PfBlockerNG v2.0 w/DNSBL
-
Is anyone using DNSBL & SquidGuard at the same time? Would this be considered redundant?
Having switched from SquidGuard to pfBlocker DNSBL to try it out, I'm struggling to find a configuration/solution for content filtering. Previously we used Shalla's Black List in SquidGuard to selectively block content by category. Is something like this possible in DNSBL & perhaps I'm just missing it?
If not, is there any reason why I would not want to run pfBlocker DNSBL & SquidGuard at the same time?
Hi darrenkdean,
There is no issue with Squid and DNSBL running at the same time… DNSBL is primarily a lite-weight solution to block 'Malicious Domains' and ADvert servers without adding the issues of running a proxy...
Currently, DNSBL does not block sub-domains. So if ads.yahoo.com is in a DNSBL blocklist, its not appropriate to block yahoo.com by adding the following, as it will obviously create issues…
local-zone: "yahoo.com" redirect local-data: "yahoo.com 60 IN A 10.10.10.1"
Its possible to use a list like Shallalist or dsi.ut-capitole.fr in DNSBL, by downloading the feed into /var/db/pfblockerng and extracting it into a subfolder. You can then manually add each category as a "localfile" in DNSBL.
The DNSBL blocklist will also require both "example.com" and "www . example.com" to be added. Here is a patch to auto add "www" to each domain.
https://forum.pfsense.org/index.php?topic=86212.msg581562#msg581562Hope that helps!
- 12 days later
-
I don't know exactly what to do with "DNSBL Virtual IP". The LAN network is 10.10.10.x range. Must this VIP be an active IP? Read something about 1x1 image that is served? Does the pfBlockerNG handle this ip? Should it be in another private network range than the one in use? Tutorials and documentation about pfBlockerNG are non existing it seems?
-
There is plenty of documentation in the pfblockerNG tabs.
From the pfBlockerNG: DNSBL: Settings
DNSBL Virtual IP
Example ( 10.10.10.1 )
Enter a single IPv4 VIP address that is RFC1918 Compliant.This address should be in an Isolated Range than what is used in your Network.
Rejected DNS Requests will be forwarded to this VIP (Virtual IP)
RFC1918 Compliant - (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)Read this Topic and also https://forum.pfsense.org/index.php?topic=86212.0 go get more information.
-
I'm sorry.. there is not. A google of pfblockerng setup or tutorial ends up with lots of single posts. Not once consistent story.
I get this silent error when 'force updating'
DNSBL enabled FAIL - restoring Unbound conf
/var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
fatal flex scanner internal error–end of buffer missedFollowed the 'tutorial' in this thread about adblocking. Also nothing is seen in Alerts.
But am I interpreting this correctly? "This address should be in an Isolated Range than what is used in your Network."
So if my internal lan is 10.10.10.x I should add another private LAN range to pfSense and enter an ip in this new range in the box DNSBL Virtual IP? So a ip in an unused private range?
-
I'm sorry.. there is not. A google of pfblockerng setup or tutorial ends up with lots of single posts. Not once consistent story.
Well if you read all posts in this topic you should get a good idea on how to setup it up.
I get this silent error when 'force updating'
DNSBL enabled FAIL - restoring Unbound conf
/var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
fatal flex scanner internal error–end of buffer missedFollowed the 'tutorial' in this thread about adblocking. Also nothing is seen in Alerts.
When you change something in pfblockerNG, go to the pfBlockerNG: Update tab you have the Live Log Viewer that enable you to see what is happening in the background.
You can also see the log files in the pfBlockerNG: Log Browser
But am I interpreting this correctly? "This address should be in an Isolated Range than what is used in your Network."
So if my internal lan is 10.10.10.x I should add another private LAN range to pfSense and enter an ip in this new range in the box DNSBL Virtual IP? So a ip in an unused private range?
Select something in the 192.168 or 172.16 network
-
This is the log when running a "Force Update":
UPDATE PROCESS START [ 02/20/16 19:05:52 ]
===[ DNSBL Process ]================================================
[ yoyo ] exists.
[ hpHosts_ads ] exists.
[ Adaway ] exists.
