PfBlockerNG v2.0 w/DNSBL
-
I have a Synology NAS on a remote location (family) with OpenVPN and DNS Server Package installed.
I use a script which uses the yoyo list to block ads when VPN`ed in.
The yoyo list is updated through a scheduled task.Hi Pippin,
For OpenVPN, as long as you configure the pfSense DNS servers for the VPN, then DNSBL should filter those DNS resolutions… Shouldn't need to do any other work-arounds...
With pfBlockerNG/DNSBL I just found the problem to be on the TAB DNSBL Easylist.
When I disabled those it started to work.
I use only the yoyo list on DNSBL Feeds.You aren't going to get much filtering with just the yoyo feed by itself. Keep in mind that anything that is blocked is visible in the Alerts Tab (DNSBL window). You can also hit F12 in the Browser and goto "Console" to see whats being blocked.
-
However I am using the following feed source for Adult sites block.
http://dsi.ut-capitole.fr/blacklists/download/adult.tar.gzThat feed has just over 1M domains and the balance (~100k) as IP addresses… I haven't tested it, but its going to tax the system depending on how many domains are in the other DNSBL feeds....
How much memory do you have in the pfSense Box? Can you bump it up?
-
I've got pbBlockerNG v2.0.17 using the latest 2.3.1-RELEASE-p5 (i386) on an Alix2d3. Each time I Reboot or unplug the system and even after waiting for half an hour, I still cannot get online. I had to manually Select 'Force' option Run in pfBlockerNG inorder to get back online to the internet.
A few versions ago, I added a feature to backup the /var/unbound/pfb_dnsbl.conf file and restore it on reboot. This is only needed for Nano and RAMDisk installs as on reboot, the /var and /tmp folders are wiped.
The only reason that I can think that would cause unbound not to start, would be that the /var/unbound/pfb_dnsbl.conf file is missing after reboot. Please confirm…
If you open the Resolver GUI config, you will see the following line "server:include: /var/unbound/pfb_dnsbl.conf"... If the file is missing, it will not load and you either need to remove that line in the Adv. field, or run a "Force Update" cmd...
Are you properly shutting down the box, or just pulling the plug?
-
O.T.
@Deadpool:how do you do that? can you explain?
Follow these links for the Synology NAS:
https://forum.synology.com/enu/viewtopic.php?f=39&t=78126&p=310721#p310721
https://synologytweaks.wordpress.com/2015/08/23/use-synology-as-an-ad-blocker -
haven't read everything, but could this also be applied if you don't rock a synology nas?
has anyone tried that?
-
O.T.
@Deadpool:how do you do that? can you explain?
Follow these links for the Synology NAS:
https://forum.synology.com/enu/viewtopic.php?f=39&t=78126&p=310721#p310721
https://synologytweaks.wordpress.com/2015/08/23/use-synology-as-an-ad-blockerI don't think its a good idea to have your NAS provide DNS resolution for your Network.
You are potentially opening yourself up to security implications by doing this…
-
Not sure what thread to post this in
http://someonewhocares.org/hosts/hosts
A good list I have found that is updated. for DNSBL ADVERTS -
I don't think its a good idea to have your NAS provide DNS resolution for your Network.
You are potentially opening yourself up to security implications by doing this…
Appreciate the input.
The NAS is in a remote location and except for OpenVPN its not open to the world. Its my backup target and also provides add blocking DNS over OpenVPN that runs on it. -
Okay, that did not work. So the newer pfblocker versions are only available for the older pfsense versions? For your records as well, we see all of our newer pfsense versions not properly logging the DNSBL alerts as well. Maybe we will back date our pfsense versions as the pfblocker is our most important tool.
For pfSense 2.2.x, the package version is 2.0.6
For pfSense 2.3.x, the package version is 2.0.17If you are not seeing the package, then you are having some connectivity issues connecting to the pfSense repos.
Typically when DNSBL logging is not working, it's due to configuration issues. Ensure that the LAN devices only have the pfSense Resolver as its DNS server. Ensure that you can ping the DNSBL VIP, and also browse to the DNSBL VIP and get the 1x1 pix.
I updated to the newest package of Pfblocker. How do I clear the alerts currently showing, outdated as of July 1st, to see if they repopulate as new alerts?
-
Okay, that did not work. So the newer pfblocker versions are only available for the older pfsense versions? For your records as well, we see all of our newer pfsense versions not properly logging the DNSBL alerts as well. Maybe we will back date our pfsense versions as the pfblocker is our most important tool.
