Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved
    pfBlockerNG
    192
    1.1k
    1.4m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      @torsurfer:

      I think a solution to this problem might be the use of a reverse proxy, which I'd have to look into to see if it's possible. But thanks Doc for your comment.

      I think that will produce one giant kaboom, but whatever… You should rather look into NAT firewall rules with "This firewall" as source.

      1 Reply Last reply Reply Quote 0
      • T
        torsurfer
        last edited by

        @doktornotor:

        @torsurfer:

        I think a solution to this problem might be the use of a reverse proxy, which I'd have to look into to see if it's possible. But thanks Doc for your comment.

        I think that will produce one giant kaboom, but whatever… You should rather look into NAT firewall rules with "This firewall" as source.

        Yeah, it involves some manual settings in lighttpd conf files to enable reverse proxy for 80 -> 8081 and 443 -> 8441. The settings will survive reboots, but won't survive any 'Save' done via the GUI. Still, it hasn't quite kaboom on me.  ;D But definitely not preferable.

        Re: NAT firewall rules. Unless there's something there at the NAT rules where it allows me to choose Localhost as the Interface, nothing that I've tinkered with so far has any effect on Squid. But thanks for the idea, Doc.

        Edit: I've said too soon, the manual settings in lighttpd conf files get 'refreshed' after reboot. So now I have to look for a different solution.  :(

        1 Reply Last reply Reply Quote 0
        • RonpfSR
          RonpfS
          last edited by

          Having problem with unbound that doesn't start on reboot

          I did a fresh install of  2.2.5-RELEASE (i386) built on Wed Nov 04 15:50:18 CST 2015 on a Asus P4P800 P4 3.0GHZ 2GB.

          On the old system, I had 2.2.5 x386 snort, suricata, NTopNG, PfBlockerNG v2.0.1 installed.
          When I restored the config, package re-installation failed, no resolver was running, so I set pfsense to use the resolver of the WAN DHCP interface.

          I reinstalled all package, remove the WAN DNS from General Setup, things run fine but when I reboot unbound isn't running, I can start it and it keep running.

          So I desintalled the packages, reinstall snort and suricata, reboot is fine, unbound is running .
          Installed pfBlockerNG v2.0.2, everything is fine, reboot , unbound isn't up, I start it and it is fine

