PfBlockerNG v2.0 w/DNSBL
-
Here is a PR to fix the Installation issue being reported…
https://github.com/pfsense/pfsense-packages/pull/1189
Once this is merged, if anyone has similar issues, please report back. Thanks!
-
If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver
-
Thanks BBcan177, and everyone that made this package possible. Great jpb.
If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver
Can you elaborate? I have multi-wan and forwarding disabled and everything works.
-
Latest PR merged.
-
There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.
Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate? I'd like to thank you, you have no idea I've been trying to block ads on my wireless devices and had been trying to do this on an Asus RT-68U (AP mode) with both tomato and merlin and was having issues. PfBlockerNG 2.0 has solved this issue for me, I no longer have to mess around with the Asus router and don't have to worry bout getting ads on my sons ipad/pc. I added a feed from http://winhelp2002.mvps.org/hosts.htm would this work for host files as well? In the log it does seem to have downloaded the .txt file (see attached screenshot) Thanks again BBcan177 for your work!
-
Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)- Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"
hpHosts
http://hosts-file.net/download/hosts.zipSWC
http://someonewhocares.org/hosts/hostsspam404
https://spam404bl.com/blacklist.txt
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txtmalc0de
https://malc0de.com/bl/BOOTMDS (use 'Flex' state)
https://mirror1.malwaredomains.com/files/justdomainsMVPS
http://winhelp2002.mvps.org/hosts.txtMDL
http://www.malwaredomainlist.com/hostslist/hosts.txtDiscontinued
GJTech
http://adblock.gjtech.net/?format=unix-hostsdShield_SD (They also have a conservative list available)
https://www.dshield.org/feeds/suspiciousdomains_High.txtZeus
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist- These two feeds post full URLs, so there can be some more false positives.
Create a new Alias, and use Alexa as a recommendation.
PhishTank
https://data.phishtank.com/data/online-valid.csv.bz2OpenPhish
https://www.openphish.com/feed.txtMPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
https://lists.malwarepatrol.net-
This is a feed that I manage (as time permits)
MS_2
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw -
Use this in its own Alias:
BBC_DGA (This is a large feed of DGA for the likes of Cryptolocker et al…)
http://osint.bambenekconsulting.com/feeds/dga-feed.gzBBC_C2
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt- Use this feed in its own alias as it is updated more frequently.
So you can update it more often than once per day.
hpHosts_partial
http://hosts-file.net/hphosts-partial.aspIf users find other feeds, please post back so that others may benefit also.
Its also important to donate to the feeds provider (IP and/or Domain) as they all need support. - Create a new alias for these.
-
Here are some basic instructions to get started with DNSBL.
- Open the pfBNG "DNSBL" Tab:
(Use the defaults unless you have a need to use otherwise)
Enter the DNSBL VIP as 10.10.10.1
Enter the DNSBL Listening Port as 8081
Enter the DNSBL SSL Listening port as 8443
Select the DNSBL Listening Interface as LanFor the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.DNSBL IP Firewall Rule Settings:
Select Deny outbound or as per your requirements
select Enable loggingAlexa (is optional, you can skip this until later if you wish)
Select Top 1K
Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.In the Custom List you may enter any domain you wish to Whitelist.
Save your settings
- Open the "DNSBL Feeds" Tab:
Create a new DNSBL Alias
Enter DNS Group Name as ADs
Enter Description as DNSBL ADvertsDNSBL:
Enter the Header/Label and Source URL as follows:
(Use copy/paste as plain text for the URL)Format Auto and State ON
yoyo
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintexthpHosts_ads
http://hosts-file.net/ad_servers.txtAdaway
https://adaway.org/hosts.txtCameleon
http://sysctl.org/cameleon/hostsSelect List Action as Unbound
Select Update Frequency as Once a dayAlexa:
Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.Add any other domains that you wish to block in the Custom List.
Save your settings
- Open the "DNSBL" Tab:
Click DNSBL Enable checkbox.
