PfBlockerNG v2.0 w/DNSBL
-
Alright, thanks both for the help! :)
Well there is one thing. Everytime I open a webpage on the pfsense forum I get a 403 error(see image). I then have to quickly reload that same webpage again to open it. If I wait to long(+-3 seconds) i get the same 403 error. Is this caused by pfBlockerNG?
pfBlocker is the only package I have installed at the moment. If I remember it correctly it started when I installed pfBlocker, but it might as wel be something else.
 -
I can't find the thread, but others have noticed this also… Don't think it has anything to do with the package, as I have seen it myself on my mobile while away from my home. However, I haven't seen the issue in a few weeks...
-
is it possible to whitelist with placeholders?
for example whitelist video.domain.com*
or how would i do that correctly?because i have a domain where videos are not playable and it looks like this -> video.domain.com/abc=43 and the id's always change.
Wildcards don't work in DNSBL Suppression. Needs to be an exact match…
thanks your your feedback
could this be something to add in a future version of pfBlocker? does it make sense anyway?
-
Hi - I'm having some trouble with pfBlockerNG updates when DNSBL is enabled. The update process spikes my CPU to 100% for more than an a hour. I've tried manual updates as well as CRON, but no success in completing the updates. Any thoughts?
**Saving configuration [ 06/23/16 21:16:18 ] …
Adding Unbound Server:Include line... completed
Validating database... completed
Reloading Unbound ... completed
DNSBL update [ 0 ]… completedDNSBL - Adding Unbound custom 'include' option
Saving new DNSBL web server configuration to port [ 8081 & 8443 ]
Saving pfSense config…
VIP address configured. Widget Packet statistics reset.
Restarting Service DNSBL...
UPDATE PROCESS START [ 06/23/16 21:16:30 ]===[ DNSBL Process ]================================================
**Saving configuration [ 06/23/16 21:37:53 ] …
Restarting Service DNSBL...
CRON PROCESS START [ 06/23/16 22:00:00 ]
[ FookEasy ]
Update found
[ FookPriv ]
Update found
UPDATE PROCESS START===[ DNSBL Process ]================================================
-
What spec machine fook? If it's a Pi the likely right, it's it's s top end Xeon then somethings likely wrong. How many lists, de-dupe on etc?
-
I'm running an Intel(R) Celeron(R) CPU N2930 @ 1.83GHz 4 CPUs: 1 package(s) x 4 core(s). I've 8GB ram and 40Gb SDD.
I do have IP4V De-Dupe currently enabled with most of the Top 20 spammer countries selected. I've selected the two default DNSBL EasyList feeds and Top1M Alex sites. Within EasyList I've selected all categories and chosen Unbound as the list action.
Happy to tweak these settings or test any other recommendation.
Thanks!
-
Ive just noticed an annoying bug when pressing save on the Firewall/pfBlockerNG/Edit/IPv4 page if there are any errors all your data gets wiped out :-(
This is an issue with the pfSense pkg_edit.php code… I have been discussing a fix with the Devs... Hope to get it resolved shortly...
-
[quote] Hi - I'm having some trouble with pfBlockerNG updates when DNSBL is enabled. The update process spikes my CPU to 100% for more than an a hour. I've tried manual updates as well as CRON, but no success in completing the updates. Any thoughts? **Saving configuration [ 06/23/16 21:16:18 ] ... Adding Unbound Server:Include line... completed Validating database... completed Reloading Unbound ... completed DNSBL update [ 0 ]... completed ------------------------------------------ DNSBL - Adding Unbound custom 'include' option Saving new DNSBL web server configuration to port [ 8081 & 8443 ] Saving pfSense config... VIP address configured. Widget Packet statistics reset. Restarting Service DNSBL... UPDATE PROCESS START [ 06/23/16 21:16:30 ] From the portion of the log that you posted above, the DNSBL count is "0"... Did you add any DNSBL feeds? Run a [b]top -SH[/b] command from the shell and see whats eating memory... [/quote] -
have you force reloaded on the Update Tab?
I most definitely did. The exclusion list has been sitting in there for months and never worked. I just got motivated to look into why it's not working today.
What kind of Domain are you suppressing?
Can you grep for it:
grep "example.com" /var/db/pfblockerng/dnsbl/*.txt grep "example.com" /var/db/pfblockerng/dnsblalias/*.txtThanks for the response. Sorry it took awhile, I was out on travel and just got back.
OK… I think it might be working but I just have to pay closer attention to it. The issue I was having was with the Walgreens site. Whenever I would refill a prescription, it would hang and a log would get written in the dnsbl alerts. I think the issue is me not adding all the domains that it got redirected to-to that whitelist.
