Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved pfBlockerNG
    1.1k Posts 192 Posters 1.6m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jamerson
      last edited by

      Thank you so much for the great tools, it works great so far two weeks now no complains.
      i have a request, can we use the DNSBL to block Microsoft Telemtry ?

      1 Reply Last reply Reply Quote 0
      • H
        Hugovsky
        last edited by

        http://someonewhocares.org/hosts/

        search near the bottom. There might be more lists out there.

        1 Reply Last reply Reply Quote 0
        • F
          f34rinc
          last edited by

          @Jamerson:

          Thank you so much for the great tools, it works great so far two weeks now no complains.
          i have a request, can we use the DNSBL to block Microsoft Telemtry ?

          https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist
          Taken from project - https://github.com/WindowsLies/BlockWindows

          1 Reply Last reply Reply Quote 0
          • J
            Jamerson
            last edited by

            @f34rinc:

            @Jamerson:

            Thank you so much for the great tools, it works great so far two weeks now no complains.
            i have a request, can we use the DNSBL to block Microsoft Telemtry ?

            https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist
            Taken from project - https://github.com/WindowsLies/BlockWindows

            those are domains, I have plenty of them :)
            can those be blocked using DNSBL ?

            1 Reply Last reply Reply Quote 0
            • F
              f34rinc
              last edited by

              @Jamerson:

              can those be blocked using DNSBL ?

              Yes it can

              1 Reply Last reply Reply Quote 0
              • RonpfSR
                RonpfS
                last edited by

                Is-it normal that during boot, Resolver start twice?

                
Configuring WAN interface...done.
Configuring LAN interface...Starting DNS Resolver...done.
Starting DHCPv6 service...done.
done.
Configuring CARP settings...done.
Configuring OpenVPN settings...done.
Configuring firewall......done.
Starting PFLOG...done.
Setting up gateway monitors...done.
Synchronizing user settings...done.  
Starting webConfigurator...done.
Configuring CRON...done
Starting DNS resolver...done.
Starting NTP time client....done.
Starting DCHP service....done.
Starting DHCPv6 service...done.
Configuring firewall......done.

                and when I access the Webconfigurator, resolver and ntp are both stopped.

                I added Unbound under Service Watchdog and unbound start within 5 min of bootup.

                Strange output from starting pfBlockerNG :

                
Starting package pfBlockerNG...            ?done.

                2.4.5-RELEASE-p1 (amd64)
                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                1 Reply Last reply Reply Quote 0
                • J
                  Jamerson
                  last edited by

                  @f34rinc:

                  @Jamerson:

                  can those be blocked using DNSBL ?

                  Yes it can

                  just post them on the block domain DNS feed ?

                  1 Reply Last reply Reply Quote 0
                  • B
                    Bummer
                    last edited by

                    Hey all!

                    This is just what the doctor ordered! Thans BBcan177, great job!

                    I have a dumb question. I was looking over the default settings and had a question about the below. If you're going to protect against spam, wouldn't you select "Inbound" as the default instead of "Outbound"? I want to prevent stuff from coming in to the network. I know I'm missing something here, just don't know what it is.

                    DNSBL IP Firewall Rule Settings:
                    Select Deny outbound or as per your requirements
                    select Enable logging

                    Thanks!

                    1 Reply Last reply Reply Quote 0
                    • H
                      Hugovsky
                      last edited by

                      All connections are initiated from inside to outside direction, so, you should block what starts the connection. Unless you have open ports from the internet to your network.

                      1 Reply Last reply Reply Quote 0
                      • B
                        Bummer
                        last edited by

                        Thanks for the replyl Hugovsky. But I'm still confused.

                        My mail server is inside my network and is clean. It would seem to me you'd want to block what is coming in from the outside to the ports opened on the mail server, etc.

                        Sorry, I can be dense at times.

                        1 Reply Last reply Reply Quote 0
                        • H
                          Hugovsky
                          last edited by

                          Best way to do that is to make an alias and use it with the nat rule that forwards to your server. Remember: the firewall is already blocking everything you don't allow.

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            @Jamerson:

                            @f34rinc:

                            @Jamerson:

                            can those be blocked using DNSBL ?

                            Yes it can

                            just post them on the block domain DNS feed ?

                            You can add domains to the custom list at the bottom of any Alias, or create a new alias.

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              @RonpfS:

                              I added Unbound under Service Watchdog and unbound start within 5 min of bootup.

                              Don't use Service Watchdog with DNSBL as that will interfere with how DNSBL updates.

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • RonpfSR
                                RonpfS
                                last edited by

                                I tried to find out why unbound dies silently on bootup

                                I did a fresh install, disabling all package before saving the config, bring the config back, normal pkg installation went smoothly.

                                I enabled all packages except pfBlockerNG and DNSBL , rebooted 2-3 times and unbound is present on reboot.

                                I enabled pfBlockerNG, DNSBL, on first reboot unbound was alive
                                After 2-3 reboot it kept dying on reboot.
                                Watching the services status, I could see it running until DNSBL start, then it dies.
                                I went thru the /var/log files, no error is logged !

