PfBlockerNG v2.0 w/DNSBL

schnubert

Valid point… ;)

I wasnt investing Alexa so far, it seems I should!

thanks! :D

Gerard64

Today I updated PfblockerNG to version 2.0.1 and enabled and configured DNSBL like BBcan177 explained at https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943 after some fiddling around (I exchanged dnsforwarder with dnsresolver) it started. But now I have another problem I can't solve. I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

How can I make reverse lookups work again?

BBcan177

@trinidadrancheria:

I was thinking about using the new features of pfBlockerNG 2.0 to stop spam at the firewall since the current version of PostFix does not yet support DNSBL out of the box..

IP lists and DNSBL feeds can protect a Mail server, but it won't replace DNS RBL functionality of Postfix/SpamAssassin etc…

@AndrewZ:

Re-installed and re-configured from scratch, nothing helps, the warning is still there.
No error in the log.
/var/db/pfblockerng/deny is empty (I have permit aliases only).

@AndrewZ,
De-duplication is only used for Deny rules. So just disable dedup to clear that warning message.

@ha11oga11o:

Dear BBcan177 i just want to express my huge gratitude to you incorporating DNSBL. Im using it for couple of days so far. It is insane how god is behave on my network. It is really insane how good it is. It simply work and it blocks so much garbage that is almost impossible to believe.

THANK YOU!

Thanks!

@doktornotor:

Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

Thanks Dok… I will get that variable fixed asap.

@schnubert:

So, apart from having the possibility to set a different update-interval is there another benefit out of it?

@schnubert,
Most DNSBL lists are updated on a daily basis… hpHosts has a partial feed that updates more frequently. You can see the last updated timestamp for IP/DNSBL Lists/feeds at the end of the pfBlockerng.log after any Cron event.

@Gé:

I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

Probably best to ask for help in the DNS forum section for this issue.

@Jamerson:

Than you for your answer, attached picture is showing that the services is not running .
when i try to run the service manually it said it started but nothings happened

@Jamerson,
Please edit the following file /usr/local/etc/rc.d/dnsbl.sh

and add the line in red as shown below:

186 update_static_output(" done.\nCreating DNSBL web server start-up script…");
$pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
187 $rc = array();

Then run:

/usr/local/etc/rc.d/dnsbl.sh start

Also did you follow the checklist here:
https://forum.pfsense.org/index.php?topic=102470.msg573776#msg573776

Panja

@Panja:

Is there a way, or will there be a way (in a future release) to add our own EasyList?
As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

Thanks

Can this be done?

Gerard64

@BBcan177:

@Gé:

I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

Probably best to ask for help in the DNS forum section for this issue.

I could do that. This morning wen i woke up several wlan users complained they couldn't get on the internet. i can't see anything wrong in pfsense everything seems to work but i can't get to internet on wlan. To many trouble with DNSBL so i'm going to disable DNSBL and start using dns-forwarder again and pfblocker without dnsbl. I also had to stop using ram file system for /var and /tmp because here also trouble because /var was full all the time wen i use dnsbl. anyway to much problems.

Edit: Wlan problems seem to be that pfsense local freeradius server can't be reached anymore.

Jamerson

@Jamerson,
Please edit the following file /usr/local/etc/rc.d/dnsbl.sh

and add the line in red as shown below:

186 update_static_output(" done.\nCreating DNSBL web server start-up script…");
$pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
187 $rc = array();

Then run:

/usr/local/etc/rc.d/dnsbl.sh start

Also did you follow the checklist here:
https://forum.pfsense.org/index.php?topic=102470.msg573776#msg573776

thank you so much for your answer,
the check list is already enabled ,
I've checked the as show but can't seem the find the location on the code to add the red line
below is what it shows on the dnsbl.sh file

#!/bin/sh

This file was automatically generated

by the pfSense service handler.

rc_start() {

Start DNSBL Lighttpd webserver

if [ -f '/var/unbound/pfb_dnsbl_lighty.conf' ]; then
/usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
fi

Terminate DNSBL HTTPS Daemon if found

pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
if [ ! -z "${pidnum}" ]; then
/bin/kill -9 "${pidnum}"
/bin/sleep 2
fi

Start DNSBL HTTPS Daemon

/usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &

}

rc_stop() {

Terminate DNSBL Lighttpd webserver, if found.

pidnum="$(/bin/pgrep lighttpd_pfb)"
if [ ! -z "${pidnum}" ]; then
/usr/bin/killall lighttpd_pfb
fi

Terminate DNSBL HTTPS Daemon, if found.

pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
if [ ! -z "${pidnum}" ]; then
/bin/kill -9 "${pidnum}"
/bin/sleep 2
fi

}

case $1 in
start)
rc_start
;;
stop)
rc_stop
;;
restart)
rc_stop
rc_start
;;
esac

Ibor Daru

@Panja:

Is there a way, or will there be a way (in a future release) to add our own EasyList?
As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

Thanks

Concur to that as well!