[ Cameleon ] exists. Adding Unbound Server:Include line… completed
Validating database... completed [ 02/20/16 19:05:53 ]DNSBL enabled FAIL - restoring Unbound conf
/var/unbound/pfb_dnsbl.conf:48472: error: EOF inside quoted string
fatal flex scanner internal error–end of buffer missed===[ Continent Process ]============================================
===[ Aliastables / Rules ]==========================================
No changes to Firewall rules, skipping Filter Reload
No Changes to Aliases, Skipping pfctl UpdateUPDATE PROCESS ENDED [ 02/20/16 19:05:54 ]
-
Did you select the Virtual IP outside you LAN 10.10.10.x network?
You enabled DNSBL ?Looks like you may have an error in one of the list. Enable only one list to see if the update goes thru.
-
Thanks. Indeed some entry gave that error… Seems to be working now. Still no alerts visible, but I know its blocking ads...
-
Did you enable logging in DNSBL IP Firewall Rule Settings?
-
Yup loggin is enabled. Also as test enabled "Global Enable Logging" on general tab. Still nothing. DNSBL blocks should show up on the Alerts tab right?
I also don't see any result of settings DNSBL Firewall Rule. No floathing rules are created.
So yeah a good informational best practice setup tutorial would be very welcome.
-
If your Lan is 10.10.10.x, what did you set the DNSBL VIP to? It has to be set to any other RFC1918 range for it to work.
In the general tab, the 'global logging' is only specific to IPv4/6 firewall rules. The DNSBL IP logging is only used when a DNSBL list posts IP addresses and these addresses are collected and put into an alias and a firewall rule added. It doesn't log domain based alerts..
I suggest you check your VIP and execute a 'force reload'. You should be able to ping and browse the VIP address from any LAN device. If not, then either the DNSBL service is not running or there is something preventing access to the VIP address. If you have multi-segment LAN addresses, enable the option in the DNSBL tab to create a floating firewall rule to pass the traffic from other Lan subnets.
If your still having trouble, post screenshots of the general and DNSBL tabs.
-
@bbcan177: I still have the issue that after pfsense has been rebooted with DNSBL enabled I manually have to start or restart the unbound service to get the DNS working. Any clue what cause this?
-
Hi fraglord, do you have either of the DHCP check boxes enabled in the Unbound Resolver settings tab? There seems to be some issues with those options. You can also review the pfSense System and Resolver logs for more clues.
-
Thanks for the quick reply :D I habe none of these options enabled because pfsense is not doing DHCP.
But there is something suspicious in the system logsphp-fpm[49122]: /rc.newwanip: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1456266101] unbound[78664:0] error: bind: address already in use [1456266101] unbound[78664:0] fatal error: could not open ports'
-
It's not a DNSBL issue. Check your Unbound settings. Maybe an interface settings issue? If you don't resolve it, post in the DNS forum and see if anyone has other advice for you.
-
Im having troubles loading links in .txt format. with both easylist and blocklists such as: https://www.spamhaus.org/drop/drop.txt
this is the log created when updating:
[ Spamhaus_drop ] Downloading update .. 403 Forbidden
[ pfB_spamhaus - Spamhaus_drop ] Download FAIL [ 02/24/16 2:07:43 ]
Firewall and/or IDS are not blocking download.The Following list has been REMOVED [ Spamhaus_drop ]
…
...[ https://easylist-downloads.adblockplus.org/antiadblockfilters.txt ] Downloading update .
[ DNSBL_EasyList - https://easylist-downloads.adblockplus.org/antiadblockfilters.txt ] Download FAIL
Firewall and/or IDS are not blocking download.I cant figure out what is going wrong in my settings. can somebody help me?
Thanks
-
When you see "403 Forbidden", the site that your trying to download from is either blocking your IP or rate limiting you. Disable the snort list for 24 hours and re-enable to get around that issue.
You can't use other EasyList feeds. Currently only two feeds for EasyList are hardcoded in the EasyList tab. There is also a note about this in the DNSBL tab.
-
It's not a DNSBL issue. Check your Unbound settings. Maybe an interface settings issue? If you don't resolve it, post in the DNS forum and see if anyone has other advice for you.
Not sure if this is the cause of the problem - I am still investigating. At least I can confirm that with DNSBL disabled this problem does not occur.
