PfBlockerNG v2.0 w/DNSBL
-
Best way to do that is to make an alias and use it with the nat rule that forwards to your server. Remember: the firewall is already blocking everything you don't allow.
-
-
I added Unbound under Service Watchdog and unbound start within 5 min of bootup.
Don't use Service Watchdog with DNSBL as that will interfere with how DNSBL updates.
-
I tried to find out why unbound dies silently on bootup
I did a fresh install, disabling all package before saving the config, bring the config back, normal pkg installation went smoothly.
I enabled all packages except pfBlockerNG and DNSBL , rebooted 2-3 times and unbound is present on reboot.
I enabled pfBlockerNG, DNSBL, on first reboot unbound was alive
After 2-3 reboot it kept dying on reboot.
Watching the services status, I could see it running until DNSBL start, then it dies.
I went thru the /var/log files, no error is logged !Once it is started it keeps running fine.
So I only put unbound in Service Watchdog, not DNSBL, is this ok?
Now unbound restart 1 or 2 minutes after it dies. -
No don't use Service Watchguard for either.
Do you have any of the Unbound DHCP registration checkboxes enabled? If so, disable those.
-
No don't use Service Watchguard for either.
So how do I find out what's making it dies on reboot ?
-
Do you have any of the Unbound DHCP registration checkboxes enabled? If so, disable those.
Nope only Enable DNSSEC Support is ticked.
Network interface is set to ALL
Outgoing interface is set to WANI do have Host Overrides for a local domain (not the local domain of pfense), including the WAN IP of the firewal (it is behind my present pfsense box)
-
Increase the Unbound log verbosity and see if it shows any further details.
-
Increase the Unbound log verbosity and see if it shows any further details.
Increased to level 2 first reboot unbound is running
2nd reboot, unbound is not running nothing in the resolver.log for this reboot, only things from last session.
Nothing in system.log nor dmesg.bootRemove all hosts overrides, set level to 5
resolver logs
Dec 9 01:04:46 unbound: [15366:0] debug: ignoring duplicate RR: mobile.Banzai.it 60 IN A 10.10.10.1 Dec 9 01:04:31 unbound: [15366:0] info: implicit transparent local-zone . TYPE0 IN Dec 9 01:04:22 unbound: [15366:0] debug: drop user privileges, run as unbound Dec 9 01:04:22 unbound: [15366:0] debug: chroot to /var/unbound Dec 9 01:04:22 unbound: [15366:0] debug: chdir to /var/unbound Dec 9 01:04:22 unbound: [14799:0] debug: setup SSL certificates Dec 9 01:01:52 unbound: [60328:0] info: send_udp over interface: 127.0.0.1System logs
Dec 9 01:04:47 php: rc.bootup: miniupnpd: Starting service on interface: lan Dec 9 01:04:47 kernel: done. Dec 9 01:04:47 php: rc.bootup: Creating rrd update script Dec 9 01:04:42 kernel: .done. Dec 9 01:04:36 check_reload_status: Updating all dyndns Dec 9 01:04:36 kernel: done. Dec 9 01:04:36 kernel: done. Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports' Dec 9 01:04:33 kernel: done. Dec 9 01:04:33 php: rc.bootup: ROUTING: setting default route to 172.25.0.254 Dec 9 01:04:33 lighttpd[28666]: (log.c.194) server started Dec 9 01:04:32 kernel: done. Dec 9 01:04:31 kernel: done. Dec 9 01:04:29 kernel: .done. Dec 9 01:04:23 kernel: ... Dec 9 01:04:22 kernel: pflog0: promiscuous mode enabled Dec 9 01:04:22 kernel: done. Dec 9 01:04:22 php: rc.bootup: Resyncing OpenVPN instances. Dec 9 01:04:22 php-fpm[245]: /rc.newwanip: rc.newwanip: Info: starting on sk0. Dec 9 01:04:22 check_reload_status: Linkup starting re0 Dec 9 01:04:22 kernel: re0: link state changed to UP Dec 9 01:04:22 kernel: Dec 9 01:04:20 kernel: re0: link state changed to DOWN Dec 9 01:04:20 check_reload_status: Linkup starting re0 Dec 9 01:04:20 php: rc.bootup: Accept router advertisements on interface sk0 Dec 9 01:04:20 check_reload_status: rc.newwanip starting sk0 Dec 9 01:04:19 kernel: sk0: link state changed to UP Dec 9 01:04:19 kernel: Dec 9 01:04:19 check_reload_status: Linkup starting sk0 Dec 9 01:04:17 check_reload_status: Linkup starting sk0 -
Here is the error:
Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'
Looks like it tried to start Unbound but it was already started as the port was opened already… Don't really have any other help to offer at this moment... Keep an eye on the logs and see if something else comes up...
