PfBlockerNG v2.0 w/DNSBL

josywong

@josywong:

how to de-duplicate for certain ipv4 list only?

If you enable "de-duplication" all of the Aliases that are set as "Deny" will be de-duplicated.

If you want to have an Alias bypass de-duplication, you can use the "Alias Native" format and manually create the firewall rule accordingly.

thanks for pointing it out. i think i did read the exact thing as described.

gesture1968

Hi,

After upgrading to 2.0.14 I'm still experiencing a lot of errors related to the blocklists:

There were error(s) loading the rules: /tmp/rules.debug:344: macro 'pfB_DNSBLIP' not defined - The line in question reads [344]: block in log quick on $WAN reply-to ( em1 x.x.x.x ) inet from $pfB_DNSBLIP to any tracker 1770008414 label "USER_RULE: pfB_DNSBLIP auto rule"

There were error(s) loading the rules: /tmp/rules.debug:328: macro 'pfB_DNSBLIP' not defined - The line in question reads [328]: block in log quick on $WAN reply-to ( em1 x.x.x.x ) inet from $pfB_DNSBLIP to any tracker 1770008442 label "USER_RULE: pfB_DNSBLIP auto rule"

There were error(s) loading the rules: /tmp/rules.debug:39: cannot load "/var/db/aliastables/pfB_PRI3.txt": No such file or directory - The line in question reads [39]: table persist file "/var/db/aliastables/pfB_PRI3.txt"

If I do a forced reload of the DNSBL, most errors are gone, but they keep coming back, especially after an update of the rules. It seems to have started after I did the first update after the version that came with the pfsense 2.3 package…

Hope this can be fixed!

using the latest pfsense 2.3, pfBlockerNG 2.0.14 with DNSBL, two servers in a CARP failover configuration (but not syncing pfBlockerNG, if I do that the IP address of the DNSBL is duplicated leading to other errors)

Thanks BBCan177, but I've found the problem :-[. In the aliastable it is mentioned that you can use FQDNs, so in my wisdom to suppress the maildomains from google.com and outlook.com I'd filled them in as aliasses. During the assembly of the updated files, your script tries to remove the entries in the pfblockerng suppresslist from the selected blocklists, but since it does not understand the FQDN, an error was reported and the list was erased, ending up being empty (this all happens after the 'emptyfiles' check). That resulted in the errors. Perhaps in your script you could check for invalid entries in the table and skip them, in stead of erasing the list…

Greetings,
Gesture.

gesture1968

Hi BBcan177,

Would it be possible to have PFBlockerNG use CARP vIP's as DNSBL IP address, since now I have to disable the sync between two servers due to the syncing and therefore duplication of the address. Using two identical addresses leads to errors in the logging, and possibly unwanted/unexpected behaviour.

Greetings
Gesture.

mbaran

Is there a way to avoid this issue? I am seeing it on Firefox and Chrome when visiting Youtube.com

I've verified that both my local dns and chrome dns cache have been cleared.

virusbcn

Hello, i have one question because i try to make it but i'm not sure if it's possible with pfblockerng…

I want permit only acces to my country in some rules nat, i explain .... only from my country can i access to typical NAT 110-> mail server or 3389->TS , i view in pfblocker i can block only from my country to -> LAN, but i'm only restrict this rules NAT, in rule NAT i view from "source" but only can i put ip or alias, how can i make "alias" to my "country ips" ????

Thank you

BBcan177

@gesture1968:

Would it be possible to have PFBlockerNG use CARP vIP's as DNSBL IP address

I had a user ask for this several months ago, and I have a draft update to the code that I need tested. (I don't have an appropriate test environment for CARP myself).

So if you are interested to test it, please send me a PM. The other user has fallen off the face of the planet ;)

BBcan177

@mbaran:

Is there a way to avoid this issue? I am seeing it on Firefox and Chrome when visiting Youtube.com

Anything that is blocked is logged to the "Alerts Tab"… You can suppress domains that are FPs... You can also hit "F12" in the browser and goto "Dev Mode"... goto "Console" and see what errors are happening. This will help you figure out the domains that are being blocked...

BBcan177

@virusbcn:

I want permit only acces to my country in some rules nat, i explain …. only from my country

Hi virusbcn,

You can create a new Alias, and set the Format as one of the "Alias" types and reference this in your Rules… An Example: https://forum.pfsense.org/index.php?topic=102071.0

pfcode

After enable the OpenVPN interface, I don't see auto rules for OpenVPN neither at Floating rule nor at OpenVPN tab.

I only see the rules that were created by enabling the Floating Rules option. Are they the same?

Edit: Thanks for BBCan77's explanation:

when using "Floating Rules", By enabling OpenVPN interface, it auto selects the OpenVPN interface in each pfBNG floating rule.

josywong

@josywong:

@BBcan177:

@josywong:

how to de-duplicate for certain ipv4 list only?