For pfSense 2.2.x, the package version is 2.0.6
For pfSense 2.3.x, the package version is 2.0.17If you are not seeing the package, then you are having some connectivity issues connecting to the pfSense repos.
Typically when DNSBL logging is not working, it's due to configuration issues. Ensure that the LAN devices only have the pfSense Resolver as its DNS server. Ensure that you can ping the DNSBL VIP, and also browse to the DNSBL VIP and get the 1x1 pix.
- Update - I was able to clear the alerts by deselecting the "enable/disable" and "keep settings" boxes, saving, then re-check them. I did get updated log alerts. However, I did not get new ones after that, its as if the log gets full, is that possible? The installation is on a 60gb SSD that is only 6 months old or so now, and previously ran on a 4gb flash drive and lasted for about 2 or 3 years. Not sure if the hardware really has anything to do with the logging not working or not.
-Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?
-
-Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?
The IP Alerts are taken from the pfSense Firewall Logs. So you can clear the firewall log to start fresh.
For DNSBL the log is taken from /var/log/pfblockerng/dnsbl.log
If you are getting sporatic DNSBL logging, ensure that your LAN device(s) only have pfSense as its DNS server, as any other DNS server settings could be round-robin to other DNS servers and will bypass DNSBL.
Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.
-
I don't think its a good idea to have your NAS provide DNS resolution for your Network.
You are potentially opening yourself up to security implications by doing this…
Appreciate the input.
The NAS is in a remote location and except for OpenVPN its not open to the world. Its my backup target and also provides add blocking DNS over OpenVPN that runs on it.You should be able to utilize the pfSense Resolver for your OpenVPN connections (Which will use DNSBL). Just need to set those connections to use pfSense DNS. I am not sure what DNS server is used in your NAS, but you may be opening yourself to cache poisioning and other potential issues.
-
Thanks,
Not sure it belongs in this thread but I should elaborate.
Currently pfS is not in active use except for learning/testing things out.
Attached image shows current setup where the NAS is OVPN server and adblocking DNS server, HOME1-net is with family in another country and HOME2-net is my home, it does not provide DNS for HOME2-net. The Synology DNS server uses bind and provides adblocking DNS for OVPN clients and the HOME1 LAN/WiFi only.you may be opening yourself to cache poisioning and other potential issues.
Curious if that is the case in the current situation, see image, thank you.
You should be able to utilize the pfSense Resolver for your OpenVPN connections (Which will use DNSBL).
Yes, in the new setup pfS will be OVPN/DNS server for HOME2-net, the NAS will become OVPN client for my backup and I thinking about leaving the NAS adblock DNS server for the HOME1-net active, nice for the family.
-
-Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?
The IP Alerts are taken from the pfSense Firewall Logs. So you can clear the firewall log to start fresh.
For DNSBL the log is taken from /var/log/pfblockerng/dnsbl.log
If you are getting sporatic DNSBL logging, ensure that your LAN device(s) only have pfSense as its DNS server, as any other DNS server settings could be round-robin to other DNS servers and will bypass DNSBL.
Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.
DNS is set correctly as suggested already. Looking at the log from the shell is the same.
-
-Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?
The IP Alerts are taken from the pfSense Firewall Logs. So you can clear the firewall log to start fresh.
Clearing the log only clears everything BUT DNSBL
-
-Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?
Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.
I can ping the VIP but cannot get the 1x1 pixel
-
The Synology DNS server uses bind
Well atleast its using a decent DNS Server, just ensure that DNSSEC is enabled… I'm always uneasy about these types of devices running the DNS role... Once you put pfSense into the mix, you could then utilize the pfBlockerNG package to get all the additional features it offers.
-
-Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?
Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.
I can ping the VIP but cannot get the 1x1 pixel
To clear the DNSBL log:
rm /var/log/pfblockerng/dnsbl.logBY any chance do you have an Anti-virus/Firewall pkg on your desktop that might be causing issues… Seen someone who had Avast doing some 'DNS tunneling' and causing issues with DNSBL. Also check your browser Addons... If your not getting the 1x1, then DNSBL won't work as expected...
-
The only thing I have for AV is MS Security Essentials. Tried turning it off and no changes. The list has cleared and is now staying that way.
-
To clear the DNSBL log:
rm /var/log/pfblockerng/dnsbl.logBY any chance do you have an Anti-virus/Firewall pkg on your desktop that might be causing issues… Seen someone who had Avast doing some 'DNS tunneling' and causing issues with DNSBL. Also check your browser Addons... If your not getting the 1x1, then DNSBL won't work as expected...
What could possibly be blocking me to the DNSBL VIP?