BBcan177

@Ibor:

@Panja:

Is there a way, or will there be a way (in a future release) to add our own EasyList?
As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

Thanks

Concur to that as well!

@Panja @Ibor Daru,

Yes this can be done. However, I am working on porting the package to 2.3 (Bootstrap) and trying to manage day-to-day life at the same time… :)

ADBlock works differently than DNSBL... ADBlock can filter domains as follows:

www.cnn.com/banners/example.com

AdBlock will filter any domain listed in the /banners folder, but DNSBL will need to know explicitly which Domains to block. ADBlock also has subdomains which if used in DNSBL will cause severe False Positives.

So to use any of the other ADBlock EasyList feeds (Dutch, Chinese, German etc...) I have to know which categories are the actual ADvert domains. Not all of the ADBlock EasyList Feeds can be used...

If you look at the DNSBL EasyList Tab, you can see which categories are being used for EasyList (w/o Elements) and EasyList Privacy.. You can compare this to the raw EasyList file and manually add the Dutch EasyList ADvert domains and add those to a Custom List for DNSBL. Just make sure that its formatted to one domain per line.

It is something that I would like to do... Just need to find some time... But it will be added :)

BBcan177

@Gé:

@BBcan177:

@Gé:

I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

Probably best to ask for help in the DNS forum section for this issue.

I could do that. This morning wen i woke up several wlan users complained they couldn't get on the internet. i can't see anything wrong in pfsense everything seems to work but i can't get to internet on wlan. To many trouble with DNSBL so i'm going to disable DNSBL and start using dns-forwarder again and pfblocker without dnsbl. I also had to stop using ram file system for /var and /tmp because here also trouble because /var was full all the time wen i use dnsbl. anyway to much problems.

Edit: Wlan problems seem to be that pfsense local freeradius server can't be reached anymore.

Sorry to hear that… Did you have DHCP registration enabled in the Resolver? There seems to be some underlying issues with that feature in the Resolver. DNSBL just does a Resolver reload to get its updates into the Resolver. Take a look at the resolver.log and the system.log to see what the error messages were... I added notes about this in the instructions posted in this thread.

I do not have a lot of extra configuration in the Resolver for overrides and thats why I suggest you ask in the DNS forum as those guys live that stuff every day and can better reply to that particular issue...

In regards to your issue with WLANs, make sure that those other LAN segments can see the DNSBL VIP or else DNSBL will not function. You can click the checkbox in the DNSBL tab to auto create a Floating firewall rule for that... But also make sure there are no other rules that can block access to the DNSBL VIP. Try to ping the DNSBL IP from thhe WLAN as a test...

On another note: Seems someone recently gave a negative smite…. ???

BBcan177

@Jamerson:

thank you so much for your answer,
the check list is already enabled ,
I've checked the as show but can't seem the find the location on the code to add the red line
below is what it shows on the dnsbl.sh file

Jamerson, sorry about that… you can disregard those instructions... The key point here is that these lines in the dnsbl.sh file (in red) file are correct...

if [ -f '[color=red]/var/unbound/pfb_dnsbl_lighty.conf' ]; then
/usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
fi

I sent you a PM to see if we can work out this issue offline, and I can go from there… Thanks!