If you enable "de-duplication" all of the Aliases that are set as "Deny" will be de-duplicated.

If you want to have an Alias bypass de-duplication, you can use the "Alias Native" format and manually create the firewall rule accordingly.

thanks for pointing it out. i think i did read the exact thing as described.

i got few more questions regarding de-duplication.
is the whole "Deny" (deny in,out,both) consider as ONE list or 3 separated lists for de-dup?
what happened to allow list ? do they get de-dup on "Allow" list?
thanks in advance

rsaanon

Hello folks.

Are there any detailed/comprehensive "pbBlockerNG v2.0 w/ DNSBL" guides out there? I've done some basic configuration, but would like details on all aspects of the pfBlockerNG configuration.

pfcode

HI, BBCan77

Found 2 issues with pfSense 2.3.1, one of them is bigger, which were all reproducable by changing WAN interface parameters, e.g. tick/untick "Block bogon networks" option, save and apply changes:

dnsbl service is still started, even though both pfBlockerNG and DNSBL are disabled.
the bigger one, the unbound service isn't auto restarted after WAN interface changes are applied if pfBlockerNG and DNSBL are enabled.

heliop100

Hi,

I'm getting this IP 192.99.0.227 (http://coopermult.com.br) blocked.
It's not showing on Alerts, and not match any list.

If I change on "Default Order: | pfB_Block/Reject | All other Rules |" to any other, the IP are unblocked for some seconds and blocked again.

Than I change the Order again and that repeats (maybe pfBlockerNG stops for some seconds while changing the rules order?)

Any idea?

Thanks.

BBcan177

@josywong:

i got few more questions regarding de-duplication.
is the whole "Deny" (deny in,out,both) consider as ONE list or 3 separated lists for de-dup?
what happened to allow list ? do they get de-dup on "Allow" list?
thanks in advance

When you enable dedup, it works for all types of "Deny"… To avoid de-duplication for a specific Alias, you can use "Alias Native" option. De-duplication does not occur for Permit or Match type Aliases.

BBcan177

@rsaanon:

Hello folks.

Are there any detailed/comprehensive "pbBlockerNG v2.0 w/ DNSBL" guides out there? I've done some basic configuration, but would like details on all aspects of the pfBlockerNG configuration.

There is a pfBlockerNG hangout available, if you are a pfSense Gold Member.

BBcan177

@pfcode:

dnsbl service is still started, even though both pfBlockerNG and DNSBL are disabled.

the bigger one, the unbound service isn't auto restarted after WAN interface changes are applied if pfBlockerNG and DNSBL are enabled.

I have a fix for #1 and that will be part of the next release. For #2, I can't reproduce that issue. (If anyone else is having that issue, let me know)

BBcan177

@heliop100:

I'm getting this IP 192.99.0.227 (http://coopermult.com.br) blocked.
It's not showing on Alerts, and not match any list.

Are you sure that "logging" is enabled in the pfBlockerNG aliases?

Try to run these commands from the shell to see if a list contains that IP:

cd /var/db/pfblockerng/deny/

grep "192.99.0.227" *
grep "^192\.99\.0\." *
grep "^192\.99\." *
grep "^192\." * | grep "\/"

pfcode

@BBcan177:

@pfcode:

dnsbl service is still started, even though both pfBlockerNG and DNSBL are disabled.

the bigger one, the unbound service isn't auto restarted after WAN interface changes are applied if pfBlockerNG and DNSBL are enabled.

I have a fix for #1 and that will be part of the next release. For #2, I can't reproduce that issue. (If anyone else is having that issue, let me know)

Thanks. I will try to see how to reproduce it, it could be related to IPv6 thing. What I will do is disable DNSBL, to see if unbound service is working or not (I just had the unbound service stopped for no reason again minutes ago). then I will try to enable DNSBL, and disable IPv6, to see. I will report back.

SanderX

Hi all,

I just registered so first, BBcan177, thanks for making such a great package for pfSense. It's really impressive.

I noticed one little issue, when I add a domain to the Custom Domain Suppression (Whitelist) and # comment after it, it seems to ignore this entry. Did anyone see this before?

e.g.
google.nl » ok
google.nl # dutch google » ignored

BBcan177

Hi SanderX,

Thanks for reporting, I have this scheduled to be fixed in the next release. You can manually edit the file to fix this issue as follows:

Edit /usr/local/www/pfblockerng/pfblockerng_alerts.php LINE #94

And add a space as indicated in red:

Original:
$dnssupp_dat .= "{$dnssupp[0]}{$dnssupp[1]}\r\n";

New:
$dnssupp_dat .= "{$dnssupp[0]} {$dnssupp[1]}\r\n";

Then edit the DNSBL suppression custom list and add a space before each # and Save. Follow that with a Force Reload DNSBL.