Save your settings- Open the "Update" Tab:
Select Force Update
You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.
- Goto the pfBlockerNG "Alerts" Tab:
Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.
As a test, goto www.aol.com and www.yahoo.com and see some alerts populate.
There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.
Have been using the beta code for some time and noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter.
popcash.net www.popcash.net outbrain.com www.outbrain.com onclickads.net www.onclickads.net googleadservices.com www.googleadservices.com adcash.com www.adcash.com popads.net www.popads.net
To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
-
There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.
Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?
Thanks again BBcan177 for your work!
I could use a lifetime pfSense Gold subscription… :) But I think all developers should get that as a bonus :)
My email is at the bottom of the pfBNG general tab.
-
There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.
Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?
Thanks again BBcan177 for your work!
I could use a lifetime pfSense Gold subscription… :) But I think all developers should get that as a bonus :)
My email is at the bottom of the pfBNG general tab.
:o lifetime ? That would be $99 x how many ever years you have left ;D :P so is the email there attached to a paypal account? Not sure if donation talk is allowed on forum if not, I apologize mods. Also , It does seem to be working for host files from http://winhelp2002.mvps.org/hosts.htm Thanks!
-
Can you elaborate? I have multi-wan and forwarding disabled and everything works.
If you enable forwarding mode then a foward-zone named "." is created as well as some forward-addr entries with the DNS servers you sepcified system->general setup.
Default behavior of unbound is to query the Root servers. But if you have a multi-WAN configuration and need to specifiy a different DNS server for each WAN(gateway) you need forwarding mode to be enabled. So yeah, works without forwarding mode for some multi-WAN configs that are fine with just the Root servers. -
BBCan177,
Any problems running your list import script on PFB 2.0? -
Few things I found out while beta testing V2
- First rule is take your time and be patient. Adding to may rules at once will casue alot of blocks you may or may not way. Wildcards are not supported, or wanted in most cases. For example adding google.com does not filter all the hosts for the domain, need to add each host that is being blocked to the filter lists
- Make sure to double check ASN's, especially for large companies that have acquired other companies, more than one ASN might exist
*** Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed, em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload. They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly. - Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum. I added all my hosts host to unbound statically as a work around
- I wanted to have my allow rules > pfb block rules > my block rules > my per interface rules. Did this by enabling "Floating Rules" and using "pfb_pass/match | pfsense pass/match | pfb_block/reject"
- If you have WIFI make sure to enable "DNSBL Firewall Rule" and select both LAN and WIFI or the NAT: Port Forward rule for 10.10.10.1 is not setup correctly. If you don't change this setting things still work but everything runs slow over wifi.
- Make sure to whitelist all the DNSBL sites FQDN via an allow aliases, some IPv4 block-lists include the IP space the DNSBL are found in
- DBSBL is basicly a man in the middle for DNS so any site that is block but running https will create warrnings. Depending on how the brower is setup it might just ignore or not display the error. CTRL+SHIFT+I on both Chrome and Firebox will bring up dev panel where you can see which pages are not loading. Chrome will show an error, Firefox will show a red slash throught the lock icon.
- Noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter. To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
popcash.net www.popcash.net cdn.popcash.net outbrain.com www.outbrain.com onclickads.net www.onclickads.net googleadservices.com www.googleadservices.com adcash.com www.adcash.com popads.net www.popads.net popmyads.com www.popmyads.com
- List of domains added to DNSBL Custom Domain Suppression to stop them from being blocked
goo.gl google.com www.google.com mail.google.com docs.google.com sites.google.com fonts.googleapis.com cache.google.com clients.google.com clients0.google.com clients1.google.com clients2.google.com clients3.google.com clients4.google.com clients5.google.com clients6.google.com clients7.google.com clients8.google.com clients9.google.com www.maxmind.com s3.amazonaws.com fls-na.amazon.com login.live.com redis.io pgl.yoyo.org someonewhocares.org www.thingamajob.com winhelp2002.mvps.org hosts-file.net www.hosts-file.net adaway.org sysctl.org adblock.gjtech.net www.dshield.org malwaredomainlist.com malwaredomains.com bambenekconsulting.com malwarepatrol.net zeustracker.abuse.ch malc0de.com curl.haxx.se dl.dropboxusercontent.com whois.cymru.com github.com collector-cdn.github.com pivotal.github.com cloud.github.com raw.githubusercontent.com raw.github.com stopforumspam.com www.stopforumspam.com sourceforge.net www.sourceforge.net iweb.dl.sourceforge.net chase.com www.chase.com mint.com www.mint.com americanexpress.com www.americanexpress.com online.americanexpress.com linuxquestions.org www.linuxquestions.org optimizely.com www.optimizely.com api.optimizely.com cdn.optimizely.com cdn2.optimizely.com cdn3.optimizely.com slashdot.org www.slashdot.org ebay.com www.ebay.com rover.ebay.com srx.main.ebayrtm.com openbl.org www.openbl.org www.us.openbl.org delta.com www.delta.com aa.com www.aa.com cruisesonly.com www.cruisesonly.com ripe.net www.ripe.net weather.com www.weather.com lacnic.net www.lacnic.net tvrage.com services.tvrage.com www.tvrage.com publicbt.com device.maxmind.com www.boingo.com xda-developers.com www.xda-developers.com forum.xda-developers.com opengapps.org download.mono-project.com
-
Ads DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: NOT Enabled
-
Add Custom Block List noted above
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintextoup yoyo http://hosts-file.net/ad_servers.txt hphosts_ats https://adaway.org/hosts.txt adaway http://sysctl.org/cameleon/hosts syctrl http://adblock.gjtech.net/?format=unix-hosts gjtech
-
Privacy Fraud DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt disconnect_basic http://hosts-file.net/fsa.txt hphost_fsa http://hosts-file.net/hjk.txt hphost_hjk http://hosts-file.net/pha.txt hphost_psh https://www.dshield.org/feeds/suspiciousdomains_High.txt dshield_sdh
-
Malware Exploit DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt disconnect_malvertising http://www.malwaredomainlist.com/hostslist/hosts.txt malwaredomainlist http://mirror1.malwaredomains.com/files/justdomains malwaredomains https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt disconnect_malware http://hosts-file.net/emd.txt hphosts_emd http://hosts-file.net/exp.txt hphosts_exp http://hosts-file.net/mmt.txt hphosts_mmt https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian malwarepatrol https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist zeustracker https://malc0de.com/bl/BOOT malc0de
-
SPAM DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
http://hosts-file.net/grm.txt hphost_grm http://hosts-file.net/hfs.txt hphost_hfs https://spam404bl.com/blacklist.txt spam_404
-
Malicious DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
http://hosts-file.net/hphosts-partial.txt hphost_partial http://winhelp2002.mvps.org/hosts.txt mvps_hosts http://someonewhocares.org/hosts/hosts SomeoneWhoCares https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw BBcan177
-
BambenekConsulting DNS Group
-
Update Frequency: Once a Day
-
Enable Alexa Whitelist: Enabled
http://osint.bambenekconsulting.com/feeds/dga-feed.gz bambenek_dga http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt bambenek_c2
Thanks
Tony M.** -
BBCan177,
Any problems running your list import script on PFB 2.0?This scripted worked without an issue for me.
-
Oops! I found ZeuS Tracker is shut down, I hope it is only temporary.
-
Can you elaborate? I have multi-wan and forwarding disabled and everything works.
If you enable forwarding mode then a foward-zone named "." is created as well as some forward-addr entries with the DNS servers you sepcified system->general setup.
Default behavior of unbound is to query the Root servers. But if you have a multi-WAN configuration and need to specifiy a different DNS server for each WAN(gateway) you need forwarding mode to be enabled. So yeah, works without forwarding mode for some multi-WAN configs that are fine with just the Root servers.Thank you.