          System General

          Dec  5 13:36:50 pfSense php-fpm[19202]: /reboot.php: Stopping all packages.
Dec  5 13:36:50 pfSense SnortStartup[38735]: Snort STOP for WAN(33233_sk0)...
Dec  5 13:36:51 pfSense snort[92226]: *** Caught Term-Signal
Dec  5 13:36:53 pfSense SuricataStartup[47549]: Suricata STOP for WAN(63282_sk0)...
Dec  5 13:36:54 pfSense kernel: sk0: promiscuous mode disabled
Dec  5 13:36:59 pfSense shutdown: reboot by root: 
Dec  5 13:36:59 pfSense shutdown: reboot by root: 
Dec  5 13:36:59 pfSense syslogd: exiting on signal 15
Dec  5 13:38:42 pfSense syslogd: kernel boot file is /boot/kernel/kernel
Dec  5 13:38:42 pfSense kernel: Copyright (c) 1992-2014 The FreeBSD Project.
Dec  5 13:38:42 pfSense kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
Dec  5 13:38:42 pfSense kernel: The Regents of the University of California. All rights reserved.
Dec  5 13:38:42 pfSense kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
Dec  5 13:38:42 pfSense kernel: FreeBSD 10.1-RELEASE-p24 #0 f27a67c(releng/10.1)-dirty: Wed Nov  4 16:13:40 CST 2015
Dec  5 13:38:42 pfSense kernel: root@pfs22-i386-builder:/usr/obj.RELENG_2_2.i386/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10 i386
Dec  5 13:38:42 pfSense kernel: FreeBSD clang version 3.4.1 (tags/RELEASE_34/dot1-final 208032) 20140512
Dec  5 13:38:42 pfSense kernel: CPU: Intel(R) Pentium(R) 4 CPU 3.00GHz (3006.87-MHz 686-class CPU)
Dec  5 13:38:42 pfSense kernel: Origin = "GenuineIntel"  Id = 0xf41  Family = 0xf  Model = 0x4  Stepping = 1
Dec  5 13:38:42 pfSense kernel: Features=0xbfebfbff <fpu,vme,de,pse,tsc,msr,pae,mce,cx8,apic,sep,mtrr,pge,mca,cmov,pat,pse36,clflush,dts,acpi,mmx,fxsr,sse,sse2,ss,htt,tm,pbe>Dec  5 13:38:42 pfSense kernel: Features2=0x441d <sse3,dtes64,mon,ds_cpl,cnxt-id,xtpr>Dec  5 13:38:42 pfSense kernel: TSC: P-state invariant
Dec  5 13:38:42 pfSense kernel: real memory  = 2147483648 (2048 MB)
Dec  5 13:38:42 pfSense kernel: avail memory = 2072236032 (1976 MB)
Dec  5 13:38:42 pfSense kernel: Event timer "LAPIC" quality 400
Dec  5 13:38:42 pfSense kernel: ACPI APIC Table: <a m="" i ="" oemapic="">
Dec  5 13:38:42 pfSense kernel: FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
Dec  5 13:38:42 pfSense kernel: FreeBSD/SMP: 1 package(s) x 1 core(s) x 2 HTT threads
Dec  5 13:38:42 pfSense kernel: cpu0 (BSP): APIC ID:  0
Dec  5 13:38:42 pfSense kernel: cpu1 (AP/HT): APIC ID:  1
Dec  5 13:38:42 pfSense kernel: ioapic0 <version 2.0="">irqs 0-23 on motherboard
Dec  5 13:38:42 pfSense kernel: wlan: mac acl policy registered
Dec  5 13:38:42 pfSense kernel: kbd1 at kbdmux0
Dec  5 13:38:42 pfSense kernel: random: <software, yarrow="">initialized
Dec  5 13:38:42 pfSense kernel: cryptosoft0: <software crypto="">on motherboard
Dec  5 13:38:42 pfSense kernel: padlock0: No ACE support.
Dec  5 13:38:42 pfSense kernel: acpi0:</software></software,></version> </a><a m="" i="" oemxsdt="">on motherboard
Dec  5 13:38:42 pfSense kernel: acpi0: Power Button (fixed)
Dec  5 13:38:42 pfSense kernel: acpi0: reservation of 0, a0000 (3) failed
Dec  5 13:38:42 pfSense kernel: acpi0: reservation of 100000, 7fef0000 (3) failed
Dec  5 13:38:42 pfSense kernel: cpu0: <acpi cpu="">on acpi0
Dec  5 13:38:42 pfSense kernel: cpu1: <acpi cpu="">on acpi0
Dec  5 13:38:42 pfSense kernel: attimer0: <at timer="">port 0x40-0x43 irq 0 on acpi0
Dec  5 13:38:42 pfSense kernel: Timecounter "i8254" frequency 1193182 Hz quality 0
Dec  5 13:38:42 pfSense kernel: Event timer "i8254" frequency 1193182 Hz quality 100
Dec  5 13:38:42 pfSense kernel: atrtc0: <at realtime="" clock="">port 0x70-0x71 irq 8 on acpi0
Dec  5 13:38:42 pfSense kernel: Event timer "RTC" frequency 32768 Hz quality 0
Dec  5 13:38:42 pfSense kernel: Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
Dec  5 13:38:42 pfSense kernel: acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
Dec  5 13:38:42 pfSense kernel: pcib0: <acpi host-pci="" bridge="">port 0xcf8-0xcff on acpi0
Dec  5 13:38:42 pfSense kernel: pci0: <acpi pci="" bus="">on pcib0
Dec  5 13:38:42 pfSense kernel: agp0: <intel 82865="" host="" to="" agp="" bridge="">on hostb0
Dec  5 13:38:42 pfSense kernel: pcib1: <acpi pci-pci="" bridge="">at device 1.0 on pci0
