PfBlockerNG v2.0 w/DNSBL

JasonJoel

@JasonJoel:

The rule direction is marked as "OUT". Shouldn't that be "ANY"? I checked and all of my pfBlocker created floating rules are direction "OUT" for some reason…

Did you define the "Adv. In/Outbound settings"? Specifically the "Gateway" setting?

It should normally be left at "default"; at which time, the Floating Rules "Direction" setting is set to "any".

I don't think so… Here are the advanced settings on my country Top 20 alias, which gets created as OUT.

Jason

![7-Advanced Country Block Settings.PNG](/public/imported_attachments/1/7-Advanced Country Block Settings.PNG)
![7-Advanced Country Block Settings.PNG_thumb](/public/imported_attachments/1/7-Advanced Country Block Settings.PNG_thumb)

BBcan177

Can you save each of your pfBlockerNG aliases as I think that tag is missing from your config.

Run this command first and send me the output:

grep "<agateway" conf="" config.xml<="" pre=""></agateway">

JasonJoel

Where do you run the command? Should I SSH in or can I do it from the GUI?

BBcan177

In pfSense: Diagnostics / Command Prompt / Execute PHP Commands

JasonJoel

Ran this:
grep " <agateway" conf="" config.xml<br="">Got this:
Parse error: syntax error, unexpected '"</agateway">

BBcan177

@JasonJoel:

Ran this:
grep " <agateway" conf="" config.xml<br="">Got this:
Parse error: syntax error, unexpected '"<agateway"' (t_constant_encapsed_string)="" in="" tmp="" r6f0tv="" on="" line="" 5<br=""></agateway"'></agateway">

Sorry, use the "Execute Shell Command" box..

JasonJoel

@BBcan177:

@JasonJoel:

Ran this:
grep " <agateway" conf="" config.xml<br="">Got this:
Parse error: syntax error, unexpected '"<agateway"' (t_constant_encapsed_string)="" in="" tmp="" r6f0tv="" on="" line="" 5<br=""></agateway"'></agateway">

Sorry, use the "Execute Shell Command" box..

First time I ran it, it gave me an error.

After I re-saved all of the alias it gave me:
<agateway_in>default</agateway_in>
<agateway_out>default</agateway_out>
<agateway_in>default</agateway_in>
<agateway_out>default</agateway_out>
<agateway_in>default</agateway_in>
<agateway_out>default</agateway_out>
<agateway_in>default</agateway_in>
<agateway_out>default</agateway_out>
<agateway_in>default</agateway_in>
<agateway_out>default</agateway_out>
<agateway_in>default</agateway_in>
<agateway_out>default</agateway_out>

BBcan177

Ok now run a "Force Update" and check your rules to see if "Any" in defined in the direction field… then check the blocking behavior again... I will get a fix out for this tonight... Thanks for reporting...

JasonJoel

@BBcan177:

Ok now run a "Force Update" and check your rules to see if "Any" in defined in the direction field… then check the blocking behavior again... I will get a fix out for this tonight... Thanks for reporting...

After doing a force update the floating rules are now "ANY" and blocking works correctly! Sorry I took so much of your time, but thank you for helping - it does seem like re-saving the alias did the trick.

Jason

BBcan177

The following Pull Request #121 for pfBlockerNG v2.0.12 has been Merged for pfSense v2.3 only.

This version contains an URGENT fix for anyone who uses Floating pfBlockerNG Rules!!

PR also contains other improvements (See link above).

chris4916

@BBcan177:

I don't use Squid, but a quick google search, do you think that "host" should be changed to "url" instead in this line below?

I know this is slightly nitpicking but it has nothing to do with Squid itself but rather the proxy.pac that will help your browser deciding whether access is direct or through proxy ;)

This said, in proxy.pac (or whatever alias), you may look at different kind of information in order to make the "routing" decision.

If goal is to route through proxy (or not) based on IP address or DNS related information, this should implement directive like:
dnsDomainIs(host,…
isInNet(dnsResolve(host)
localHostOrDomainIs(host...