-
I am receiving certificate invalid errors after enabling the DNSBL when navigating certain sites - so far the culprit seems to mainly be googleads.g.doubleclick.net when trying to serve content over an HTTPS enabled website.
The attempt still shows in the Alerts tab of pfBlockerNG, the main site still loads, but it seems to be wanting to use the firewall's self signed certificate as the certificate for the ad server host.
Did I miss a setting somewhere to prevent this from happening?
-
There's no such setting anywhere and no way to prevent this from happening really, except for whitelisting the domain.
-
To a certain extent, this isn't surprising. pfBlockerNG essentially has to Man-in-the-Midde HTTPS. If the ad is being loaded from an HTTPS server (I don't necessarily mean the page you're viewing, rather where the ad itself is coming from), then pfBlockerNG redirects you to its own little webserver running on your pfsense box, and, since is done over HTTPS, that webserver uses a generic, default certificate. It's a different cert than what is used for the pfsense WebGUI. For various reasons, pfBlockerNG uses the same certifcate for every blocked HTTPS resource. This creates a problem because the name in the certificate doesn't match the domain name of the blocked resource, which is why you see certificate warnings. There's no good way around this, though. Attempting to dynamically create valid certs off a CA running on the pfsense box would be both complicated and slow.
But, I'm a little surprised you're seeing warnings. I used to see warnings occasionally, but I haven't for a while. I thought browsers just started silently dropping HTTPS connections to external resources when there's a bad certificate.
Can you provide additional information to reproduce this? What browser are you using? What webpage were you accessing? If I can see an example, and maybe inspect a packet capture and page source code may be I can see what's going on.
-
What about setting your virtual address to 0.0.0.0? As that whole /8 is non-routable, you wouldn't get the cert error. It would just silently fail to load ads.
-
What about setting your virtual address to 0.0.0.0? As that whole /8 is non-routable, you wouldn't get the cert error. It would just silently fail to load ads.
While that might hide the cert error, there would be downsides. First, some some pages will hang as they wait for the ad server to respond. Second, blackholing the traffic completely by setting the VIP to something other than the DNSBL webserver will disable alerts. That would create problems, because the regular ad-blocking lists WILL break some sites and mobile apps. The alerts are, by far, the easiest way to track down problems.
There are better plausible workarounds, but we need to see some examples to understand under what circumstances people run into cert errors.
-
Sorry if this is stupid question. I am using OpenDNS and wondered if I can use DNSBL along with it? The only way I was able to get alert data was by changing the DNS settings on my PC.
Thanks.
-
Sorry if this is stupid question. I am using OpenDNS and wondered if I can use DNSBL along with it? The only way I was able to get alert data was by changing the DNS settings on my PC.
Not in this way. If you point your clients to pfSense as DNS server and use OpenDNS as forwarders for Unbound, then yes it should work.
-
I am receiving certificate invalid errors after enabling the DNSBL when navigating certain sites - so far the culprit seems to mainly be googleads.g.doubleclick.net when trying to serve content over an HTTPS enabled website.
The attempt still shows in the Alerts tab of pfBlockerNG, the main site still loads, but it seems to be wanting to use the firewall's self signed certificate as the certificate for the ad server host.
Did I miss a setting somewhere to prevent this from happening?
Ya ran into the same problem while beta testing, completely forgot about this issue until I read your post :) For a quick fix I created a CA and web certificate via pfsense GUI then copies this cert to /var/unbound/dnsbl_cert.pem which dnsbl light http will use. Then push out the CA to all the desktops, could be done via GPO or login scripts. With https://letsencrypt.org/ picking up traction, everything is going to be running over TLS or SSL soon going to have to implement this type of fix.
**EDIT: Sorry guys did a bad job on this post and what I was doing, it does not fix the underlying issue with the TLS stream being bad because the cert is not valid, reggie14 did a much better job testing this than I. In my setup is simply helped limit the errors in Chrome. Again just a quick fix that might help. Again sorry for the confusion.