Dec  5 13:38:42 pfSense kernel: pci1: <acpi pci="" bus="">on pcib1
Dec  5 13:38:42 pfSense kernel: vgapci0: <vga-compatible display="">mem 0xfa000000-0xfaffffff,0xf6000000-0xf7ffffff at device 0.0 on pci1
Dec  5 13:38:42 pfSense kernel: vgapci0: Boot video device
Dec  5 13:38:42 pfSense kernel: uhci0: <intel 82801eb="" (ich5)="" usb="" controller="" usb-a="">port 0xeec0-0xeedf irq 16 at device 29.0 on pci0
Dec  5 13:38:42 pfSense kernel: usbus0 on uhci0
Dec  5 13:38:42 pfSense kernel: uhci1: <intel 82801eb="" (ich5)="" usb="" controller="" usb-b="">port 0xef00-0xef1f irq 19 at device 29.1 on pci0
Dec  5 13:38:42 pfSense kernel: usbus1 on uhci1
Dec  5 13:38:42 pfSense kernel: uhci2: <intel 82801eb="" (ich5)="" usb="" controller="" usb-c="">port 0xef20-0xef3f irq 18 at device 29.2 on pci0
Dec  5 13:38:42 pfSense kernel: usbus2 on uhci2
Dec  5 13:38:42 pfSense kernel: uhci3: <intel 82801eb="" (ich5)="" usb="" controller="" usb-d="">port 0xef40-0xef5f irq 16 at device 29.3 on pci0
Dec  5 13:38:42 pfSense kernel: usbus3 on uhci3
Dec  5 13:38:42 pfSense kernel: ehci0: <intel 82801eb="" r="" (ich5)="" usb="" 2.0="" controller="">mem 0xfbfff800-0xfbfffbff irq 23 at device 29.7 on pci0
Dec  5 13:38:42 pfSense kernel: usbus4: EHCI version 1.0
Dec  5 13:38:42 pfSense kernel: usbus4 on ehci0
Dec  5 13:38:42 pfSense kernel: pcib2: <acpi pci-pci="" bridge="">at device 30.0 on pci0
Dec  5 13:38:42 pfSense kernel: pci2: <acpi pci="" bus="">on pcib2
Dec  5 13:38:42 pfSense kernel: skc0: <marvell gigabit="" ethernet="">port 0xd800-0xd8ff mem 0xfbefc000-0xfbefffff irq 22 at device 5.0 on pci2
Dec  5 13:38:42 pfSense kernel: skc0: Marvell Yukon Lite Gigabit Ethernet rev. A3(0x7)
Dec  5 13:38:42 pfSense kernel: sk0: <marvell semiconductor,="" inc.="" yukon="">on skc0
Dec  5 13:38:42 pfSense kernel: sk0: Ethernet address: 00:11:d8:0a:75:40
Dec  5 13:38:42 pfSense kernel: miibus0: <mii bus="">on sk0
Dec  5 13:38:42 pfSense kernel: e1000phy0: <marvell 88e1011="" gigabit="" phy="">PHY 0 on miibus0
Dec  5 13:38:42 pfSense kernel: e1000phy0:  none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-master, 1000baseT-FDX, 1000baseT-FDX-master, auto
Dec  5 13:38:42 pfSense kernel: re0: <d-link dge-530(t)="" gigabit="" ethernet="" adapter="">port 0xd400-0xd4ff mem 0xfbefbc00-0xfbefbcff irq 22 at device 10.0 on pci2
Dec  5 13:38:42 pfSense kernel: re0: Chip rev. 0x10000000
Dec  5 13:38:42 pfSense kernel: re0: MAC rev. 0x00000000
Dec  5 13:38:42 pfSense kernel: miibus1: <mii bus="">on re0
Dec  5 13:38:42 pfSense kernel: rgephy0: <rtl8169s 8211="" 8110s="" 1000base-t="" media="" interface="">PHY 1 on miibus1
Dec  5 13:38:42 pfSense kernel: rgephy0:  none, 10baseT, 10baseT-FDX, 10baseT-FDX-flow, 100baseTX, 100baseTX-FDX, 100baseTX-FDX-flow, 1000baseT, 1000baseT-master, 1000baseT-FDX, 1000baseT-FDX-master, 1000baseT-FDX-flow, 1000baseT-FDX-flow-master, auto, auto-flow
Dec  5 13:38:42 pfSense kernel: re0: Ethernet address: 1c:7e:e5:1f:fa:d5
Dec  5 13:38:42 pfSense kernel: isab0: <pci-isa bridge="">at device 31.0 on pci0
Dec  5 13:38:42 pfSense kernel: isa0: <isa bus="">on isab0
Dec  5 13:38:42 pfSense kernel: atapci0: <intel ich5="" udma100="" controller="">port 0xeff0-0xeff7,0xefe4-0xefe7,0xefa8-0xefaf,0xefe0-0xefe3,0xef90-0xef9f irq 18 at device 31.1 on pci0
Dec  5 13:38:42 pfSense kernel: ata2: <ata channel="">at channel 0 on atapci0
Dec  5 13:38:42 pfSense kernel: ata3: <ata channel="">at channel 1 on atapci0
Dec  5 13:38:42 pfSense kernel: pcm0: <intel ich5="" (82801eb)="">port 0xe800-0xe8ff,0xee80-0xeebf mem 0xfbfff400-0xfbfff5ff,0xfbfff000-0xfbfff0ff irq 17 at device 31.5 on pci0
Dec  5 13:38:42 pfSense kernel: pcm0: <analog devices="" ad1985="" ac97="" codec="">Dec  5 13:38:42 pfSense kernel: acpi_button0: <power button="">on acpi0
Dec  5 13:38:42 pfSense kernel: uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
Dec  5 13:38:42 pfSense kernel: uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
Dec  5 13:38:42 pfSense kernel: fdc0: <floppy drive="" controller="" (fde)="">port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0
Dec  5 13:38:42 pfSense kernel: pmtimer0 on isa0