I ended up trying one of the domains that was blocked previously but whitelisted, and it seemed to let me through. So.....I think it's an issue with whitelisting the redirects and not with pfblocker or dnsbl itself.
-
[quote] Hi - I'm having some trouble with pfBlockerNG updates when DNSBL is enabled. The update process spikes my CPU to 100% for more than an a hour. I've tried manual updates as well as CRON, but no success in completing the updates. Any thoughts? **Saving configuration [ 06/23/16 21:16:18 ] ... Adding Unbound Server:Include line... completed Validating database... completed Reloading Unbound ... completed DNSBL update [ 0 ]... completed ------------------------------------------ DNSBL - Adding Unbound custom 'include' option Saving new DNSBL web server configuration to port [ 8081 & 8443 ] Saving pfSense config... VIP address configured. Widget Packet statistics reset. Restarting Service DNSBL... UPDATE PROCESS START [ 06/23/16 21:16:30 ] From the portion of the log that you posted above, the DNSBL count is "0"... Did you add any DNSBL feeds? Run a [b]top -SH[/b] command from the shell and see whats eating memory... [/quote] Hi BBcan177 I added another DNSBL feed and have started the update process. Here is the results from top -SH last pid: 57837; load averages: 1.10, 1.03, 0.69 up 1+21:05:30 18:56:13 202 processes: 6 running, 166 sleeping, 30 waiting CPU: 25.3% user, 0.0% nice, 0.1% system, 0.4% interrupt, 74.2% idle Mem: 380M Active, 2656M Inact, 755M Wired, 668M Buf, 4027M Free Swap: 16G Total, 16G Free PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 32798 root 103 0 220M 33536K CPU0 0 11:35 100.00% php 11 root 155 ki31 0K 64K CPU1 1 43.6H 88.67% idle{idle: cpu1} 11 root 155 ki31 0K 64K RUN 0 42.6H 84.67% idle{idle: cpu0} 11 root 155 ki31 0K 64K CPU2 2 43.7H 71.00% idle{idle: cpu2} 11 root 155 ki31 0K 64K RUN 3 43.7H 63.18% idle{idle: cpu3} 98665 root 20 0 2023M 1872M uwait 1 109:34 1.07% suricata{FlowManagerThre} 55524 clamav 20 0 787M 701M select 2 15:30 0.00% clamd{clamd} 98665 root 20 0 2023M 1872M nanslp 1 13:59 0.00% suricata{suricata} 98665 root 20 0 2023M 1872M uwait 2 13:53 0.00% suricata{Detect2} 98665 root 20 0 2023M 1872M uwait 1 11:40 0.00% suricata{Detect1} 98665 root 20 0 2023M 1872M uwait 3 9:32 0.00% suricata{Detect3} -
I have multiple pfsense firewalls at multiple locations, on various versions. My newest ones are on 2.3.1 release p1, I see there is now a p5. My problem with pfBlocker is that on this newer version, pfblocker is on version 2.0.17 whereas I have an older version of pfsense, version 2.2.5 that has pfblocker 2.0.2. The problem I am having is that the newer pfsense is not offering an update to pfblocker, and I am comparing versions due to a problem with the DNSBL allowing me to sites on the newer pfblocker with the older pfsense but blocking my clients on the newer pfsense with the older pfblocker. Why would it not offer an update to the package for pfblocker?
-
I have multiple pfsense firewalls at multiple locations, on various versions. My newest ones are on 2.3.1 release p1, I see there is now a p5. My problem with pfBlocker is that on this newer version, pfblocker is on version 2.0.17 whereas I have an older version of pfsense, version 2.2.5 that has pfblocker 2.0.2. The problem I am having is that the newer pfsense is not offering an update to pfblocker, and I am comparing versions due to a problem with the DNSBL allowing me to sites on the newer pfblocker with the older pfsense but blocking my clients on the newer pfsense with the older pfblocker. Why would it not offer an update to the package for pfblocker?
I am not actively updating the package for the 2.2.x branch… Just not enough time in the day to support multiple branches... 2.0.17 is only available for 2.3.x. If you are not seeing the new version in the 2.3.x branch, then try to execute a "pkg update -f" command... if your still having issues with that, then try to post in the pfSense "Installation and Upgrade" Threads and see if one of the Devs might have some answers for you...
-
I have multiple pfsense firewalls at multiple locations, on various versions. My newest ones are on 2.3.1 release p1, I see there is now a p5. My problem with pfBlocker is that on this newer version, pfblocker is on version 2.0.17 whereas I have an older version of pfsense, version 2.2.5 that has pfblocker 2.0.2. The problem I am having is that the newer pfsense is not offering an update to pfblocker, and I am comparing versions due to a problem with the DNSBL allowing me to sites on the newer pfblocker with the older pfsense but blocking my clients on the newer pfsense with the older pfblocker. Why would it not offer an update to the package for pfblocker?