FYI the update from Chrome 45 to 46 made a difference in what come up under security warnings:
http://arstechnica.com/information-technology/2015/10/chrome-finally-kills-off-the-http-https-mixed-content-warning/**Thanks
Tony M -
Getting this EasyList error for w/o elements.
[ DNSBL_EasyList - w/o Elements ] Download FAIL
Could not determine IP address of host.
Firewall and/or IDS are not blocking download. -
Getting this EasyList error for w/o elements.
[ DNSBL_EasyList - w/o Elements ] Download FAIL
Could not determine IP address of host.
Firewall and/or IDS are not blocking download.Well that's not a package error. You need working DNS. :D
$ host easylist-downloads.adblockplus.org easylist-downloads.adblockplus.org has address 148.251.139.76 easylist-downloads.adblockplus.org has address 144.76.100.145 easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:200:114f::2 easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:192:7126::2
-
Getting this EasyList error for w/o elements.
[ DNSBL_EasyList - w/o Elements ] Download FAIL
Could not determine IP address of host.
Firewall and/or IDS are not blocking download.Well that's not a package error. You need working DNS. :D
$ host easylist-downloads.adblockplus.org easylist-downloads.adblockplus.org has address 148.251.139.76 easylist-downloads.adblockplus.org has address 144.76.100.145 easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:200:114f::2 easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:192:7126::2
Filter out easylist-downloads.adblockplus.org via DNSBL as well as add it to an allow alias and see if this helps. Depending out how you having things setup could be blocking. Host lookup most likely works because it's doing is via unbound. Just a thought let us know :)
Tony M
-
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.
I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?
-
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.
I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?
dnsbl show as stopped is not a good sign, are you sure dnsbl check box is enabled as well as unbound (DNS Resolver)?
-
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.
I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?
dnsbl show as stopped is not a good sign, are you sure dnsbl check box is enabled as well as unbound (DNS Resolver)?
Yes, both dnsbl and unbound check box's are checked. The funny thing is that it blocks the ad's when enabled, but doesn't seem to use the 1x1 gif and instead just times out the servers.
-
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.
I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?
dnsbl show as stopped is not a good sign, are you sure dnsbl check box is enabled as well as unbound (DNS Resolver)?
Yes, both dnsbl and unbound check box's are checked. The funny thing is that it blocks the ad's when enabled, but doesn't seem to use the 1x1 gif and instead just times out the servers.
If the dnsbl web server is not running this is what I would expect, request will not have a response and will time out. Anything in /var/log/pfblockerng/dnsbl_error.log and dnsbl.log files?
-
The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.
-
The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.
Got it working by completely removing the package and settings and reinstalling, removing settings was the key though no idea what was wrong. Now it starts as it should.
-
Upgraded to 2.0, now always see the yellow sign on the status page with the following tooltip:
pfBlockerNG deDuplcation is out of sync. Perform a Force Reload to correct.
Tried Force Reload, Update, Cron, selecting/de-selecting deduplication is settings - nothing helps.
This warning goes off only if deduplication is disabled. -
Host lookup most likely works because it's doing is via unbound. Just a thought let us know :)
Well, it's not. Also not blocked, otherwise it'd be resolved to the DNSBL VIP.
Tried Force Reload, Update, Cron, selecting/de-selecting deduplication is settings - nothing helps.
This warning goes off only if deduplication is disabled.Probably easier to just wipe the lists:
rm -rf /var/db/pfblockerng/
Reinstall the package and run 'Force Update' after that.
-
I am receiving certificate invalid errors after enabling the DNSBL when navigating certain sites - so far the culprit seems to mainly be googleads.g.doubleclick.net when trying to serve content over an HTTPS enabled website.
@Atlan, As indicated in reggie14's post, if you can reply back with the following questions below and we can go from there.
Can you provide additional information to reproduce this? What browser are you using? What webpage were you accessing? If I can see an example, and maybe inspect a packet capture and page source code may be I can see what's going on.