Panja

BBcan177 no worries!
We all have lives to live. 8)
So no pressure mate. Just wanted to check.
Good to hear it's coming. I'll just wait. I'm a patient dude. ;)

Jamerson

@BBcan177:

@Jamerson:

thank you so much for your answer,
the check list is already enabled ,
I've checked the as show but can't seem the find the location on the code to add the red line
below is what it shows on the dnsbl.sh file

Jamerson, sorry about that… you can disregard those instructions... The key point here is that these lines in the dnsbl.sh file (in red) file are correct...

if [ -f '[color=red]/var/unbound/pfb_dnsbl_lighty.conf' ]; then
/usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
fi

I sent you a PM to see if we can work out this issue offline, and I can go from there… Thanks!

much appreciate your support,
will reply on the PM

csircc

Hi,

i had installed pfblockerNG and setup IPv4 Alias/List Configuration to create IPv4 Lists (for example source: http://list.iblocklist.com/?list=xshktygkujudfnjfioro&fileformat=p2p&archiveformat=gz).But this rule block my important website (like Hotmail and other ) i don't want to disable or delete this list. Do i have any other method?(like whitelist and how to do) Thanks!

Jamerson

@Jamerson:

@BBcan177:

@Jamerson:

thank you so much for your answer,
the check list is already enabled ,
I've checked the as show but can't seem the find the location on the code to add the red line
below is what it shows on the dnsbl.sh file

Jamerson, sorry about that… you can disregard those instructions... The key point here is that these lines in the dnsbl.sh file (in red) file are correct...

if [ -f '[color=red]/var/unbound/pfb_dnsbl_lighty.conf' ]; then
/usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
fi

I sent you a PM to see if we can work out this issue offline, and I can go from there… Thanks!

much appreciate your support,
will reply on the PM

thank you so much for your help,
I didn't read the instruction carefully ,
the servers is on and everything is working fine

thank you so much BBCAN

Gerard64

@BBcan177:

Sorry to hear that… Did you have DHCP registration enabled in the Resolver? There seems to be some underlying issues with that feature in the Resolver. DNSBL just does a Resolver reload to get its updates into the Resolver. Take a look at the resolver.log and the system.log to see what the error messages were... I added notes about this in the instructions posted in this thread.

I do not have a lot of extra configuration in the Resolver for overrides and thats why I suggest you ask in the DNS forum as those guys live that stuff every day and can better reply to that particular issue...

In regards to your issue with WLANs, make sure that those other LAN segments can see the DNSBL VIP or else DNSBL will not function. You can click the checkbox in the DNSBL tab to auto create a Floating firewall rule for that... But also make sure there are no other rules that can block access to the DNSBL VIP. Try to ping the DNSBL IP from thhe WLAN as a test...

On another note: Seems someone recently gave a negative smite…. ???

Thank you BBcan177 for the information I wil try it soon again. I had to do a full backup restore to get pfSense back on track. I have to get some new courage to give it another shot.

I selected all the network segments and as long as the wlan client were still connected they could reach the vip address the dnsbl webserver. Wen the wlan client reconnects it got a authentication error because pfsense could not reach the local radius server. I searched for hours to find what cause this but couldn't find it.

It wasn't me btw who gave you the childish smite you do and did a GREAT job!

doktornotor

@csircc:

i had installed pfblockerNG and setup IPv4 Alias/List Configuration to create IPv4 Lists (for example source: http://list.iblocklist.com/?list=xshktygkujudfnjfioro&fileformat=p2p&archiveformat=gz).But this rule block my important website (like Hotmail and other ) i don't want to disable or delete this list. Do i have any other method?(like whitelist and how to do) Thanks!

Soloam

Passing my comment from the other topic to this one

Somtimes the reporting of the Alerts misses the list matching! I had this problem today.

List 1 - Alias_Deny (De-Duplication enabled)
List 2 - Alias_Native

Interface 1
Block List 1

The IP1 is in both lists, because Alias_Native does not passes by the De-Duplication process.

I had a hit on Interface 1 of IP1 and in the alert tab appeared the information that the hit is from List 2 (that does not even appears on the Interface)

Thank You all

Soloam

One extra that would be very useful is the ability to export (automatic) the lists to the webserver of PFSense, that way I could use the same list on other computers and only maintain it in pfsense. This is useful because when I'm not at home I like to use on my personal laptop the lists with PeerBlock!

Nice Job

pfcode

Hi, BBCan77

I got first crash report since upgraded to v2:

PHP Errors:
[27-Nov-2015 12:14:53 America/Toronto] PHP Fatal error: Maximum execution time of 900 seconds exceeded in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 1662

Jamerson

Thank you BBCAN,
I've tested it and it works fine really clean internet.
the only think I notice is the DHCP server stops sharing IPS,
is this related to the DNSBL ?
please advise.