PfBlockerNG v2.0 w/DNSBL

RonpfS

It always start the Resolver twice even on a fresh install with no package installed.

I tried to open the /var/unbound/pfb_dnsbl.conf 58.9MB in the pfblocker logs tab and it only say Loading file…. nothing appears.

Trying to open it with File Manager gives me :

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 123487193 bytes) in /usr/local/www/packages/filemgr/file_manager.php on line 411

I can download it and nothing seems abnormal.

I got this crash report :

Crash report begins.  Anonymous machine information:

i386
10.1-RELEASE-p24
FreeBSD 10.1-RELEASE-p24 #0 f27a67c(releng/10.1)-dirty: Wed Nov  4 16:13:40 CST 2015     root@pfs22-i386-builder:/usr/obj.RELENG_2_2.i386/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10

Crash report details:

PHP Errors:
[09-Dec-2015 01:27:54 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200
[09-Dec-2015 01:39:21 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200
[09-Dec-2015 01:40:20 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 82324797 bytes) in /usr/local/www/pfblockerng/pfblockerng_log.php on line 200
[09-Dec-2015 01:40:38 America/New_York] PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 123487193 bytes) in /usr/local/www/packages/filemgr/file_manager.php on line 411

Filename: /var/crash/minfree
2048

It is a 2GB P4 Prescott …

In the pfBlocker/Log browser there is no dnsbl.log or error.log
In /var/log/pfblockerng/ there is a file dnsbl_error.log , doesn't tell much.

Is-it possible to revert to version 2.0.1 ? Didn't had that issue on a much slower laptop with 2.0.1.

Soloam

I have found some false positives in the iblocklist lists, for example if you preform a dns lookup to "fractal-design.com" (case builder) it would return 62.116.130.8 that if you search https://www.iblocklist.com/search?string=62.116.130.8 if gives a lot of lists (Malicious, Tracking, etc) can it be outdated?

doktornotor

@soloam:

I have found some false positives in the iblocklist lists, for example if you preform a dns lookup to "fractal-design.com" (case builder) it would return 62.116.130.8 that if you search https://www.iblocklist.com/search?string=62.116.130.8 if gives a lot of lists (Malicious, Tracking, etc) can it be outdated?

FPs need to be reported to whomever maintains the blocklist. Or just stop using iBlock lists altogether.

I found idiocy like eicar.org on multiple "malware" blocklists. Sigh. Also, people will happily add entire CDN servers (Amazon, etc.) there. Some people just should get out of the blocklist business, stupidity everywhere.

Soloam

I've been getting a lot of false positives in iblock lists, they seemed like a good blacklist provider. What lists are people using in IP and Hosts?

Thank You all

BBcan177

@BBcan177:

Here is the error:

Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

Maybe it has something to do with IPv6? as the error has a udp6 socket shown.

RonpfS

@BBcan177:

@BBcan177:

Here is the error:

Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

Maybe it has something to do with IPv6? as the error has a udp6 socket shown.

I changed the LAN IPv6 Configuration Type from Track Interface to none
that solved the unbound crashing ;D

As the WAN DHCP didn't provide DHCP6 IP, the LAN IPv6 ip was:

IPv6 Link Local fe80::1:1

this is probably better not to assign LAN IPV6 ip.

now I get :
IPv6 Link Local fe80::1e7e:e5ff:fe1f:fad5

Thanks for opening my noob eyes ;)

BBcan177

pfBlockerNG (Bootstrap conversion) has been submitted to the devs.

https://github.com/pfsense/FreeBSD-ports/pull/24

If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….

2.3 Testing feedback here:
https://forum.pfsense.org/index.php?board=65.0

Jamerson

on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?

BBcan177

@Jamerson:

on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?

When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.

mygeeknc

I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

BBcan177

@mygeeknc:

I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?

BBcan177

@BBcan177:

pfBlockerNG (Bootstrap conversion) has been submitted to the devs.

https://github.com/pfsense/FreeBSD-ports/pull/24

If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….

2.3 Testing feedback here:
https://forum.pfsense.org/index.php?board=65.0

The pkg was merged last night for pfSense 2.3 … Would appreciate any Feedback. Please post feedback to the 2.3 forum thread.

heliop100

Hi,

Thanks BBcan177 for v 2

I'm testing it, upgrade with no problem.

On DNSBL I use your tutorial list and four custom domains:
facebook.com
youtube.com
terra.com.br
terra.com

I get Alerts but not block the sites (1.jpg)

On ipv4 lists I get facebook.com blocked using Whois/AS number. With Whois/Domain name didn't work.

1.jpg_thumb

BBcan177

Hi heliop100,

In regards to DNSBL, make sure that the LAN devices only use pfSense as its DNS server. You probably also needed to add www.facebook.com etc to your domain list.

Since facebook uses several different IPs, using its AS number would be required instead of just the domain name when using the IP block settings.

heliop100

Ok, I change for www.facebook.com, pt-br.facebook.com, and now are working.

This are on my lab.
If I want to do this on my work network, whit my Domain Controllers/DNS Servers, what are the setup.
Use pfSense as DNS for my devices and forward DNS requests from pfSense to the ADs?

Thanks

BBcan177

@heliop100:

Ok, I change for www.facebook.com, pt-br.facebook.com, and now are working.

This are on my lab.
If I want to do this on my work network, whit my Domain Controllers/DNS Servers, what are the setup.
Use pfSense as DNS for my devices and forward DNS requests from pfSense to the ADs?

Thanks

To use DNSBL with an internal DNS server, you should have all the local LAN devices point to your internal DNS server only, then have the internal DNS server point its forwarders to pfSense as its only DNS forwarder… You can also add a firewall rule to reject any other outbound DNS that doesn't originate from your pfSense Box.

mygeeknc

The browser is IE 11 (this is part of a multi-user environment, I have no choice on this one) and the url was a dropbox folder share. I can't give the exact url but should be pretty easy to replicate.

@BBcan177:

@mygeeknc:

I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?

BBcan177

@mygeeknc:

The browser is IE 11 (this is part of a multi-user environment, I have no choice on this one) and the url was a dropbox folder share. I can't give the exact url but should be pretty easy to replicate.

@BBcan177:

@mygeeknc:

I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?

You can also suppress the domain that is being blocked when you browse to that Dropbox URL.

Jamerson

@BBcan177:

@Jamerson:

on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?

When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.

i already did those steps however it didn't works,
even rebooted the firewall.

BBcan177

@Jamerson:

@BBcan177:

@Jamerson:

on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?

When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.

i already did those steps however it didn't works,
even rebooted the firewall.

Add both example.com and www.example.com to the list…
(Change example.com)