PfBlockerNG v2.0 w/DNSBL

yea

This might sound like a bizarre bug, but just reporting what happened.

Had everything working great for weeks now. Survived updates, everything good.

Today noticed that Chameleon had 0 entries on the pfsense home. Figured no matter, but thought to debug I'd change under DNSBL Feeds, "Chameleon" to "chameleon".

After hitting saved pfsense complained of HTTP_REFERRER issues and my router was inaccessible even after reboot.

Was odd, hence my reporting.

Reinstalled and recovered from backup and everything is fine now.

I should note that the Chamelon list is not relevant to me.

BBcan177

Hi yea,

When you hit "save" to update that DNSBL list, do you know if the pfBNG cron task might have been running in the background at the same time? Can you see the pfblockerng.log?

BBcan177

@BBcan177:

@RonpfS:
[ SEC1_OpenBL ]		 Downloading update [ 12/14/15 21:28:54 ] . cURL Error: 28

 [ pfB_SEC1 - SEC1_OpenBL ] Download FAIL [ 12/14/15 21:29:54 ]
 [ 69.60.103.158 ] Firewall IP block found in: [ Array ]
There is an issue as its displaying "Array"…

You can either edit the line in pfblockerng.inc Line 1329 or wait for the next PR…

Original: $log = " [ {$ip} ] Firewall IP block found in: [ [b]{$result} ]\n";
Modified: $log = " [ {$ip} ] Firewall IP block found in: [ [b]{$result[1]} | {$result[0]} ]\n";

The following issue is fixed in the package. So users can either edit the file to manually make this change, or re-install. I didn't bump the package version for this single issue.

https://github.com/pfsense/pfsense-packages/commit/d48c16f2bf89810c45d75fe50912fb6bd7edf019

Gerard64

How can I make a whitelist for pfblocker or more for dnsbl?
I created a alias with 2 test domains and set it as the first floating rule but that didn't work the 2 test domains can't be reached.

How do i do this the best way?

BBcan177

@Gé:

How can I make a whitelist for pfblocker or more for dnsbl?
I created a alias with 2 test domains and set it as the first floating rule but that didn't work the 2 test domains can't be reached.

How do i do this the best way?

The IP rules are independent of DNSBL…

Currently, you can't create access-control type refinements in DNSBL. If you want to have some devices to bypass DNSBL, then those devices need to use a different DNS server. I have plans for improvement in this area, but that involves enabling python support in Unbound and designing a python script for DNSBL

Gerard64

Sounds complicated.
Good luck with this future improvement.

Using a alternative DNS is a good enough solution to reach a site I can't reach thru dnsbl wen needed.

Thank you!

hda

@Gé:

…Using a alternative...

pfBlockerNG: DNSBL: Settings (Custom Domain Suppression) ? No ?

yea

@BBcan177:

Hi yea,

When you hit "save" to update that DNSBL list, do you know if the pfBNG cron task might have been running in the background at the same time? Can you see the pfblockerng.log?

Hi BBcan177 nothing warned me of such. Couldn't prove either way I'm afraid.

chadb

I am seeing an issue where the pages with ads can take up to 20 seconds to timeout prior to loading the page…

Example: landsend.com will sit blank for 20 seconds waiting on assets.adobedtm.com, then loads immediately.

Our DNSBL webserver is set at 192.168.192.168 and i can ping it from my computer, it is also set to allow all traffic to/from this address in the floating rules.

My internal network is 10.0.0.0/12 and Guest network is in 172.16.0.0/16 range.

I have followed all the instructions in this forum, and all is working well, except this delay between DNSBL and the computer.

Are there any more tests i can do to check the connection to the DNSBL webserver? If I browse to the IP or request a jpg file it times out.

Thanks for any help or suggestions.

-Chad

BBcan177

@chadb:

I am seeing an issue where the pages with ads can take up to 20 seconds to timeout prior to loading the page…
If I browse to the IP or request a jpg file it times out.

Hi Chad,

You have to check your Firewall/NAT rules to see if a rule is blocking access to the DNSBL VIP from your LAN. Without fixing that you will get timeouts as you are experiencing. You have to ensure that you can ping and browse to the VIP.