-
It always start the Resolver twice even on a fresh install with no package installed.
I tried to open the /var/unbound/pfb_dnsbl.conf 58.9MB in the pfblocker logs tab and it only say Loading file…. nothing appears.
Trying to open it with File Manager gives me :
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 123487193 bytes) in /usr/local/www/packages/filemgr/file_manager.php on line 411I can download it and nothing seems abnormal.
I got this crash report :
Crash report begins. Anonymous machine information: i386 10.1-RELEASE-p24 FreeBSD 10.1-RELEASE-p24 #0 f27a67c(releng/10.1)-dirty: Wed Nov 4 16:13:40 CST 2015 root@pfs22-i386-builder:/usr/obj.RELENG_2_2.i386/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10 Crash report details: PHP Errors: [09-Dec-2015 01:27:54 America/New_York] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200 [09-Dec-2015 01:39:21 America/New_York] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200 [09-Dec-2015 01:40:20 America/New_York] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200 [09-Dec-2015 01:40:38 America/New_York] PHP Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 123487193 bytes) in /usr/local/www/packages/filemgr/file_manager.php on line 411 Filename: /var/crash/minfree 2048It is a 2GB P4 Prescott …
In the pfBlocker/Log browser there is no dnsbl.log or error.log
In /var/log/pfblockerng/ there is a file dnsbl_error.log , doesn't tell much.Is-it possible to revert to version 2.0.1 ? Didn't had that issue on a much slower laptop with 2.0.1.
-
I have found some false positives in the iblocklist lists, for example if you preform a dns lookup to "fractal-design.com" (case builder) it would return 62.116.130.8 that if you search https://www.iblocklist.com/search?string=62.116.130.8 if gives a lot of lists (Malicious, Tracking, etc) can it be outdated?
-
I have found some false positives in the iblocklist lists, for example if you preform a dns lookup to "fractal-design.com" (case builder) it would return 62.116.130.8 that if you search https://www.iblocklist.com/search?string=62.116.130.8 if gives a lot of lists (Malicious, Tracking, etc) can it be outdated?
FPs need to be reported to whomever maintains the blocklist. Or just stop using iBlock lists altogether.
I found idiocy like eicar.org on multiple "malware" blocklists. Sigh. Also, people will happily add entire CDN servers (Amazon, etc.) there. Some people just should get out of the blocklist business, stupidity everywhere.
-
I've been getting a lot of false positives in iblock lists, they seemed like a good blacklist provider. What lists are people using in IP and Hosts?
Thank You all
-
Here is the error:
Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'
Maybe it has something to do with IPv6? as the error has a udp6 socket shown.
-
Here is the error:
Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'
Maybe it has something to do with IPv6? as the error has a udp6 socket shown.
I changed the LAN IPv6 Configuration Type from Track Interface to none
that solved the unbound crashing ;DAs the WAN DHCP didn't provide DHCP6 IP, the LAN IPv6 ip was:
IPv6 Link Local fe80::1:1
this is probably better not to assign LAN IPV6 ip.
now I get :
IPv6 Link Local fe80::1e7e:e5ff:fe1f:fad5Thanks for opening my noob eyes ;)
-
pfBlockerNG (Bootstrap conversion) has been submitted to the devs.
https://github.com/pfsense/FreeBSD-ports/pull/24
If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….
2.3 Testing feedback here:
https://forum.pfsense.org/index.php?board=65.0 -
on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ? -
on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.
-
I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?