This involves DNS resolution

if goal is to look at URL pattern (not involving DNS resolution) then syntax to be used is:
shExpMatch(url,
url.substring

However, shExpMatch(host, does work too if you match the fqdn part of URL only 8) (although this is quite confusing, I agree)

simby

Hi!

i have error:

There were error(s) loading the rules: /tmp/rules.debug:40: cannot define table pfB_Malicious: Cannot allocate memory - The line in question reads [40]: table persist file "/var/db/aliastables/pfB_Malicious.txt" @ 2016-04-26 07:10:37

and i have 16GB memory on i7

What is the problem?

cmaxwell04

@BBcan177:

@cmaxwell04:

Help please,

I'm having a strage problem in pfsense 2.3. Whenever I enable pfBlockerNG DNSBL it stops DNS Resolver, and I have to start it manually. when I rebot pfsense 2.3 I have to manualy start DNS Resolver. if I desable DNSBL, DNS Resolver will always run automaticaly.

thanks

Hi cmaxwell04,

Can you review the pfblockerng.log and see if there are any error messages in regards to DNSBL. Try to Re-Enable DNSBL, and try to send any relevant error messages… Do you see any errors in the resolver.log or system.log?

After a reboot of the pfsense, DNS Resolver was not running, so I disabled DNSBL and got this error messages.

Notices
Filter Reload

There were error(s) loading the rules: /tmp/rules.debug:214: macro 'pfB_DNSBLIP' not defined - The line in question reads [214]: block return in log quick on $LAN inet from any to $pfB_DNSBLIP tracker 1770009088 label "USER_RULE: pfB_DNSBLIP auto rule" @ 2016-04-26 12:58:40

Crash report begins. Anonymous machine information:

amd64
10.3-RELEASE
FreeBSD 10.3-RELEASE #4 05adf0a(RELENG_2_3_0): Mon Apr 11 19:09:19 CDT 2016 root@factory23-amd64-builder:/builder/factory-230/tmp/obj/builder/factory-230/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors:
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP Stack trace:
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 1. {main}() /etc/rc.update_urltables:0
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 2. process_alias_urltable() /etc/rc.update_urltables:51
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 3. parse_aliases_file() /etc/inc/pfsense-utils.inc:2185
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 4. filesize() /etc/inc/pfsense-utils.inc:1932

Nachtfalke

@chris4916:

@BBcan177:

I don't use Squid, but a quick google search, do you think that "host" should be changed to "url" instead in this line below?

I know this is slightly nitpicking but it has nothing to do with Squid itself but rather the proxy.pac that will help your browser deciding whether access is direct or through proxy ;)

This said, in proxy.pac (or whatever alias), you may look at different kind of information in order to make the "routing" decision.

If goal is to route through proxy (or not) based on IP address or DNS related information, this should implement directive like:
dnsDomainIs(host,…
isInNet(dnsResolve(host)
localHostOrDomainIs(host...

This involves DNS resolution

if goal is to look at URL pattern (not involving DNS resolution) then syntax to be used is:
shExpMatch(url,
url.substring

However, shExpMatch(host, does work too if you match the fqdn part of URL only 8) (although this is quite confusing, I agree)

Hey chris,

thank you for helping with the PAC file. I had alook on the internet and found this:
http://findproxyforurl.com/pac-functions/
but for me this is all quite confusing.

Could you be so kind a create a PAC file which could help with DNSBL and squid?

Lets say we have these IPs:

pfsense LAN-IP: 192.168.10.1 /24
pfsense WAN-IP: 192.168.178.254 /24
DNSBL VIP: 10.123.123.123

Could you show me a PAC file which will make sure that every connection to the internet will be checked against DNSBL?

Don't know if this is "easy" to do but at the moment I am totally confused ;-)

Regards

BBcan177

@simby:

Hi!

i have error:

There were error(s) loading the rules: /tmp/rules.debug:40: cannot define table pfB_Malicious: Cannot allocate memory - The line in question reads [40]: table persist file "/var/db/aliastables/pfB_Malicious.txt" @ 2016-04-26 07:10:37

and i have 16GB memory on i7

What is the problem?

Hi simby,

The package defaults the System / Advanced / Firewall & NAT / "Firewall Maximum Table Entries" to 2million entries… Did you alter that setting? It's not related to the hardware...

If you hover-over this rule in the Firewall Tab, does it show the IPs? Does the widget have a Red Icon in the far right column?

Can you give some more context to the events that led to this error, and what happened after?

Take a look at the pfblockerng.log for additional clues.

