PfBlockerNG v2.0 w/DNSBL

Ramosel

Few things I found out while beta testing V2

Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed, em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload. They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.

Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum. I added all my hosts host to unbound statically as a work around

Tony M.

Tony, there are some recent posts from people either trying to get OpenVPN/PIA and pfBlockerNG/DNSBL working together or like me, looking to head that direction after I get some other fine tuning in place. Can you please elaborate or cookbook your setup if it is indeed working correctly.

For the 5 folks who asked me privately to keep you informed if I get any info on this… I'll be asking these questions publicly. If someone does respond privately I'll forward responses only if the OP approves. Really, no one here bites (well, maybe Dok - grin)

Rick

wiz561

I am trying to setup the DNSBL portion of pfblocker and ran into a strange problem. I have a pretty restrictive firewall setup where it's pretty much default deny; allow by exception. When setting up the DNSBL portion, I see that the workstations are just timing out when accessing a known blocked site in the DNSBL. In the firewall logs for pfsense, I see the workstation trying to get to 127.0.0.1:8081. I fixed this timeout by adding the 127.0.0.1:8081 in the firewall and now it works properly.

Why does DNSBL try doing a localhost instead of the 10.10.10.1?

Thanks!

RonpfS

DNSBL create a NAT port forward to 127.0.0.1

![DSNBL NAT 3.jpg](/public/imported_attachments/1/DSNBL NAT 3.jpg)
![DSNBL NAT 3.jpg_thumb](/public/imported_attachments/1/DSNBL NAT 3.jpg_thumb)

wiz561

@RonpfS:

DNSBL create a NAT port forward to 127.0.0.1

Makes sense. Thank You!

chain

@RonpfS:

DNSBL create a NAT port forward to 127.0.0.1

Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

I see alot of DNSBL alert, but no permit or match? is this working correctly?

BBcan177

@chain:

@RonpfS:

DNSBL create a NAT port forward to 127.0.0.1

Do you need to create different Port Forward for different zone i.e LAN, WIFI, Guest?

I see alot of DNSBL alert, but no permit or match? is this working correctly?

No you do not need to create any additional NAT rules.. However, in the general tab, you can click the checkbox to create a 'Floating permit rule' for other LAN subnets (WIFI, Guest etc…) to access the DNSBL VIP address. Also ensure that you do not have any other restrictive rules (as wiz561 posted above).

Not sure what you mean by "Permit and Match" as that only refers to IP rules, and not DNSBL?

Exolon

@BBcan17,

The wrench/spanner/settings icon for the pfBlocker widget doesn't work with pfSense 2.3/ pfBlockerNG 2.0.6,

Appears you just need to an ID statement to the DIV tag to the pfblockerng.widget.php (line 500 approx.):


Not really worth me putting a pull request just for this, but maybe something for your next pull request?

BBcan177

@Exolon:

Not really worth me putting a pull request just for this, but maybe something for your next pull request?

Thanks Exolon, I guess one of the latest pfSense commits broke that ;) I have tested the change at line 500 and it seems to correct the issue…

Thanks!

chain

When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

http://kregjig.ning.com/

image.PNG_thumb

BBcan177

@chain:

When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

http://kregjig.ning.com/

Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

chain

@BBcan177:

@chain:

When DNSBL is running, I have looked at the Alerts to find site is working, but not able to see the images. How do I find what is blocking the site images

http://kregjig.ning.com/

Click F12 in the browser and goto "console" it will show the domains that are blocked… Its also visible in the Alerts tab. You can also suppress a domain by clicking the "+" icon in the Alerts Tab.

OK, that's perfect I'll try to getting it working

chain

I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

BBcan177

@chain:

I'm running DNSBL_DNSBLEasyList and have selected all the categories. I notice that I don't get any hit on these categories. is there a way to test if this is working correctly?

Since DNSBL uses deduplication and as Easylists are the last to download, the most popular ADvert servers are being blocked by other Feeds… You can view the Easylist Domain list in the pfBNG Log tab and try to browse to any of those as a test.

shull

Please excuse the noob question, but how do you enable EasyLists? Specifically, what do you put in the Header field? Thanks!

pfSenseHeader.JPG_thumb

BBcan177

The header is just a label for the feed… So it needs to be unique...

ie:

EasyList
EasyPrivacy

chain

here is additional list that can be add to DNSBL

http://www.securemecca.com/Downloads/hosts.txt

todolist

Thanks for pfBlockerNG. I make heavy use of it! I have recently enabled DNSBL and am having a strange issue: When I try to access the pfSense web GUI via hostname, I am redirected to the DNSBL VIP (10.10.10.1). When I "dig firewall.domain" the pfSense box (DNS server) returns the VIP first, and then the proper IP: 10.100.0.1.

I have Unbound set to disable forwarding and enable DHCP registrations and I have a host override for "firewall.domain" pointing to it's proper IP 10.100.0.1. DNSBL "Alerts" tab shows the following:

IF: Unknown
Source: Unknown
Domain/Referer|URI|Agent: firewall.domain Not available for HTTPS alerts
List: no match

Am I missing something in the Unbound configuration? Or is it a DNSBL setting I'm missing? All other local hosts are resolving without issue, it's just pfSense itself that exhibits this behavior.

BBcan177

@todolist:

When I try to access the pfSense web GUI via hostname, I am redirected to the DNSBL VIP (10.10.10.1). When I "dig firewall.domain" the pfSense box (DNS server) returns the VIP first, and then the proper IP: 10.100.0.1.

I have Unbound set to disable forwarding and enable DHCP registrations and I have a host override for "firewall.domain" pointing to it's proper IP 10.100.0.1. DNSBL "Alerts" tab shows the following:

IF: Unknown
Source: Unknown
Domain/Referer|URI|Agent: firewall.domain Not available for HTTPS alerts
List: no match

Am I missing something in the Unbound configuration? Or is it a DNSBL setting I'm missing? All other local hosts are resolving without issue, it's just pfSense itself that exhibits this behavior.

Check your NAT and DNS Host overrides… Don't add anything manually that points to the DNSBL VIP, as that is done by the pkg automatically... Also there are some issues with the Unbound DHCP reg checkboxes... Most leave those disabled...

If you still having issues, maybe try to post in the DNS/NAT forum sections, to see if others can offer any other advice.

todolist

Thanks BBcan177! What would cause the "IF" and "Source" alerts to be "Unknown" and the "List" entry to read "no match"? Is there a debug option I can enable? I've looked through the pfBlockerNG logs tab but maybe I missed a "verbose" option?

BBcan177

Unfortunately for HTTPS requests, the IF/SRC information is not available to log… If you want to see more information run a tcpdump or wireshark... There is some help text in the DNSBL tab...