Dec  5 13:38:42 pfSense kernel: sc0: <system console="">at flags 0x100 on isa0
Dec  5 13:38:42 pfSense kernel: sc0: VGA <16 virtual consoles, flags=0x300>
Dec  5 13:38:42 pfSense kernel: vga0: <generic isa="" vga="">at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
Dec  5 13:38:42 pfSense kernel: ata0: <ata channel="">at port 0x1f0-0x1f7,0x3f6 irq 14 on isa0
Dec  5 13:38:42 pfSense kernel: ata1: <ata channel="">at port 0x170-0x177,0x376 irq 15 on isa0
Dec  5 13:38:42 pfSense kernel: atkbdc0: <keyboard controller="" (i8042)="">at port 0x60,0x64 on isa0
Dec  5 13:38:42 pfSense kernel: atkbd0: <at keyboard="">irq 1 on atkbdc0
Dec  5 13:38:42 pfSense kernel: kbd0 at atkbd0
Dec  5 13:38:42 pfSense kernel: atkbd0: [GIANT-LOCKED]
Dec  5 13:38:42 pfSense kernel: ppc0: parallel port not found.
Dec  5 13:38:42 pfSense kernel: p4tcc0: <cpu frequency="" thermal="" control="">on cpu0
Dec  5 13:38:42 pfSense kernel: p4tcc1: <cpu frequency="" thermal="" control="">on cpu1
Dec  5 13:38:42 pfSense kernel: Timecounters tick every 1.000 msec
Dec  5 13:38:42 pfSense kernel: IPsec: Initialized Security Association Processing.
Dec  5 13:38:42 pfSense kernel: random: unblocking device.
Dec  5 13:38:42 pfSense kernel: usbus0: 12Mbps Full Speed USB v1.0
Dec  5 13:38:42 pfSense kernel: usbus1: 12Mbps Full Speed USB v1.0
Dec  5 13:38:42 pfSense kernel: usbus2: 12Mbps Full Speed USB v1.0
Dec  5 13:38:42 pfSense kernel: usbus3: 12Mbps Full Speed USB v1.0
Dec  5 13:38:42 pfSense kernel: usbus4: 480Mbps High Speed USB v2.0
Dec  5 13:38:42 pfSense kernel: ugen0.1: <intel>at usbus0
Dec  5 13:38:42 pfSense kernel: uhub0: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus0
Dec  5 13:38:42 pfSense kernel: ugen4.1: <intel>at usbus4
Dec  5 13:38:42 pfSense kernel: uhub1: <intel 1="" 9="" ehci="" root="" hub,="" class="" 0,="" rev="" 2.00="" 1.00,="" addr="">on usbus4
Dec  5 13:38:42 pfSense kernel: ugen3.1: <intel>at usbus3
Dec  5 13:38:42 pfSense kernel: uhub2: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus3
Dec  5 13:38:42 pfSense kernel: ugen2.1: <intel>at usbus2
Dec  5 13:38:42 pfSense kernel: uhub3: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus2
Dec  5 13:38:42 pfSense kernel: ugen1.1: <intel>at usbus1
Dec  5 13:38:42 pfSense kernel: uhub4: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus1
Dec  5 13:38:42 pfSense kernel: uhub0: 2 ports with 2 removable, self powered
Dec  5 13:38:42 pfSense kernel: uhub2: 2 ports with 2 removable, self powered
Dec  5 13:38:42 pfSense kernel: uhub3: 2 ports with 2 removable, self powered
Dec  5 13:38:42 pfSense kernel: uhub4: 2 ports with 2 removable, self powered
Dec  5 13:38:42 pfSense kernel: uhub1: 8 ports with 8 removable, self powered
Dec  5 13:38:42 pfSense kernel: ugen2.2: <ortek>at usbus2
Dec  5 13:38:42 pfSense kernel: ukbd0: <ep1 interrupt="">on usbus2
Dec  5 13:38:42 pfSense kernel: kbd2 at ukbd0
Dec  5 13:38:42 pfSense kernel: ada0 at ata2 bus 0 scbus0 target 0 lun 0
Dec  5 13:38:42 pfSense kernel: ada0: <st340016a 3.10="">ATA-5 device
Dec  5 13:38:42 pfSense kernel: ada0: Serial Number 3HS49BWJ
Dec  5 13:38:42 pfSense kernel: ada0: 100.000MB/s transfers (UDMA5, PIO 8192bytes)
Dec  5 13:38:42 pfSense kernel: ada0: 38166MB (78165360 512 byte sectors: 16H 63S/T 16383C)
Dec  5 13:38:42 pfSense kernel: ada0: Previously was known as ad4
Dec  5 13:38:42 pfSense kernel: cd0 at ata3 bus 0 scbus1 target 0 lun 0
Dec  5 13:38:42 pfSense kernel: cd0: <hl-dt-st dvd-ram="" gh22np20="" 2.00="">Removable CD-ROM SCSI-0 device 
Dec  5 13:38:42 pfSense kernel: cd0: 66.700MB/s transfers (UDMA4, ATAPI 12bytes, PIO 65534bytes)
Dec  5 13:38:42 pfSense kernel: cd0: Attempt to query device size failed: NOT READY, Medium not present - tray closed
Dec  5 13:38:42 pfSense kernel: SMP: AP CPU #1 Launched!
Dec  5 13:38:42 pfSense kernel: Timecounter "TSC-low" frequency 1503437224 Hz quality 1000
Dec  5 13:38:42 pfSense kernel: Trying to mount root from ufs:/dev/ufsid/566228d1397a31e0 [rw]...
Dec  5 13:38:42 pfSense check_reload_status: Linkup starting sk0
Dec  5 13:38:44 pfSense check_reload_status: Linkup starting sk0
Dec  5 13:38:44 pfSense kernel: 
Dec  5 13:38:44 pfSense kernel: sk0: link state changed to UP
