Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    pfBlockerNG
    192
    1.1k
    1.6m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • RonpfSR
      RonpfS
      last edited by

      @BBcan177:

      No don't use Service Watchguard for either.

      So how do I find out what's making it dies on reboot ?

      2.4.5-RELEASE-p1 (amd64)
      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by

        @BBcan177:

        Do you have any of the Unbound DHCP registration checkboxes enabled? If so, disable those.

        Nope only Enable DNSSEC Support is ticked.
        Network interface is set to ALL
        Outgoing interface is set to WAN

        I do have Host Overrides for a local domain (not the local domain of pfense), including the WAN IP of the firewal (it is behind my present pfsense box)

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          Increase the Unbound log verbosity and see if it shows any further details.

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • RonpfSR
            RonpfS
            last edited by

            @BBcan177:

            Increase the Unbound log verbosity and see if it shows any further details.

            Increased to level 2 first reboot unbound is running
            2nd reboot, unbound is not running nothing in the resolver.log for this reboot, only things from last session.
            Nothing in system.log nor dmesg.boot

            Remove all hosts overrides, set level to 5

            resolver logs

            
Dec 9 01:04:46 	unbound: [15366:0] debug: ignoring duplicate RR: mobile.Banzai.it 60 IN A 10.10.10.1
Dec 9 01:04:31 	unbound: [15366:0] info: implicit transparent local-zone . TYPE0 IN
Dec 9 01:04:22 	unbound: [15366:0] debug: drop user privileges, run as unbound
Dec 9 01:04:22 	unbound: [15366:0] debug: chroot to /var/unbound
Dec 9 01:04:22 	unbound: [15366:0] debug: chdir to /var/unbound
Dec 9 01:04:22 	unbound: [14799:0] debug: setup SSL certificates
Dec 9 01:01:52 	unbound: [60328:0] info: send_udp over interface: 127.0.0.1

            System logs

            Dec 9 01:04:47 	php: rc.bootup: miniupnpd: Starting service on interface: lan
Dec 9 01:04:47 	kernel: done.
Dec 9 01:04:47 	php: rc.bootup: Creating rrd update script
Dec 9 01:04:42 	kernel: .done.
Dec 9 01:04:36 	check_reload_status: Updating all dyndns
Dec 9 01:04:36 	kernel: done.
Dec 9 01:04:36 	kernel: done.
Dec 9 01:04:36 	php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'
Dec 9 01:04:33 	kernel: done.
Dec 9 01:04:33 	php: rc.bootup: ROUTING: setting default route to 172.25.0.254
Dec 9 01:04:33 	lighttpd[28666]: (log.c.194) server started
Dec 9 01:04:32 	kernel: done.
Dec 9 01:04:31 	kernel: done.
Dec 9 01:04:29 	kernel: .done.
Dec 9 01:04:23 	kernel: ...
Dec 9 01:04:22 	kernel: pflog0: promiscuous mode enabled
Dec 9 01:04:22 	kernel: done.
Dec 9 01:04:22 	php: rc.bootup: Resyncing OpenVPN instances.
Dec 9 01:04:22 	php-fpm[245]: /rc.newwanip: rc.newwanip: Info: starting on sk0.
Dec 9 01:04:22 	check_reload_status: Linkup starting re0
Dec 9 01:04:22 	kernel: re0: link state changed to UP
Dec 9 01:04:22 	kernel:
Dec 9 01:04:20 	kernel: re0: link state changed to DOWN
Dec 9 01:04:20 	check_reload_status: Linkup starting re0
Dec 9 01:04:20 	php: rc.bootup: Accept router advertisements on interface sk0
Dec 9 01:04:20 	check_reload_status: rc.newwanip starting sk0
Dec 9 01:04:19 	kernel: sk0: link state changed to UP
Dec 9 01:04:19 	kernel:
Dec 9 01:04:19 	check_reload_status: Linkup starting sk0
Dec 9 01:04:17 	check_reload_status: Linkup starting sk0

            2.4.5-RELEASE-p1 (amd64)
            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              Here is the error:

              Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

              Looks like it tried to start Unbound but it was already started as the port was opened already… Don't really have any other help to offer at this moment... Keep an eye on the logs and see if something else comes up...

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • RonpfSR
                RonpfS
                last edited by

                It always start the Resolver twice even on a fresh install with no package installed.

                I tried to open the /var/unbound/pfb_dnsbl.conf 58.9MB in the pfblocker logs tab and it only say Loading file…. nothing appears.

                Trying to open it with File Manager gives me :

                Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 123487193 bytes) in /usr/local/www/packages/filemgr/file_manager.php on line 411

                I can download it and nothing seems abnormal.

                I got this crash report :

                Crash report begins.  Anonymous machine information:

i386
10.1-RELEASE-p24
FreeBSD 10.1-RELEASE-p24 #0 f27a67c(releng/10.1)-dirty: Wed Nov  4 16:13:40 CST 2015     root@pfs22-i386-builder:/usr/obj.RELENG_2_2.i386/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10

Crash report details:

PHP Errors:
[09-Dec-2015 01:27:54 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200
[09-Dec-2015 01:39:21 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200
[09-Dec-2015 01:40:20 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200
[09-Dec-2015 01:40:38 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 123487193 bytes) in /usr/local/www/packages/filemgr/file_manager.php on line 411

Filename: /var/crash/minfree
2048

                It is a 2GB P4 Prescott …

                In the pfBlocker/Log browser there is no dnsbl.log or error.log
                In /var/log/pfblockerng/ there is a file dnsbl_error.log , doesn't tell much.