BBcan177

@cmaxwell04:

After a reboot of the pfsense, DNS Resolver was not running, so I disabled DNSBL and got this error messages.

Is this a full install or Nano? Do you use RamDisks?

There were error(s) loading the rules: /tmp/rules.debug:214: macro 'pfB_DNSBLIP' not defined - The line in question reads [214]: block return in log quick on $LAN inet from any to $pfB_DNSBLIP tracker 1770009088 label "USER_RULE: pfB_DNSBLIP auto rule" @ 2016-04-26 12:58:40

I have a fix for this issue, and will add that to the next release. In my tests, this is just a warning, and can be discarded. When DNSBL is disabled, check to see if there are any Firewall rules that reference "pfB_DNSBL"…

Crash report begins. Anonymous machine information:

amd64
10.3-RELEASE
FreeBSD 10.3-RELEASE #4 05adf0a(RELENG_2_3_0): Mon Apr 11 19:09:19 CDT 2016 root@factory23-amd64-builder:/builder/factory-230/tmp/obj/builder/factory-230/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors:
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP Stack trace:
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 1. {main}() /etc/rc.update_urltables:0
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 2. process_alias_urltable() /etc/rc.update_urltables:51
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 3. parse_aliases_file() /etc/inc/pfsense-utils.inc:2185
[26-Apr-2016 12:59:13 Africa/Abidjan] PHP 4. filesize() /etc/inc/pfsense-utils.inc:1932

This error message is not related to pfBlockerNG directly, so it could also be from another issue… Do you have any pfSense URL Aliases defined?

Nachtfalke

Hi,

I noticed that resolving DNS takes sometimes several retries. This is one of the URLs in the DNSBL which I tried to resolve 2 time until I got the correct VIP.
Any ideas where to look?

Further I created a new PAC file with the help of some websites on the internet. Tested the PAC file with some "testing" tools I found on the web, too.


function FindProxyForURL(url, host) {

    // Normalize the URL for pattern macthing
    url = url.toLowerCase();
    host = host.toLowerCase();

    // diese Ziel-IPs, Domains oder Hosts gehen DIRECT
    if (shExpMatch(url, "*.microsoft.com/*") ||
        shExpMatch(url, "*.windowsupdates.com/*") ||
        shExpMatch(url, "*ap.bundesbank.de/*") ||
        shExpMatch(url, "*on4u3.buhl.de/*") ||
        shExpMatch(host, "*.local") ||
        shExpMatch(url, "*data-cdn.mbamupdates.com/*"))
    {
    return "DIRECT";
    }

    // If IP of the requested host falls within any of the ranges specified, send direct.
    if (isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||
        isInNet(dnsResolve(host), "172.16.0.0",  "255.240.0.0") ||
        isInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0") ||
        isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0"))
    {
    return "DIRECT";
    }

    // Fuer alle anderen Requests den Proxy zurueckgeben
    return "PROXY 192.168.10.1:3128";
}

Unfortunately DNSBL is still not working. :-/

DNS_not_OK.png_thumb

DNS_OK.png_thumb

f34rinc

Not sure if anyone else saw the pfSense newsletter today ;D the package pfBlockerNG is going to be the topic for this months pfSense Hangout Friday, April 29th, 2016 at 1PM CDT/2PM EDT

BBCan177 will be providing an overview of the package, how-to's, and taking questions from the audience.

This should be really good reference material for anyone looking for a basic setup, overview of how the package works.

Panja

I'm having issues retrieving updates from dshield.org.

In the log I found:


Failed to connect to feeds.dshield.org port 80: Connection refused Retry in 5 seconds...
. cURL Error: 7
Failed to connect to feeds.dshield.org port 80: Connection refused Retry in 5 seconds...
. cURL Error: 7
Failed to connect to feeds.dshield.org port 80: Connection refused Retry in 5 seconds...
.. unknown http status code

I have set up pfBlocker to get updates from:
http://feeds.dshield.org/top10-2.txt

Anyone know why it is failing?

BBcan177

@Panja:

I'm having issues retrieving updates from dshield.org.

I have set up pfBlocker to get updates from:
http://feeds.dshield.org/top10-2.txt

That link loads ok for me…
Change the "State" to "Off" for a day, then re-enable it... Maybe they are rate-limiting you...
Also best to use the "Download Failure Threshold" and set it to say (4).