Dec  5 13:38:44 pfSense check_reload_status: rc.newwanip starting sk0
Dec  5 13:38:44 pfSense php: rc.bootup: Accept router advertisements on interface sk0 
Dec  5 13:38:44 pfSense check_reload_status: Linkup starting re0
Dec  5 13:38:44 pfSense kernel: re0: link state changed to DOWN
Dec  5 13:38:46 pfSense check_reload_status: Linkup starting re0
Dec  5 13:38:46 pfSense kernel: 
Dec  5 13:38:46 pfSense kernel: re0: link state changed to UP
Dec  5 13:38:46 pfSense php-fpm[245]: /rc.newwanip: rc.newwanip: Info: starting on sk0.
Dec  5 13:38:47 pfSense php: rc.bootup: Resyncing OpenVPN instances.
Dec  5 13:38:47 pfSense kernel: done.
Dec  5 13:38:47 pfSense kernel: pflog0: promiscuous mode enabled
Dec  5 13:38:47 pfSense kernel: ...
Dec  5 13:38:53 pfSense kernel: .done.
Dec  5 13:38:55 pfSense kernel: done.
Dec  5 13:38:56 pfSense kernel: done.
Dec  5 13:38:57 pfSense lighttpd[28659]: (log.c.194) server started 
Dec  5 13:38:57 pfSense kernel: done.
Dec  5 13:38:57 pfSense php: rc.bootup: ROUTING: setting default route to 172.25.0.254
Dec  5 13:38:57 pfSense kernel: done.
Dec  5 13:39:00 pfSense php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449340740] unbound[30863:0] error: bind: address already in use [1449340740] unbound[30863:0] fatal error: could not open ports' 
Dec  5 13:39:00 pfSense kernel: done.
Dec  5 13:39:00 pfSense kernel: done.
Dec  5 13:39:00 pfSense check_reload_status: Updating all dyndns
Dec  5 13:39:06 pfSense kernel: .done.
Dec  5 13:39:11 pfSense php: rc.bootup: Creating rrd update script
Dec  5 13:39:11 pfSense php: rc.bootup: miniupnpd: Starting service on interface: lan
Dec  5 13:39:11 pfSense kernel: done.
Dec  5 13:39:11 pfSense kernel: done.
Dec  5 13:39:11 pfSense syslogd: exiting on signal 15
Dec  5 13:39:11 pfSense syslogd: kernel boot file is /boot/kernel/kernel
Dec  5 13:39:11 pfSense php-fpm[31202]: /rc.start_packages: Restarting/Starting all packages.
Dec  5 13:39:11 pfSense kernel: done.
Dec  5 13:39:12 pfSense check_reload_status: Syncing firewall
Dec  5 13:39:12 pfSense SnortStartup[70337]: Snort START for WAN(33233_sk0)...
Dec  5 13:39:15 pfSense check_reload_status: Syncing firewall
Dec  5 13:39:15 pfSense check_reload_status: Syncing firewall
Dec  5 13:39:15 pfSense SuricataStartup[79006]: Suricata START for WAN(63282_sk0)...
Dec  5 13:39:15 pfSense php-fpm[31202]: [pfBlockerNG] Starting sync process.
Dec  5 13:39:19 pfSense check_reload_status: Reloading filter
Dec  5 13:39:40 pfSense login: login on ttyv0 as root
Dec  5 13:39:40 pfSense sshlockout[53762]: sshlockout/webConfigurator v3.0 starting up
Dec  5 13:39:53 pfSense kernel: sk0: promiscuous mode enabled
Dec  5 13:43:45 pfSense php-fpm[10393]: /index.php: Successful login for user 'admin' from: 172.24.48.84
Dec  5 13:43:45 pfSense php-fpm[10393]: /index.php: Successful login for user 'admin' from: 172.24.48.84
Dec  5 13:44:32 pfSense php-fpm[8855]: /status_services.php: NTPD is starting up.
Dec  5 13:50:26 pfSense check_reload_status: Syncing firewall
Dec  5 13:50:26 pfSense check_reload_status: Reloading filter
Dec  5 14:00:54 pfSense php-fpm[26326]: /index.php: Successful login for user 'admin' from: 172.24.48.84
Dec  5 14:00:54 pfSense php-fpm[26326]: /index.php: Successful login for user 'admin' from: 172.24.48.84</hl-dt-st></st340016a></ep1></ortek></intel></intel></intel></intel></intel></intel></intel></intel></intel></intel></cpu></cpu></at></keyboard></ata></ata></generic></system></floppy></power></analog></intel></ata></ata></intel></isa></pci-isa></rtl8169s></mii></d-link></marvell></mii></marvell></marvell></acpi></acpi></intel></intel></intel></intel></intel></vga-compatible></acpi></acpi></intel></acpi></acpi></at></at></acpi></acpi></a></sse3,dtes64,mon,ds_cpl,cnxt-id,xtpr></fpu,vme,de,pse,tsc,msr,pae,mce,cx8,apic,sep,mtrr,pge,mca,cmov,pat,pse36,clflush,dts,acpi,mmx,fxsr,sse,sse2,ss,htt,tm,pbe> 
``` <a m="" i="" oemxsdt="">Resolver

          Dec  5 12:38:36 pfSense unbound: [26765:0] info: service stopped (unbound 1.5.4).
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 0: 34 queries, 15 answers from cache, 19 recursions, 1 prefetch
