PfBlockerNG v2.0 w/DNSBL

Deadpool

have you force reloaded on the Update Tab?

wiz561

have you force reloaded on the Update Tab?

I most definitely did. The exclusion list has been sitting in there for months and never worked. I just got motivated to look into why it's not working today.

BBcan177

@wiz561:

@Deadpool:

have you force reloaded on the Update Tab?

I most definitely did. The exclusion list has been sitting in there for months and never worked. I just got motivated to look into why it's not working today.

What kind of Domain are you suppressing?

Can you grep for it:

grep "example.com" /var/db/pfblockerng/dnsbl/*.txt
grep "example.com" /var/db/pfblockerng/dnsblalias/*.txt

hulleyrob

Ive just noticed an annoying bug when pressing save on the Firewall/pfBlockerNG/Edit/IPv4 page if there are any errors all your data gets wiped out :-(

Can you please leave the data so if can be corrected?

Thanks

Rob

Deadpool

is it possible to whitelist with placeholders?

for example whitelist video.domain.com*
or how would i do that correctly?

because i have a domain where videos are not playable and it looks like this -> video.domain.com/abc=43 and the id's always change.

XmickS

Windows is showing the "no internet access" icon when I'm connected to my home network(see image). I noticed that when I disable DNSBL, windows says I do have "internet access". How should I solve this?

Maybe windows does a dns test which gets blocked by the DNSBL.

![No intenet access.png](/public/imported_attachments/1/No intenet access.png)
![No intenet access.png_thumb](/public/imported_attachments/1/No intenet access.png_thumb)
![No intenet access.png](/public/imported_attachments/1/No intenet access.png)
![No intenet access.png_thumb](/public/imported_attachments/1/No intenet access.png_thumb)

RonpfS

Already discussed @BBcan177:

@jycai:

I suppress couple domains and looks like the yellow triangle icon has gone away. Thanks！
Just wondering, is there any other way to solve this issue, like put the local PCs in a white list or something like that?

I think you suppressed: www.msftncsi.com

Recent discussion here:
https://forum.pfsense.org/index.php?topic=111460.msg620939#msg620939

The package doesn't have a built-in whitelist. Its up to the user to decide what to block.

XmickS

Okay thanks for the reply!

I added " www.msftncsi.com/" to the DNSBL supression list and did a "Reload All", but that didn't solve the issue. When I browse to "www.msftncsi.com/" it still gets blocked. I also killed firewall states, disabled and enabled pfblocker and DNSBL. That too didn't work. How should I proceed?

I already had one domain listed in the domain supression list, and that also still gets blocked. Maybe I have some setting wrong?

RonpfS

@XmickS:

Okay thanks for the reply!

I added " www.msftncsi.com/" to the DNSBL supression list and did a "Reload All", but that didn't solve the issue. When I browse to "www.msftncsi.com/" it still gets blocked. I also killed firewall states, disabled and enabled pfblocker and DNSBL. That too didn't work. How should I proceed?

I already had one domain listed in the domain supression list, and that also still gets blocked. Maybe I have some setting wrong?

" www.msftncsi.com/" should be "www.msftncsi.com" without the quotes (")

XmickS

I know :), I just added the quotes to make it more clear to see in my reply.

I also rebooted and that also didn't help.

BBcan177

Add both to the following to the suppress list and run a "Force Reload - DNSBL"

www.msftncsi.com
msftncsi.com

You can run the following to see if a domain is listed:

grep "msftncsi.com" /var/unbound/pfb_dnsbl.conf
grep "msftncsi.com" /var/db/pfblockerng/dnsbl/*.txt
grep "msftncsi.com" /var/db/pfblockerng/dnsblorig/*

BBcan177

@Deadpool:

is it possible to whitelist with placeholders?

for example whitelist video.domain.com*
or how would i do that correctly?

because i have a domain where videos are not playable and it looks like this -> video.domain.com/abc=43 and the id's always change.

Wildcards don't work in DNSBL Suppression. Needs to be an exact match…

XmickS

@BBcan177:

Add both to the following to the suppress list and run a "Force Reload - DNSBL"

www.msftncsi.com
msftncsi.com

You can run the following to see if a domain is listed:
grep "msftncsi.com" /var/unbound/pfb_dnsbl.conf
grep "msftncsi.com" /var/db/pfblockerng/dnsbl/*.txt
grep "msftncsi.com" /var/db/pfblockerng/dnsblorig/*

Only the last command gave an output:```
/var/db/pfblockerng/dnsblorig/ADs_someone.orig:127.0.0.1 msftncsi.com
/var/db/pfblockerng/dnsblorig/ADs_someone.orig:127.0.0.1 www.msftncsi.com

RonpfS

maybe you need to clear the DNS cache on windows side

BBcan177

Hi Xmicks,

The three commands will show:

First grep cmd: If a domain is listed in the DNSBL Blocklist.
Second grep : This will show which Feed has a Blocked Domain
Thirds grep : These are the original files from the Feed…

So you don't have any reference to msftncsi.com in DNSBL....

If its still blocked, clear your browser and OS cache... If you ping it and its still getting the DNSBL IP, then its probably still in your cache....

Can use this to clear the cache from Chrome : chrome://net-internals/#dns

XmickS

Now the domains are surpressed! Don't know why it suddenly worked, because I already had both www.msftncsi.com and msftncsi.com listed. And had forced reload multiple times before.

Nonetheless it workes now :D

BBcan177

@XmickS:

Now the domains are surpressed! Don't know why it suddenly worked, because I already had both www.msftncsi.com and msftncsi.com listed. And had forced reload multiple times before.

Nonetheless it workes now :D

ok Next time you have some more tools to work with :) Any other issues let me know..

XmickS

Alright, thanks both for the help! :)

Well there is one thing. Everytime I open a webpage on the pfsense forum I get a 403 error(see image). I then have to quickly reload that same webpage again to open it. If I wait to long(+-3 seconds) i get the same 403 error. Is this caused by pfBlockerNG?

pfBlocker is the only package I have installed at the moment. If I remember it correctly it started when I installed pfBlocker, but it might as wel be something else.

![403 error.PNG](/public/imported_attachments/1/403 error.PNG)
![403 error.PNG_thumb](/public/imported_attachments/1/403 error.PNG_thumb)

BBcan177

I can't find the thread, but others have noticed this also… Don't think it has anything to do with the package, as I have seen it myself on my mobile while away from my home. However, I haven't seen the issue in a few weeks...

Deadpool

@BBcan177:

@Deadpool:

is it possible to whitelist with placeholders?

for example whitelist video.domain.com*
or how would i do that correctly?

because i have a domain where videos are not playable and it looks like this -> video.domain.com/abc=43 and the id's always change.

Wildcards don't work in DNSBL Suppression. Needs to be an exact match…

thanks your your feedback

could this be something to add in a future version of pfBlocker? does it make sense anyway?