PfBlockerNG v2.0 w/DNSBL
-
I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?
Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?
-
pfBlockerNG (Bootstrap conversion) has been submitted to the devs.
https://github.com/pfsense/FreeBSD-ports/pull/24
If you guys get a chance, I would recommend testing out the latest pfSense v2.3 snapshot as its expected to go Beta soon along with the packages….
2.3 Testing feedback here:
https://forum.pfsense.org/index.php?board=65.0The pkg was merged last night for pfSense 2.3 … Would appreciate any Feedback. Please post feedback to the 2.3 forum thread.
-
Hi,
Thanks BBcan177 for v 2
I'm testing it, upgrade with no problem.
On DNSBL I use your tutorial list and four custom domains:
facebook.com
youtube.com
terra.com.br
terra.comI get Alerts but not block the sites (1.jpg)
On ipv4 lists I get facebook.com blocked using Whois/AS number. With Whois/Domain name didn't work.
-
Hi heliop100,
In regards to DNSBL, make sure that the LAN devices only use pfSense as its DNS server. You probably also needed to add www.facebook.com etc to your domain list.
Since facebook uses several different IPs, using its AS number would be required instead of just the domain name when using the IP block settings.
-
Ok, I change for www.facebook.com, pt-br.facebook.com, and now are working.
This are on my lab.
If I want to do this on my work network, whit my Domain Controllers/DNS Servers, what are the setup.
Use pfSense as DNS for my devices and forward DNS requests from pfSense to the ADs?Thanks
-
Ok, I change for www.facebook.com, pt-br.facebook.com, and now are working.
This are on my lab.
If I want to do this on my work network, whit my Domain Controllers/DNS Servers, what are the setup.
Use pfSense as DNS for my devices and forward DNS requests from pfSense to the ADs?Thanks
To use DNSBL with an internal DNS server, you should have all the local LAN devices point to your internal DNS server only, then have the internal DNS server point its forwarders to pfSense as its only DNS forwarder… You can also add a firewall rule to reject any other outbound DNS that doesn't originate from your pfSense Box.
-
The browser is IE 11 (this is part of a multi-user environment, I have no choice on this one) and the url was a dropbox folder share. I can't give the exact url but should be pretty easy to replicate.
I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?
Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?
-
The browser is IE 11 (this is part of a multi-user environment, I have no choice on this one) and the url was a dropbox folder share. I can't give the exact url but should be pretty easy to replicate.
I know this has been brought up before but I don't think I've seen a resolution. Is there a way around having the SSL certificate error on some pages with the DNSBL enabled?
Can you post the URL(s) that you are having issues with, or send them to me via PM? Also what browser are you using?
You can also suppress the domain that is being blocked when you browse to that Dropbox URL.
-
on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.
i already did those steps however it didn't works,
even rebooted the firewall. -
on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.
i already did those steps however it didn't works,
even rebooted the firewall.Add both example.com and www.example.com to the list…
(Change example.com) -
Hey BBcan,
2.0 is working great for me, but I did have to make one tweak after install:
The LightHTTPD config for DNSBL has debug enabled by default. This causes a lot of file write I/O for some reason, and on systems with poor disk performance (like the hypervisor I run PFSense on) it has a nasty side-effect of making the 1x1 image take around 5 seconds to be served.
I monitored the LightHTTPD process and saw lots of write activity to /var/log/pfblockerng/dnsbl_error.log every time a client loaded a blocked url.
I was able to fix the issue by disabling log-condition-handling in the pfb_dnsbl_lighty.conf file ( Modified pfblockerng.inc and restarted )
debug.log-condition-handling = "disable"Did you intend to leave this setting on for release of the package? Or should it be updated default to disable?
-
The LightHTTPD config for DNSBL has debug enabled by default. This causes a lot of file write I/O for some reason, and on systems with poor disk performance (like the hypervisor I run PFSense on) it has a nasty side-effect of making the 1x1 image take around 5 seconds to be served.
I monitored the LightHTTPD process and saw lots of write activity to /var/log/pfblockerng/dnsbl_error.log every time a client loaded a blocked url.
I was able to fix the issue by disabling log-condition-handling in the pfb_dnsbl_lighty.conf file ( Modified pfblockerng.inc and restarted )
debug.log-condition-handling = "disable"Did you intend to leave this setting on for release of the package? Or should it be updated default to disable?
Hi ODVPFS,
The debug.log-condition-handling is used to collect HTTPs alerts. Without that option enabled, HTTPs alerts will still be blocked but without the logging.
When a client makes an HTTPs request to a domain that is in the blocked lists, the Resolver (Unbound) forwards the client to the DNSBL VIP address where the DNSBL Lighttpd web server is listening. The browser tries to make an SSL handshake with Lighttpd, but quickly sees that the certificate doesn't match, and the browser should quickly drop the connection and terminate the browser request. Since it doesn't establish the SSL handshake, the 1x1 gif never gets sent, and there is nothing to log. It sounds counter intuitive being an error log, but this debug error log captures the HTTPs domain which is then logged to the Alerts tab. As stated above, you can disable it, however, you will not get any alerts for HTTPs rejected domains without it…
In regards to your delay in serving the 1x1 image, are you on a single LAN subnet or a multi LAN network? Ensure that you are able to ping and browse to the VIP. The HTTP alerts do not use this Lighttpd error log. For multi-lan segments, there is a checkbox in the DNSBL tab to create a floating rule to allow traffic from other LAN subnets.