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 0: requestlist max 11 avg 0.9 exceeded 0 jostled 0
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: average recursion processing time 0.211307 sec
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: histogram of recursion processing times
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: [25%]=0.0503223 median[50%]=0.144179 [75%]=0.283989
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: lower(secs) upper(secs) recursions
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.016384    0.032768 1
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.032768    0.065536 7
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.065536    0.131072 1
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.131072    0.262144 5
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.262144    0.524288 3
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.524288    1.000000 2
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 1: 5 queries, 3 answers from cache, 2 recursions, 1 prefetch
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: average recursion processing time 0.156386 sec
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: histogram of recursion processing times
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: [25%]=0 median[50%]=0 [75%]=0
          Dec  5 12:38:36 pfSense unbound: [26765:0] info: lower(secs) upper(secs) recursions
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.065536    0.131072 1
          Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.131072    0.262144 1
          Dec  5 12:39:06 pfSense unbound: [52118:0] notice: init module 0: validator
          Dec  5 12:39:06 pfSense unbound: [52118:0] notice: init module 1: iterator
          Dec  5 12:39:06 pfSense unbound: [52118:0] info: start of service (unbound 1.5.4).
          Dec  5 13:44:49 pfSense unbound: [25393:0] notice: init module 0: validator
          Dec  5 13:44:49 pfSense unbound: [25393:0] notice: init module 1: iterator
          Dec  5 13:44:49 pfSense unbound: [25393:0] info: start of service (unbound 1.5.4).

          
This did not happen with the old system, but I can no longer do any test on that system, today it has disk error when I boot it  :-\

On a few reboot, unbound was running at bootup but it silently died, a restart keep it running.</a>

          2.4.5-RELEASE-p1 (amd64)
          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            Hi RonpfS,

            When you restored the backup config, was DNSBL installed? If not, then in the Resolver Adv. settings, there would have been this line:

            server:include: /var/unbound/pfb_dnsbl.conf

            but that file would not exist yet. So Unbound would fail to start.

            Since installing DNSBL, did you enable any of the 'DHCP Registration' options in the Resolver? There are some issues with those options.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • RonpfSR
              RonpfS
              last edited by

              Yeah I figured out it would have been better to disable pfBlockerNG before saving the old config.

              No I don't have the DHCP registration ticked nor Static DHCP.

              I am having trouble with the Suppression List.

              Do I need to create a rule with pfBlockerNGSuppress to permit traffic or is this done by pfBlockerNG. If this is the case, I don't see any rules generated that let the traffic pass.

              Adding an IP to the suppression list doesn't seems to let it pass.

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @RonpfS:

                Do I need to create a rule with pfBlockerNGSuppress to permit traffic or is this done by pfBlockerNG. If this is the case, I don't see any rules generated that let the traffic pass.

                Adding an IP to the suppression list doesn't seems to let it pass.

                The suppresion alias does not need to be referenced to a rule. Please read the description for "Suppression" in the General tab…

                "Do not use the pfBlockerNGSuppress Alias in a Firewall Rule. This alias is used during the cron download process only."

