Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    Scheduled Pinned Locked Moved
    pfBlockerNG
    192
    1.1k
    1.4m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • SoloamS
      Soloam
      last edited by

      I've been getting a lot of false positives in iblock lists, they seemed like a good blacklist provider. What lists are people using in IP and Hosts?

      Thank You all

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @BBcan177:

        Here is the error:

        Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

        Maybe it has something to do with IPv6? as the error has a udp6 socket shown.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • RonpfSR
          RonpfS
          last edited by

          @BBcan177:

          @BBcan177:

          Here is the error:

          Dec 9 01:04:36 php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449641076] unbound[30851:0] debug: creating udp6 socket :: 53 [1449641076] unbound[30851:0] error: bind: address already in use [1449641076] unbound[30851:0] fatal error: could not open ports'

          Maybe it has something to do with IPv6? as the error has a udp6 socket shown.

          I changed the LAN IPv6 Configuration Type from Track Interface to none
          that solved the unbound crashing  ;D

          As the WAN DHCP didn't provide DHCP6 IP, the LAN IPv6 ip was:

          IPv6 Link Local fe80::1:1

          this is probably better not to assign LAN IPV6 ip.

          now I get :
          IPv6 Link Local fe80::1e7e:e5ff:fe1f:fad5

          Thanks for opening my noob eyes  ;)

          2.4.5-RELEASE-p1 (amd64)
          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            pfBlockerNG (Bootstrap conversion) has been submitted to the devs.

            https://github.com/pfsense/FreeBSD-ports/pull/24

            If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….

            2.3 Testing feedback here:
            https://forum.pfsense.org/index.php?board=65.0

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • J
              Jamerson
              last edited by

              on the DNSBL FEEDS , below on the page have Custom Block List,
              I've added some domains there but I can still access them even they are on the block list .
              how is this possible ?

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @Jamerson:

                on the DNSBL FEEDS , below on the page have Custom Block List,
                I've added some domains there but I can still access them even they are on the block list .
                how is this possible ?

                When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • M
                  mygeeknc
                  last edited by

                  I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @mygeeknc:

                    I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

                    Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @BBcan177:

                      pfBlockerNG (Bootstrap conversion) has been submitted to the devs.

                      https://github.com/pfsense/FreeBSD-ports/pull/24

                      If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….

                      2.3 Testing feedback here:
                      https://forum.pfsense.org/index.php?board=65.0

                      The pkg was merged last night for pfSense 2.3 … Would appreciate any Feedback. Please post feedback to the 2.3 forum thread.

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • H
                        heliop100
                        last edited by

                        Hi,

                        Thanks BBcan177 for v 2

                        I'm testing it, upgrade with no problem.

                        On DNSBL I use your tutorial list and four custom domains:
                        facebook.com
                        youtube.com
                        terra.com.br
                        terra.com

                        I get Alerts but not block the sites (1.jpg)

                        On ipv4 lists I get facebook.com blocked using Whois/AS number. With Whois/Domain name didn't work.

                        1.jpg_thumb
                        1.jpg

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          Hi heliop100,

                          In regards to DNSBL, make sure that the LAN devices only use pfSense as its DNS server. You probably also needed to add www.facebook.com etc to your domain list.

                          Since facebook uses several different IPs, using its AS number would be required instead of just the domain name when using the IP block settings.

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • H
                            heliop100
                            last edited by

                            Ok, I change for www.facebook.com, pt-br.facebook.com, and now are working.

                            This are on my lab.
                            If I want to do this on my work network, whit my Domain Controllers/DNS Servers, what are the setup.
                            Use pfSense as DNS for my devices and forward DNS requests from pfSense to the ADs?

                            Thanks

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              @heliop100:

                              Ok, I change for www.facebook.com, pt-br.facebook.com, and now are working.

                              This are on my lab.
                              If I want to do this on my work network, whit my Domain Controllers/DNS Servers, what are the setup.
                              Use pfSense as DNS for my devices and forward DNS requests from pfSense to the ADs?

                              Thanks

                              To use DNSBL with an internal DNS server, you should have all the local LAN devices point to your internal DNS server only, then have the internal DNS server point its forwarders to pfSense as its only DNS forwarder…  You can also add a firewall rule to reject any other outbound DNS that doesn't originate from your pfSense Box.

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • M
                                mygeeknc
                                last edited by

                                The browser is IE 11 (this is part of a multi-user environment, I have no choice on this one) and the url was a dropbox folder share. I can't give the exact url but should be pretty easy to replicate.