Here is a tech link to the Lighttpd error conditional log...
http://blog.lighttpd.net/articles/2006/04/02/log-condition-handling-the-hidden-feature-for-debuging/ -
An update to pfBNG was recently merged. The pkg is now v2.0.3.
PR #1217
https://github.com/pfsense/pfsense-packages/pull/1217-
Changes have been made to the DNSBL Service. If you experience any issues with the DNSBL Service not starting after re-install please let me know.
-
"Alias Native" option added to TOP20 tab.
-
Improved the Syslog (system.log) notices when Cron/Force commands are run.
-
Added a set_time_limit(0) to hopefully fix the issue with the 900 secs timeout that some users were experiencing.
-
-
on the DNSBL FEEDS , below on the page have Custom Block List,
I've added some domains there but I can still access them even they are on the block list .
how is this possible ?When you add to an existing custom list, you need to select the "Update custom list" setting at the bottom of the page. Otherwise the list is only updated as per the Alias frequency setting.
i already did those steps however it didn't works,
even rebooted the firewall.Add both example.com and www.example.com to the list…
(Change example.com)thank you for your answer.
yes both domains are added , using sex.com as test
www.sex.com
sex.comafter I chosed on update custom list 'Update Custom List' and clicked saved, after I even forced to reload the pfblocked on the update page , but when I chose sex.com it opens
-
I have hard coded some domains so that they can't be suppressed ;) <kidding>Run the following command to see if the domain is in the DNSBL list:
grep "example.com" /var/unbound/pfb_dnsbl.confpinging those domains should also resolve to the DNSBL VIP address.
If the domain is listed there, then check to see if your device DNS is pointed to the Resolver, and is not resolving from to a different DNS server…</kidding>
-
@BBcan177
First I wanted to thank you for the work you have put into this and as usual no real problems. I just wanted to ask about the gif image being pushed to the browser. When I browse to the VIP address I get a 1x1 pixel image. Is this image a placecard holder that would be populated with info or should it be in a different scale. I run my browser locked down as much as possible so not having seen the image is not on my priority list. I can ping and browse to it but was wondering about the single pixel size. If this is normal unpopulated size no worries but if not where do you hide it and what size is the default. -
Hi webtyro,
The 1x1 pixel is used so that it fills in where an ADvert is placed in a browser. This could be a warning message "Blocked by Admin" or something like that… but its hard to seperate the Feeds of ADVert domains vs Malicious domains, so its just easier to use the 1x1 pixel.
-
Hi webtyro,
The 1x1 pixel is used so that it fills in where an ADvert is placed in a browser. This could be a warning message "Blocked by Admin" or something like that… but its hard to seperate the Feeds of ADVert domains vs Malicious domains, so its just easier to use the 1x1 pixel.
Sometimes, when clicking a blocked AD URL, The browser was brought to VIP page with a white 1x1 pixel in the middle.
-
Hi webtyro,
The 1x1 pixel is used so that it fills in where an ADvert is placed in a browser. This could be a warning message "Blocked by Admin" or something like that… but its hard to seperate the Feeds of ADVert domains vs Malicious domains, so its just easier to use the 1x1 pixel.
Sometimes, when clicking a blocked AD URL, The browser was brought to VIP page with a white 1x1 pixel in the middle.
Note to self: "Don't click on ADs" :) lol….
-
Hi ODVPFS,
The debug.log-condition-handling is used to collect HTTPs alerts. Without that option enabled, HTTPs alerts will still be blocked but without the logging.
When a client makes an HTTPs request to a domain that is in the blocked lists, the Resolver (Unbound) forwards the client to the DNSBL VIP address where the DNSBL Lighttpd web server is listening. The browser tries to make an SSL handshake with Lighttpd, but quickly sees that the certificate doesn't match, and the browser should quickly drop the connection and terminate the browser request. Since it doesn't establish the SSL handshake, the 1x1 gif never gets sent, and there is nothing to log. It sounds counter intuitive being an error log, but this debug error log captures the HTTPs domain which is then logged to the Alerts tab. As stated above, you can disable it, however, you will not get any alerts for HTTPs rejected domains without it…
In regards to your delay in serving the 1x1 image, are you on a single LAN subnet or a multi LAN network? Ensure that you are able to ping and browse to the VIP. The HTTP alerts do not use this Lighttpd error log. For multi-lan segments, there is a checkbox in the DNSBL tab to create a floating rule to allow traffic from other LAN subnets.
Here is a tech link to the Lighttpd error conditional log...
http://blog.lighttpd.net/articles/2006/04/02/log-condition-handling-the-hidden-feature-for-debuging/Thanks, that makes sense. The issue I have is clearly disk I/O related (and self-induced) so I'm willing to sacrifice the logging in this case. I'm running PFSense on a Smartos/KVM Hypervisor (which uses ZFS) and I'm doing it without log drives - which has the consequence of horribly slow write sync performance.
Everything network related is fine - once I disabled the debug the response times went down to <100ms easily. I diagnosed the issue by running truss on the Lighthttpd process while hitting it with test requests from the browser - could see a ton of strings written to error log (even though the content of the error log never changed, which is strange, its almost like its overwriting the file repeatedly). Anyway I checked fstat for the pid to get the inode, and used find to identify it was the log file, which led me to the debug setting.
The only thing I would suggest as a very very minor enhancement (which I'm happy to try to do and submit a PR on github if you are open to it) is to throw a checkbox on the DNSBL config section to disable logging (explaining the caveat of losing HTTPS logging) so I don't have to redo my hack whenever I download updates.
Thanks again for the support, this is a great package!
