seeing this. (2.4.5-p1)
Crash report details:
PHP Errors: [13-Nov-2020 12:33:48 America/New_York] PHP Fatal error: Uncaught Error: Cannot create references to/from string offsets in /usr/local/pkg/pfblockerng/pfblockerng_install.inc:113 Stack trace: #0 /etc/inc/pkg-utils.inc(770) : eval()'d code(1): include_once() #1 /etc/inc/pkg-utils.inc(770): eval() #2 /etc/inc/pkg-utils.inc(858): eval_once('include_once('/...') #3 /etc/rc.packages(74): install_package_xml('pfBlockerNG-dev...') #4 {main} thrown in /usr/local/pkg/pfblockerng/pfblockerng_install.inc on line 113
/etc/rc.packages: New alert found: PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng_install.inc, Line: 113, Message: Uncaught Error: Cannot create references to/from string offsets in /usr/local/pkg/pfblockerng/pfblockerng_install.inc:113 Stack trace: #0 /etc/inc/pkg-utils.inc(770) : eval()'d code(1): include_once() #1 /etc/inc/pkg-utils.inc(770): eval() #2 /etc/inc/pkg-utils.inc(858): eval_once('include_once('/...') #3 /etc/rc.packages(74): install_package_xml('pfBlockerNG-dev...') #4 {main} thrown
Anything I need to worry about?
-
if you look at /usr/local/pkg/pfblockerng/pfblockerng_install.inc
it's about the cron jobs removal.
// Remove discontinued pfBlockerNG CRON job $pfb_cron = &$config['cron']['item']; if (isset($pfb_cron)) { foreach ($pfb_cron as $key => $item) { if (strpos($item['command'], 'pfblockerng.php dc >>') !== FALSE) { unset($pfb_cron[$key]); } } }
Have a look at /etc/crontab, you can also install the Cron package.
-
@RonpfS
These are the current pfBlockerNG cron entries# pfSense specific crontab entries # Created: November 13, 2020, 2:10 pm # 0 0 4-10 * * root /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dcc >> /var/log/pfblockerng/extras.log 2>&1 0 * * * * root /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php cron >> /var/log/pfblockerng/pfblockerng.log 2>&1
What I don't know though is...are these two entries part of the new -Devel installation or are these the old discontinued ones - that it's supposed to remove?
Based on the comment line, you can see that the comments were added today, but can't say for certain if the cron entries are pre-existing or not.Based on you having the -Devel version also installed and guessing that you are not seeing this error, what does your pfBlocker crontab entry look like? Match mine?
I don't speak PHP, so not quite sure how to evaluate that 'if' statement.
-
@ck42
I have one more0 11 4-10 * * root /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dcc >> /var/log/pfblockerng/extras.log 2>&1 0 22 * * * root /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php bl shallalist,ut1 >> /var/log/pfblockerng/extras.log 2>&1 15 2,5,8,11,14,17,20,23 * * * root /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php cron >> /var/log/pfblockerng/pfblockerng.log 2>&1
Maybe disabling pfblockerNG will delete the pfb entries. When you install, was pfblockerNG disabled ?
Maybe try to install the package with pfblockerNG disabled again. -
@RonpfS
Disabling pfBlocker did remove the cron entries. Re-enabling did not create that third one that you have though.
Next, I disabled it and then re-installed it (did not uninstall and then install again manually, just used the re-install option in the package manager). Then enabled it. Still only have the two cron entries. But.....I don't seem to be seeing the crash message any longer. Interesting.
I'll keep an eye on it and see if this is permanent.
Still curious though about your third cron entry. Wondering if this is maybe due to an additional configuration somewhere in your pfBlocker configuration that you enabled that I don't have. If so, then it's not a concern. -
@ck42 The entry is related to Firewall / pfBlockerNG/ DNSBL / DNSBL Category Blacklist.