-
It's not a DNSBL issue. Check your Unbound settings. Maybe an interface settings issue? If you don't resolve it, post in the DNS forum and see if anyone has other advice for you.
Not sure if this is the cause of the problem - I am still investigating. At least I can confirm that with DNSBL disabled this problem does not occur.
How many domains are you blocking? You can see the total in the widget? Your footnote shows 1Gb of ram, maybe with DNSBL, it's taking longer for Unbound to start and newwanip is attempting to restart a second time? Can you increase the RAM size?
-
How many domains are you blocking? You can see the total in the widget? Your footnote shows 1Gb of ram, maybe with DNSBL, it's taking longer for Unbound to start and newwanip is attempting to restart a second time? Can you increase the RAM size?
1099450 Domains in my case with 2.5GB
-
When you see "403 Forbidden", the site that your trying to download from is either blocking your IP or rate limiting you. Disable the snort list for 24 hours and re-enable to get around that issue.
I can open the link in my browser, so i think they're not blocking me. I dont have the snort package installed on my pfsensebox. Which snortlist should i disable?
Thanks for the help!
-
Hi XmickS,
Sorry I meant to say disable the spamhaus drop list in pfBlockerNG for 24hrs. Typically a "403" error means the site you are downloading from is blocking you. Is your browser using a different Gateway or DNS server then the pfSense box? Do you use a proxy? If that doesn't help, post a screenshot of the spamhaus alias settings.
-
I'm starting from a fresh install of 2.2.6-RELEASE (amd64) and rebuilding to clear out cruft from multiple past upgrades.
The installation of the pfBlockerNG package has been sitting at "Executing custom_php_resync_config_command()…" for about 45 minutes now. The browser is not showing a loading animation either (shows the pfSense logo favicon).
Is this normal?
I'm on a 30 down/5 up connection. Whatever it's downloading, if it's downloading that is, shouldn't take that long. Diagnostics/System Activity doesn't appear to say a whole lot is happening on the CPU either.
-
Hi krhainos, can you post the last 20 lines of the pfblockerng.log? You can run this command from the Diagnostics: Command Prompt:
tail -n20 /var/log/pfblockerng/pfblockerng.log
Are there any relevant errors in the pfSense system log?
-
Hi krhainos, can you post the last 20 lines of the pfblockerng.log? You can run this command from the Diagnostics: Command Prompt:
tail -n20 /var/log/pfblockerng/pfblockerng.log
Are there any relevant errors in the pfSense system log?
I'm actually on the way to figuring it out!
Something about one of my rules is tripping up the pfBlockerNG installation.
I've been keeping configuration backups after every piece I configure. I've only done restores from my old config on my alises list, and my rules. It seems the installation hangs after I restore my rules. I'll update once I figure out what exactly it dislikes about my rules.
Update: I found it. After going through the filter section in my config, I found a line between two rules that read "<rule>". It looked out of place, so I removed it. pfBlockerNG is happy now! It downloads, updates, crons and everything. I don't know how it got in there, and going through old backups, it's been there for a while.
I've attached a screenshot in case a visual helps.
-
Hi XmickS,
Sorry I meant to say disable the spamhaus drop list in pfBlockerNG for 24hrs. Typically a "403" error means the site you are downloading from is blocking you. Is your browser using a different Gateway or DNS server then the pfSense box? Do you use a proxy? If that doesn't help, post a screenshot of the spamhaus alias settings.
Found the problem. I was using vpn client and the ip i was using was being blocked by spamhaus. when i switched to another ip i was able to download the list. now everything is working as (i think) it should. thanks for the help!
-
maybe a newbie question, but im curious. what is the difference with pfblockerng and adblock plus (or ghostery)? when these extensions are saying that they're blocking stuff, does that mean that my pfsense box is not blocking everything, or are they blocking the same stuff?
-
Adblock plus is an extension inside your Browser, so it does filter what your browser is using. It does not filter traffic for other application like Windows Update.
pfBlockerNG is on the firewall and filter traffic from all applications and computers.
-
Adblock plus is an extension inside your Browser, so it does filter what your browser is using. It does not filter traffic for other application like Windows Update.
pfBlockerNG is on the firewall and filter traffic from all applications and computers.