                                @BBcan177:

                                @mygeeknc:

                                I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

                                Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @mygeeknc:

                                  The browser is IE 11 (this is part of a multi-user environment, I have no choice on this one) and the url was a dropbox folder share. I can't give the exact url but should be pretty easy to replicate.

                                  @BBcan177:

                                  @mygeeknc:

                                  I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?

                                  Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?

                                  You can also suppress the domain that is being blocked when you browse to that Dropbox URL.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    Jamerson
                                    last edited by

                                    @BBcan177:

                                    @Jamerson:

                                    on the DNSBL FEEDS , below on the page have Custom Block List,
                                    I've added some domains there but I can still access them even they are on the block list .
                                    how is this possible ?

                                    When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.

                                    i already did those steps however it didn't works,
                                    even rebooted the firewall.

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      @Jamerson:

                                      @BBcan177:

                                      @Jamerson:

                                      on the DNSBL FEEDS , below on the page have Custom Block List,
                                      I've added some domains there but I can still access them even they are on the block list .
                                      how is this possible ?

                                      When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.

                                      i already did those steps however it didn't works,
                                      even rebooted the firewall.

                                      Add both  example.com  and  www.example.com  to the list…
                                      (Change example.com)

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • O
                                        ODVPFS
                                        last edited by

                                        Hey BBcan,

                                        2.0 is working great for me, but I did have to make one tweak after install:

                                        The LightHTTPD config for DNSBL has debug enabled by default.  This causes a lot of file write I/O for some reason, and on systems with poor disk performance (like the hypervisor I run PFSense on) it has a nasty side-effect of making the 1x1 image take around 5 seconds to be served.

                                        I monitored the LightHTTPD process and saw lots of write activity to /var/log/pfblockerng/dnsbl_error.log every time a client loaded a blocked url.

                                        I was able to fix the issue by disabling log-condition-handling in the pfb_dnsbl_lighty.conf file ( Modified pfblockerng.inc and restarted )
                                        debug.log-condition-handling    = "disable"

                                        Did you intend to leave this setting on for release of the package?  Or should it be updated default to disable?

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          @ODVPFS:

                                          The LightHTTPD config for DNSBL has debug enabled by default.  This causes a lot of file write I/O for some reason, and on systems with poor disk performance (like the hypervisor I run PFSense on) it has a nasty side-effect of making the 1x1 image take around 5 seconds to be served.

                                          I monitored the LightHTTPD process and saw lots of write activity to /var/log/pfblockerng/dnsbl_error.log every time a client loaded a blocked url.

                                          I was able to fix the issue by disabling log-condition-handling in the pfb_dnsbl_lighty.conf file ( Modified pfblockerng.inc and restarted )
                                          debug.log-condition-handling    = "disable"

                                          Did you intend to leave this setting on for release of the package?  Or should it be updated default to disable?

                                          Hi ODVPFS,

                                          The debug.log-condition-handling is used to collect HTTPs alerts. Without that option enabled, HTTPs alerts will still be blocked but without the logging.

                                          When a client makes an HTTPs request to a domain that is in the blocked lists, the Resolver (Unbound) forwards the client to the DNSBL VIP address where the DNSBL Lighttpd web server is listening. The browser tries to make an SSL handshake with Lighttpd, but quickly sees that the certificate doesn't match, and the browser should quickly drop the connection and terminate the browser request. Since it doesn't establish the SSL handshake, the 1x1 gif never gets sent, and there is nothing to log. It sounds counter intuitive being an error log, but this debug error log captures the HTTPs domain which is then logged to the Alerts tab. As stated above, you can disable it, however, you will not get any alerts for HTTPs rejected domains without it…

                                          In regards to your delay in serving the 1x1 image, are you on a single LAN subnet or a multi LAN network? Ensure that you are able to ping and browse to the VIP. The HTTP alerts do not use this Lighttpd error log. For multi-lan segments, there is a checkbox in the DNSBL tab to create a floating rule to allow traffic from other LAN subnets.

                                          Here is a tech link to the Lighttpd error conditional log...
                                          http://blog.lighttpd.net/articles/2006/04/02/log-condition-handling-the-hidden-feature-for-debuging/

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            An update to pfBNG was recently merged. The pkg is now v2.0.3.

                                            PR #1217
                                            https://github.com/pfsense/pfsense-packages/pull/1217

                                            • Changes have been made to the DNSBL Service. If you experience any issues with the DNSBL Service not starting after re-install please let me know.

                                            • "Alias Native" option added to TOP20 tab.

                                            • Improved the Syslog (system.log) notices when Cron/Force commands are run.

                                            • Added a set_time_limit(0) to hopefully fix the issue with the 900 secs timeout that some users were experiencing.

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post