I am not actively updating the package for the 2.2.x branch… Just not enough time in the day to support multiple branches... 2.0.17 is only available for 2.3.x. If you are not seeing the new version in the 2.3.x branch, then try to execute a "pkg update -f" command... if your still having issues with that, then try to post in the pfSense "Installation and Upgrade" Threads and see if one of the Devs might have some answers for you...
Okay, that did not work. So the newer pfblocker versions are only available for the older pfsense versions? For your records as well, we see all of our newer pfsense versions not properly logging the DNSBL alerts as well. Maybe we will back date our pfsense versions as the pfblocker is our most important tool.
-
Okay, that did not work. So the newer pfblocker versions are only available for the older pfsense versions? For your records as well, we see all of our newer pfsense versions not properly logging the DNSBL alerts as well. Maybe we will back date our pfsense versions as the pfblocker is our most important tool.
For pfSense 2.2.x, the package version is 2.0.6
For pfSense 2.3.x, the package version is 2.0.17If you are not seeing the package, then you are having some connectivity issues connecting to the pfSense repos.
Typically when DNSBL logging is not working, it's due to configuration issues. Ensure that the LAN devices only have the pfSense Resolver as its DNS server. Ensure that you can ping the DNSBL VIP, and also browse to the DNSBL VIP and get the 1x1 pix.
-
Just one thing I can't get done. Thats blocking those annoying ads on youtube. Is that possible with dnsbl? I use the easylists Cameleon, adaway yoyo and hostfile. I haven't configured ip blocklists yet.
same here. haven't found a way yet.
does somebody tried the blocking lists from example adblock plus addon for firefox/chrome?
would that work?Is working here.
I have a Synology NAS on a remote location (family) with OpenVPN and DNS Server Package installed.
I use a script which uses the yoyo list to block ads when VPNed in. The yoyo list is updated through a scheduled task. Thats working pretty well for quite some time (also for the family).On pfS it didn`t work at first.
With pfBlockerNG/DNSBL I just found the problem to be on the TAB DNSBL Easylist.
When I disabled those it started to work.
I use only the yoyo list on DNSBL Feeds.Hope it helps.
-
I use a script which uses the yoyo list to block ads when VPN`ed in.
how do you do that? can you explain?
-
So I have setup two DNSBL feeds. One for AdBlock and another for Adult sites block. Both feeds work correctly and sites are blocked as appropriate. However I am using the following feed source for Adult sites block.
http://dsi.ut-capitole.fr/blacklists/download/adult.tar.gzThis file is very big and has a lot of hosts defined. When the cron job runs I notice that the update/download of the job is successful but sometimes (almost 50% of the times) the unbound service is stuck on stopped. Due to this all DNS resolutions fail until in go to the webgui and start up the unbound service again.
If I disable the Adult Block feed all is fine and there are not issues after update. Any ideas on what I can do to help figure out the issue?
Thanks
-
I've got pbBlockerNG v2.0.17 using the latest 2.3.1-RELEASE-p5 (i386) on an Alix2d3. Each time I Reboot or unplug the system and even after waiting for half an hour, I still cannot get online. I had to manually Select 'Force' option Run in pfBlockerNG inorder to get back online to the internet.
I use it to block ads only, nothing more and CRON Settings is set to Once a day.
Is it possible to store & restore the block lists from the CF card? And why do I lose Internet access without forcing a cron update? Shouldn't I get Internet access, but without the ad block? Is it because this particular Alix does not have a battery backed up Real-Time Clock (The Alix2D13 added a RTC battery)?
Thanks..
-
I have a Synology NAS on a remote location (family) with OpenVPN and DNS Server Package installed.
I use a script which uses the yoyo list to block ads when VPN`ed in.
The yoyo list is updated through a scheduled task.Hi Pippin,
For OpenVPN, as long as you configure the pfSense DNS servers for the VPN, then DNSBL should filter those DNS resolutions… Shouldn't need to do any other work-arounds...
With pfBlockerNG/DNSBL I just found the problem to be on the TAB DNSBL Easylist.
When I disabled those it started to work.
I use only the yoyo list on DNSBL Feeds.You aren't going to get much filtering with just the yoyo feed by itself. Keep in mind that anything that is blocked is visible in the Alerts Tab (DNSBL window). You can also hit F12 in the Browser and goto "Console" to see whats being blocked.
-
However I am using the following feed source for Adult sites block.
http://dsi.ut-capitole.fr/blacklists/download/adult.tar.gzThat feed has just over 1M domains and the balance (~100k) as IP addresses… I haven't tested it, but its going to tax the system depending on how many domains are in the other DNSBL feeds....
How much memory do you have in the pfSense Box? Can you bump it up?