But there is no difference in what they filter? Thought maybe pfblocker can't filter everything as well as an adblocker extension.
Sometimes an ad slips through my firewall. Does that mean I don't have everything set as it should?
-
Sometimes an ad slips through my firewall. Does that mean I don't have everything set as it should?
Probably not… it just means the devious little bastards that foist their crap on us have found new inventive ways to sneak shit through. Give the list writers time, they'll catch up.
Rick
-
While I'm relatively new to PFBlockerNG, I've been reading up a lot so I don't ask a question that hasn't already been answered. I hope this is a new question.
I setup PFBlockerNG first at home to test and now I'm implementing it in my office environment (starting with a branch office so I don't disrupt everyone if something gets messed up). The issue I encountered is minor. My home setup utilized PFSense for DHCP and DNS, so the DNS Unbound receiver just worked out of the box once enabled. When testing the config on the Windows Domain network, I had some issues. Windows Server 2012 manages DHCP and DNS. DHCP was configured to set the DNS server as the local DNS server and a remote server (connected over VPN). DNS forwarders were set to point to multiple DNS servers (a few public ones provided by our ISP).
Once I got the settings setup at the office, I noticed no traffic in the PFBlockerNG Alerts. After redoing some settings, I removed all DNS servers from DHCP and set the server running DNS on the local subnet and 10.10.10.1 (set in DNSBL settings) as the other DNS server. Then in DNS I removed all forwarders and replaced it with 10.10.10.1. After completing this, everything was working with PFBlockerNG filtering out ads based on the lists I used from setting it up via this post - (https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943).
Now, everything seems to be working properly, but I noticed that within my local subnet (192.168.2.0/24), I am unable to ping PFsense or access the webgui interface using the internal IP (192.168.2.1). However, I am able to access the webgui using the public WAN IP (all over HTTPS). Also, when I am on the main office subnet (192.168.1.0/24), I can access the PFSense webgui for the remote office with the LAN IP over the VPN at (192.168.2.1) as well as by using the GUI.
I assume this is due to DNS but I am not 100% sure on how to resolve this on the local subnet. It's not a major issue as I can manage it with the WAN IP but if possible I'd like to be able to resolve this problem I've created. Any ideas?
TL;DR -
I configured PFBlockerNG, updated DHCP and DNS settings on my Windows Server 2012 box, and can only access the PFSense web gui via the WAN IP. Any ideas on what setting I am missing or did I mess something up? -
Adblock plus is an extension inside your Browser, so it does filter what your browser is using. It does not filter traffic for other application like Windows Update.
pfBlockerNG is on the firewall and filter traffic from all applications and computers.
But there is no difference in what they filter? Thought maybe pfblocker can't filter everything as well as an adblocker extension.
Sometimes an ad slips through my firewall. Does that mean I don't have everything set as it should?
Which DNSBL Blocklists are you using? There are two posts in this thread for multiple DNSBL lists.
Are you sure that your LAN devices are not using a different DNS server?
Which sites are showing ADs?
-
Then in DNS I removed all forwarders and replaced it with 10.10.10.1.
Point your local LAN devices to your windows Server, and set the MS DNS forwarder to the pfSense IP Address to have DNSBL filter the DNS requests.
-
Then in DNS I removed all forwarders and replaced it with 10.10.10.1.
Point your local LAN devices to your windows Server, and set the MS DNS forwarder to the pfSense IP Address to have DNSBL filter the DNS requests.
I went back and did what you said. LAN devices point to the windows server and the MS DNS forwarder was set to the pfsense LAN interface IP. DNSBL did not filter. I troubleshot it and got it to work by using the pfsense WAN interface IP. While everything is working now with DNSBL filtering traffic, I can't ping the LAN interface IP or access the webgui when on the LAN subnet. I enabled logging on the firewall and tested sending a PING to the pfsense LAN IP and here is what I get:
Act Time If Source Destination Proto
–--------------------------------------------------------------------------------------------------------------------------
pass/100000101 Mar 2 15:58:02 LAN 10.0.0.9 10.0.0.1 ICMP
pass/100000101 Mar 2 16:42:23 LAN 10.0.0.9 10.0.0.1 ICMP
pass/100000101 Mar 2 16:42:25 LAN 10.0.0.9:137 10.0.0.255:137 UDP
pass/100000101 Mar 2 16:42:33 LAN 10.0.0.9:63623 10.10.10.1:53 UDP
pass/100000101 Mar 2 16:42:33 LAN 10.0.0.9:63729 10.10.10.1:53 UDP
pass/100000101 Mar 2 16:42:36 LAN 10.0.0.9:65440 10.10.10.1:53 UDPDid I mess up a setting or is my system in need of a fresh install? Thanks for your help!