                Is-it possible to revert to version 2.0.1 ? Didn't had that issue on a much slower laptop with 2.0.1.

                2.4.5-RELEASE-p1 (amd64)
                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                1 Reply Last reply Reply Quote 0
                • SoloamS
                  Soloam
                  last edited by

                  I have found some false positives in the iblocklist lists, for example if you preform a dns lookup to "fractal-design.com" (case builder) it would return 62.116.130.8 that if you search https://www.iblocklist.com/search?string=62.116.130.8 if gives a lot of lists (Malicious, Tracking, etc) can it be outdated?

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    @soloam:

                    I have found some false positives in the iblocklist lists, for example if you preform a dns lookup to "fractal-design.com" (case builder) it would return 62.116.130.8 that if you search https://www.iblocklist.com/search?string=62.116.130.8 if gives a lot of lists (Malicious, Tracking, etc) can it be outdated?

                    FPs need to be reported to whomever maintains the blocklist. Or just stop using iBlock lists altogether.

                    I found idiocy like eicar.org on multiple "malware" blocklists. Sigh. Also, people will happily add entire CDN servers (Amazon, etc.) there. Some people just should get out of the blocklist business, stupidity everywhere.

                    1 Reply Last reply Reply Quote 0
                    • SoloamS
                      Soloam
                      last edited by

                      I've been getting a lot of false positives in iblock lists, they seemed like a good blacklist provider. What lists are people using in IP and Hosts?

                      Thank You all

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        @BBcan177:

                        Here is the error:

                        Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

                        Maybe it has something to do with IPv6? as the error has a udp6 socket shown.

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • RonpfSR
                          RonpfS
                          last edited by

                          @BBcan177:

                          @BBcan177:

                          Here is the error:

                          Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

                          Maybe it has something to do with IPv6? as the error has a udp6 socket shown.

                          I changed the LAN IPv6 Configuration Type from Track Interface to none
                          that solved the unbound crashing  ;D

                          As the WAN DHCP didn't provide DHCP6 IP, the LAN IPv6 ip was:

                          IPv6 Link Local fe80::1:1

                          this is probably better not to assign LAN IPV6 ip.

                          now I get :
                          IPv6 Link Local fe80::1e7e:e5ff:fe1f:fad5

                          Thanks for opening my noob eyes  ;)

                          2.4.5-RELEASE-p1 (amd64)
                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            pfBlockerNG (Bootstrap conversion) has been submitted to the devs.

                            https://github.com/pfsense/FreeBSD-ports/pull/24

                            If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….

                            2.3 Testing feedback here:
                            https://forum.pfsense.org/index.php?board=65.0

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • J
                              Jamerson
                              last edited by

                              on the DNSBL FEEDS , below on the page have Custom Block List,
                              I've added some domains there but I can still access them even they are on the block list .
                              how is this possible ?

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                @Jamerson:

                                on the DNSBL FEEDS , below on the page have Custom Block List,
                                I've added some domains there but I can still access them even they are on the block list .
                                how is this possible ?

                                When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mygeeknc
                                  last edited by

                                  I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    @mygeeknc:

                                    I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

                                    Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      @BBcan177:

                                      pfBlockerNG (Bootstrap conversion) has been submitted to the devs.

                                      https://github.com/pfsense/FreeBSD-ports/pull/24

                                      If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….

                                      2.3 Testing feedback here:
                                      https://forum.pfsense.org/index.php?board=65.0

                                      The pkg was merged last night for pfSense 2.3 … Would appreciate any Feedback. Please post feedback to the 2.3 forum thread.

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        heliop100
                                        last edited by

                                        Hi,

                                        Thanks BBcan177 for v 2

                                        I'm testing it, upgrade with no problem.

                                        On DNSBL I use your tutorial list and four custom domains:
                                        facebook.com
                                        youtube.com
                                        terra.com.br
                                        terra.com

                                        I get Alerts but not block the sites (1.jpg)

                                        On ipv4 lists I get facebook.com blocked using Whois/AS number. With Whois/Domain name didn't work.

                                        1.jpg_thumb
                                        1.jpg

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          Hi heliop100,

                                          In regards to DNSBL, make sure that the LAN devices only use pfSense as its DNS server. You probably also needed to add www.facebook.com etc to your domain list.

                                          Since facebook uses several different IPs, using its AS number would be required instead of just the domain name when using the IP block settings.

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • H
                                            heliop100
                                            last edited by

                                            Ok, I change for www.facebook.com, pt-br.facebook.com, and now are working.

                                            This are on my lab.
                                            If I want to do this on my work network, whit my Domain Controllers/DNS Servers, what are the setup.
                                            Use pfSense as DNS for my devices and forward DNS requests from pfSense to the ADs?

                                            Thanks

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.