Jamerson

@BBcan177:

I have hard coded some domains so that they can't be suppressed ;) <kidding>Run the following command to see if the domain is in the DNSBL list:
grep "example.com" /var/unbound/pfb_dnsbl.conf

pinging those domains should also resolve to the DNSBL VIP address.

If the domain is listed there, then check to see if your device DNS is pointed to the Resolver, and is not resolving from to a different DNS server…</kidding>

if I ping the domains its resolve the DNSBL IP 10.10.10.1
now somehow stuff start working and it blocks the sites.
maybe it needed time ? I didn't change anything from side .

BBcan177

I have posted a Pull Request #1223:

Fix 'Match Outbound' rule variable name
Remove duplicate Alexa variable as its already in pfb_global()
Determine if a DNSBL background reload is running before updating DNSBL
Change "${cmd}" variable name to "{$cmd}"
Add $pfb['ccdir'] explicitly due to file caching issue.
Fix dShield URL
Add tcpiputils to DNSBL Domain threat lookup
Add log size settings (5000 & 10000 lines) for limited storage installations. (Not recommended)
Add Paypal 'support the Developer' link
Remove extra whitespace

Also, the following issue was included in Pull Request #1219

BBcan177

@BBcan177:

I have posted a Pull Request #1223:

PR has been merged. pfBlockerNG v2.0.4

captain1980

I have a question of running VPN next to/ together with DNSBL.

On my laptop and Iphone/ Ipad i have client software running PIA VPN. With the VPN on nothing seem to be blocked, when switched of DNSBL is working. This is confirmed in the alerts tab and log.

Is it not possible to run VPN and DNSBL ? My understanding of the system is still limited. Hope you guys could point me in the right direction.

Greets,

HJ

BBcan177

@captain1980:

Is it not possible to run VPN and DNSBL ? My understanding of the system is still limited.

I don't personally use a VPM like PIA, but the only way for DNSBL to function, is if the pfSense Resolver is used for the DNS requests. If the VPN uses a different DNS server, then DNSBL will not block any domains…

captain1980

Ok thanks for the reply.

Is it possible to use another DNS then the one from the VPN server to use both systems.

When i run the VPN and DNSBL the NTp clock syc & dns resoler go "off" and then nothing works anymore.

Hj

Ramosel

@BBcan177:

I don't personally use a VPM like PIA, but the only way for DNSBL to function, is if the pfSense Resolver is used for the DNS requests. If the VPN uses a different DNS server, then DNSBL will not block any domains…

I think I understand the issue when running a PIA client on a device behind the pfSense system.

Does this issue exist if you use pfSense/OpenVPN system as the VPN client? If so, is the fix as simple as using PIA's DNS values in pfSense?

captain1980

Using the DNS of the VPN server did not change the problem.

When i start running the Openvpn client "unbound" will stop together with the "ntp sync" internet. Running no client VPN everything runs well.

My goal is to run client VPN to PIA plus use the capabilities of pfblockerng dnsbl for ad blocking, trackers etc. In don,t want my IP to be shown.

Ramosel

@captain1980:

Using the DNS of the VPN server did not change the problem.

My goal is to run client VPN to PIA plus use the capabilities of pfblockerng dnsbl for ad blocking, trackers etc. In don,t want my IP to be shown.

Thanks for the information. This is the direction I'm heading too. I have a few more things to clean up before I (re)invoke my PIA connection. I'll keep an eye on your issue.

Rick

cmpufxr

@chadb:

I am seeing an issue where the pages with ads can take up to 20 seconds to timeout prior to loading the page…

Example: landsend.com will sit blank for 20 seconds waiting on assets.adobedtm.com, then loads immediately.

-Chad

I have been dealing with this issue also, I have found using wireshark that the VIP network request is being sent to 10.10.10.1 on port 80 (not the port that you have set) so the website waits until it times out to load the page.

A previous post mentioned that it was squid that was sending traffic to port 80. (to see the 1x1 gif you need to go to 10.10.10.1 on the port you have set.)

I have also set the VIP ip to 172.16.0.5 and the ports to 8178 and 8179 (suricata off, squid off, squidguard off) using wireshark I still see traffic going to 10.10.10.1 port 80

Also on systems that do not use the squid3 have the same delay also on windows or centos. The websites I am using to test are newegg and foxnews.