                                Once it is started it keeps running fine.

                                So I only put unbound in Service Watchdog, not DNSBL, is this ok?
                                Now unbound restart 1 or 2 minutes after it dies.

                                2.4.5-RELEASE-p1 (amd64)
                                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  No don't use Service Watchguard for either.

                                  Do you have any of the Unbound DHCP registration checkboxes enabled? If so, disable those.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • RonpfSR
                                    RonpfS
                                    last edited by

                                    @BBcan177:

                                    No don't use Service Watchguard for either.

                                    So how do I find out what's making it dies on reboot ?

                                    2.4.5-RELEASE-p1 (amd64)
                                    Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                    Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                    1 Reply Last reply Reply Quote 0
                                    • RonpfSR
                                      RonpfS
                                      last edited by

                                      @BBcan177:

                                      Do you have any of the Unbound DHCP registration checkboxes enabled? If so, disable those.

                                      Nope only Enable DNSSEC Support is ticked.
                                      Network interface is set to ALL
                                      Outgoing interface is set to WAN

                                      I do have Host Overrides for a local domain (not the local domain of pfense), including the WAN IP of the firewal (it is behind my present pfsense box)

                                      2.4.5-RELEASE-p1 (amd64)
                                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        Increase the Unbound log verbosity and see if it shows any further details.

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • RonpfSR
                                          RonpfS
                                          last edited by

                                          @BBcan177:

                                          Increase the Unbound log verbosity and see if it shows any further details.

                                          Increased to level 2 first reboot unbound is running
                                          2nd reboot, unbound is not running nothing in the resolver.log for this reboot, only things from last session.
                                          Nothing in system.log nor dmesg.boot

                                          Remove all hosts overrides, set level to 5

                                          resolver logs

                                          
Dec 9 01:04:46 	unbound: [15366:0] debug: ignoring duplicate RR: mobile.Banzai.it 60 IN A 10.10.10.1
Dec 9 01:04:31 	unbound: [15366:0] info: implicit transparent local-zone . TYPE0 IN
Dec 9 01:04:22 	unbound: [15366:0] debug: drop user privileges, run as unbound
Dec 9 01:04:22 	unbound: [15366:0] debug: chroot to /var/unbound
Dec 9 01:04:22 	unbound: [15366:0] debug: chdir to /var/unbound
Dec 9 01:04:22 	unbound: [14799:0] debug: setup SSL certificates
Dec 9 01:01:52 	unbound: [60328:0] info: send_udp over interface: 127.0.0.1

                                          System logs

                                          Dec 9 01:04:47 	php: rc.bootup: miniupnpd: Starting service on interface: lan
Dec 9 01:04:47 	kernel: done.
Dec 9 01:04:47 	php: rc.bootup: Creating rrd update script
Dec 9 01:04:42 	kernel: .done.
Dec 9 01:04:36 	check_reload_status: Updating all dyndns
Dec 9 01:04:36 	kernel: done.
Dec 9 01:04:36 	kernel: done.
Dec 9 01:04:36 	php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'
Dec 9 01:04:33 	kernel: done.
Dec 9 01:04:33 	php: rc.bootup: ROUTING: setting default route to 172.25.0.254
Dec 9 01:04:33 	lighttpd[28666]: (log.c.194) server started
Dec 9 01:04:32 	kernel: done.
Dec 9 01:04:31 	kernel: done.
Dec 9 01:04:29 	kernel: .done.
Dec 9 01:04:23 	kernel: ...
Dec 9 01:04:22 	kernel: pflog0: promiscuous mode enabled
Dec 9 01:04:22 	kernel: done.
Dec 9 01:04:22 	php: rc.bootup: Resyncing OpenVPN instances.
Dec 9 01:04:22 	php-fpm[245]: /rc.newwanip: rc.newwanip: Info: starting on sk0.
Dec 9 01:04:22 	check_reload_status: Linkup starting re0
Dec 9 01:04:22 	kernel: re0: link state changed to UP
Dec 9 01:04:22 	kernel:
Dec 9 01:04:20 	kernel: re0: link state changed to DOWN
Dec 9 01:04:20 	check_reload_status: Linkup starting re0
Dec 9 01:04:20 	php: rc.bootup: Accept router advertisements on interface sk0
Dec 9 01:04:20 	check_reload_status: rc.newwanip starting sk0
Dec 9 01:04:19 	kernel: sk0: link state changed to UP
Dec 9 01:04:19 	kernel:
Dec 9 01:04:19 	check_reload_status: Linkup starting sk0
Dec 9 01:04:17 	check_reload_status: Linkup starting sk0

                                          2.4.5-RELEASE-p1 (amd64)
                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            Here is the error:

                                            Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

                                            Looks like it tried to start Unbound but it was already started as the port was opened already… Don't really have any other help to offer at this moment... Keep an eye on the logs and see if something else comes up...

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.