                There are more details on how to suppress, in the Alerts Tab, when you hover-over the Lists Column.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • RonpfSR
                  RonpfS
                  last edited by

                  I read it  ;)

                  However the suppression only seems to happen when you do a force reload, not when you click on the suppress icon

                  IBlock_Badpeer       47283      47283      195706 
 Suppression IBlock_Ads: 50.31.164.0/24
 Suppression IBlock_Ads: 50.31.164.0/24
 Suppression IBlock_Ads: 50.31.164.0/24
 Suppression IBlock_Ads: 50.31.164.0/24
 Suppression IBlock_Ads: 50.31.164.0/24
IBlock_Ads           3217       3211       195955 

                  This take a few minutes to get online suppression results  :-\

                  2.4.5-RELEASE-p1 (amd64)
                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @RonpfS:

                    However the suppression only seems to happen when you do a force reload, not when you click on the suppress icon

                    Check your pfBlockerNGSuppress alias and remove all of the single /32 addresses in 50.31.164.x and just use a single /24

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • SoloamS
                      Soloam
                      last edited by

                      Hello all, I have my rules now allowing and not blocking, as we should do, I just have one question. Should I add a default reject all to the end of my LAN interfaces? Since I only allow, the traffic that does not match my allow rules will be blocked by default by pfsense, making my browser (for example) wait for a timeout (for example blocked IP's). If I add a reject all to the end of my rules, the request on the browser will be a lot faster, returning a rejected error.

                      Thank you all

                      1 Reply Last reply Reply Quote 0
                      • J
                        Jamerson
                        last edited by

                        Thank you so much for the great tools, it works great so far two weeks now no complains.
                        i have a request, can we use the DNSBL to block Microsoft Telemtry ?

                        1 Reply Last reply Reply Quote 0
                        • H
                          Hugovsky
                          last edited by

                          http://someonewhocares.org/hosts/

                          search near the bottom. There might be more lists out there.

                          1 Reply Last reply Reply Quote 0
                          • F
                            f34rinc
                            last edited by

                            @Jamerson:

                            Thank you so much for the great tools, it works great so far two weeks now no complains.
                            i have a request, can we use the DNSBL to block Microsoft Telemtry ?

                            https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist
                            Taken from project - https://github.com/WindowsLies/BlockWindows

                            1 Reply Last reply Reply Quote 0
                            • J
                              Jamerson
                              last edited by

                              @f34rinc:

                              @Jamerson:

                              Thank you so much for the great tools, it works great so far two weeks now no complains.
                              i have a request, can we use the DNSBL to block Microsoft Telemtry ?

                              https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist
                              Taken from project - https://github.com/WindowsLies/BlockWindows

                              those are domains, I have plenty of them :)
                              can those be blocked using DNSBL ?

                              1 Reply Last reply Reply Quote 0
                              • F
                                f34rinc
                                last edited by