The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.
Got it working by completely removing the package and settings and reinstalling, removing settings was the key though no idea what was wrong. Now it starts as it should.
If there are errors starting/stopping the DNSBL service, those will be logged to the pfSense System log. The RC file for the DNSBL service is here (/usr/local/etc/rc.d/dnsbl.sh [stop|start|restart])
The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.
The dnsbl_error.log is actually an error log for DNSBL Lighttpd. I will be renaming this file to something else to avoid this confusion. This log is used to collect any HTTPS alerts from the Lighttpd conditional error process (debug.log-condition-handling option).
Upgraded to 2.0, now always see the yellow sign on the status page with the following tooltip:
This warning indicates that the masterfile is out of sync with the files in the /deny folder. This is a new feature that was added to v2.0 to warn users about this issue. Usually running a 'Force Reload' is sufficient to fix that warning; however, clearing out all the files and starting fresh might be needed in certain conditions. If this is still an issue, please review the pfblockerng.log file for other clues.
Probably easier to just wipe the lists:
rm -rf /var/db/pfblockerng/
Reinstall the package and run 'Force Update' after that.
Can also just uncheck 'Keep Settings' and Disable 'pfBNG' and 'Save' which will do the same :)
Getting this EasyList error for w/o elements.
[ DNSBL_EasyList - w/o Elements ] Download FAIL
Could not determine IP address of host.
Firewall and/or IDS are not blocking download.Well, it's not. Also not blocked, otherwise it'd be resolved to the DNSBL VIP.
I will be adding another validation on failed downloads to check if the 'Host Address' returns as the DNSBL VIP address (Meaning DNSBL is blocking the download), and adding that to the Error Response. But yes, if the error is "Could not determine IP address of host.", then there was another issue with the DNS lookup that failed. If DNSBL was blocking this download, that error message would not be displayed.
-
'If there are errors starting/stopping the DNSBL service, those will be logged to the pfSense System log. The RC file for the DNSBL service is here (/usr/local/etc/rc.d/dnsbl.sh [stop|start|restart])'
I didn't see anything logged in my system log to help me identify my problem. Luckily I saw your post - :)
My DNSBL service won't start. When I attempt to start it from command line it comes back with:
[2.2.5-RELEASE][root@cerberus.home]/root: /usr/local/etc/rc.d/dnsbl.sh start 2015-11-22 12:06:31: (network.c.542) SSL: BIO_read_filename('/var/unbound/dnsbl_cert.pem') failed
when I dive into 'var/unbound/' there is no 'dnsbl_cert.pem' file.
I would rather not lose all of my settings to reinstall the package. I've already tried this with the box checked 'keep settings' but it still didn't let the service start. Is there a way to get the file 'dnsbl_cert.pem' or a way to backup my settings and reapply them after I completely wipe the package?
thank you!
;D
-
Is there a way to get the file 'dnsbl_cert.pem' or a way to backup my settings and reapply them after I completely wipe the package?
If you run 'Force Update' that pem file should be automatically created.
-
Just did a 'force update' and it still didn't create the 'dnsbl_cert.pem' file. ..and I do have 'Enable DNSBL' checked.
from the log viewer:
http://pastebin.com/HbA3ZRiK
Thanks
-
It looks like Cron was running in the background when you pressed "Save"… This was in the log:
** DNSBL Disabled **
Try another 'Force update'. You also have to change the 'State' to 'Flex' for some of those lists that are failing.
Also Toasted Spam has this URL
http://toastedspam.com/denyAlso put 'StopForumSpam' into its own Alias and set the frequency to 'Once per day', as that List is rate-limiting connections.
-
Okay - I uncheck the 'enable DNSBL' box, saved it & then rechecked it. Saved it again, all while I made sure CRON was not running.
I also made the changes you suggested, thanks! :D
log: http://pastebin.com/jHQnF1qH
it still tells me
DNSBL Disabled