-
Maybe DNSBL was not filtering because the DNS on your Windows server cached the domain name ip before the switch.
-
I went back and did what you said. LAN devices point to the windows server and the MS DNS forwarder was set to the pfsense LAN interface IP. DNSBL did not filter. I troubleshot it and got it to work by using the pfsense WAN interface IP. While everything is working now with DNSBL filtering traffic, I can't ping the LAN interface IP or access the webgui when on the LAN subnet.
I would start by disabling DNSBL and fixing one issue at a time. You should be able to ping and browse to the pfSense LAN IP from any LAN device first before attempting to use any package. Always best to troubleshoot with less obstacles. Then once the basic connectivity is working, you can add additional features. Using the pfSense WAN IP in a local Windows Server DNS Forwarder, doesn't look to be a solution.
-
Can anyone help me figure out how to get rid of this?
I got pfblocker running and all setup. But when it blocks stuff I get this big error image.
When I try to go to the domain it shows in the alerts I get that 1x1 image. Why isn't it applying it to the page?
-
Can anyone help me figure out how to get rid of this?
I got pfblocker running and all setup. But when it blocks stuff I get this big error image.
I get that 1x1 image. Why isn't it applying it to the page?
DNSBL pushes a 1x1 pixel image for any blocked domain. So if your viewing a page with ADverts, the Blocked AD is replaced with a hidden 1x1 image so that you don't see a big blocked image. But if the whole site your visiting is blocked completely by DNSBL, you will see the image that you show. Its a normal behavior.
-
I went back and did what you said. LAN devices point to the windows server and the MS DNS forwarder was set to the pfsense LAN interface IP. DNSBL did not filter. I troubleshot it and got it to work by using the pfsense WAN interface IP. While everything is working now with DNSBL filtering traffic, I can't ping the LAN interface IP or access the webgui when on the LAN subnet.
I would start by disabling DNSBL and fixing one issue at a time. You should be able to ping and browse to the pfSense LAN IP from any LAN device first before attempting to use any package. Always best to troubleshoot with less obstacles. Then once the basic connectivity is working, you can add additional features. Using the pfSense WAN IP in a local Windows Server DNS Forwarder, doesn't look to be a solution.
Thanks! I stripped down everything to just a basic install and one by one added the necessary settings. Now it is working properly. Workstations point to the windows server, and the MS DNS forwarder points to the LAN IP of my pfsense box. It's all working properly for this remote office now.
-
Hi everybody,
I need some help with pfBlockerNG and squid on the same pfsense machine. (Additional packages snort)
I installed and configured the pfblockerng package, downloaded som DNSBL. Then for testing I pasted some of the URLs into my browser to test and then it redirects me to the pfsense WebUI but not to the 1x1 pixel web page. Further I do not get any Alert in the pfblocker alers tab.
I am not sure if it is relevant but I am running squid (http + https) on the same pfsense machine with Auto Proxy configuration configured on my client.
In pfblockerng I added 10.123.123.123 als the virtual IP. I do not use this IP or subnet somewhere on my network. When I enter 10.123.123.123 in my browser I am redirected to the pfsense WebUI. When I enter the NATed IP 10.123.123.123:8081 I got the 1x1 pixel picture.
My pfsense has two interfaces - one interface for WAN (192.168.178.0/24) and another interface for LAN (192.168.10.0/24).
So my questions are:
1. Why is it redirecting me to the WebUI when entering a URL / domain which ins in DNSBL instead of redirecting me to the NAted IP address with 1x1 pixel
2. When I use https://10.123.123.123:443 the connection times out, when I try to access https://10.123.123.123.8443 the proxy tells my "access denied".
3. No matter what I access I can see any alerts.I really appreciate any help and/or suggestions