                                @Jamerson:

                                can those be blocked using DNSBL ?

                                Yes it can

                                1 Reply Last reply Reply Quote 0
                                • RonpfSR
                                  RonpfS
                                  last edited by

                                  Is-it normal that during boot, Resolver start twice?

                                  
Configuring WAN interface...done.
Configuring LAN interface...Starting DNS Resolver...done.
Starting DHCPv6 service...done.
done.
Configuring CARP settings...done.
Configuring OpenVPN settings...done.
Configuring firewall......done.
Starting PFLOG...done.
Setting up gateway monitors...done.
Synchronizing user settings...done.  
Starting webConfigurator...done.
Configuring CRON...done
Starting DNS resolver...done.
Starting NTP time client....done.
Starting DCHP service....done.
Starting DHCPv6 service...done.
Configuring firewall......done.

                                  and when I access the Webconfigurator, resolver and ntp are both stopped.

                                  I added Unbound under Service Watchdog and unbound start within 5 min of bootup.

                                  Strange output from starting pfBlockerNG :

                                  
Starting package pfBlockerNG...            ?done.

                                  2.4.5-RELEASE-p1 (amd64)
                                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    Jamerson
                                    last edited by

                                    @f34rinc:

                                    @Jamerson:

                                    can those be blocked using DNSBL ?

                                    Yes it can

                                    just post them on the block domain DNS feed ?

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      Bummer
                                      last edited by

                                      Hey all!

                                      This is just what the doctor ordered! Thans BBcan177, great job!

                                      I have a dumb question. I was looking over the default settings and had a question about the below. If you're going to protect against spam, wouldn't you select "Inbound" as the default instead of "Outbound"? I want to prevent stuff from coming in to the network. I know I'm missing something here, just don't know what it is.

                                      DNSBL IP Firewall Rule Settings:
                                      Select Deny outbound or as per your requirements
                                      select Enable logging

                                      Thanks!

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        Hugovsky
                                        last edited by

                                        All connections are initiated from inside to outside direction, so, you should block what starts the connection. Unless you have open ports from the internet to your network.

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          Bummer
                                          last edited by

                                          Thanks for the replyl Hugovsky. But I'm still confused.

                                          My mail server is inside my network and is clean. It would seem to me you'd want to block what is coming in from the outside to the ports opened on the mail server, etc.

                                          Sorry, I can be dense at times.

                                          1 Reply Last reply Reply Quote 0
                                          • H
                                            Hugovsky
                                            last edited by

                                            Best way to do that is to make an alias and use it with the nat rule that forwards to your server. Remember: the firewall is already blocking everything you don't allow.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post