Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG v2.0 w/DNSBL

    pfBlockerNG
    192
    1.1k
    1.3m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • W
      wolfsden3
      last edited by

      @BBcan177:

      @wolfsden3:

      Okay, that did not work. So the newer pfblocker versions are only available for the older pfsense versions? For your records as well, we see all of our newer pfsense versions not properly logging the DNSBL alerts as well. Maybe we will back date our pfsense versions as the pfblocker is our most important tool.

      @wolfsden3

      For pfSense 2.2.x, the package version is 2.0.6
      For pfSense 2.3.x, the package version is 2.0.17

      If you are not seeing the package, then you are having some connectivity issues connecting to the pfSense repos.

      Typically when DNSBL logging is not working, it's due to configuration issues. Ensure that the LAN devices only have the pfSense Resolver as its DNS server. Ensure that you can ping the DNSBL VIP, and also browse to the DNSBL VIP and get the 1x1 pix.

      I updated to the newest package of Pfblocker. How do I clear the alerts currently showing, outdated as of July 1st, to see if they repopulate as new alerts?

      1 Reply Last reply Reply Quote 0
      • W
        wolfsden3
        last edited by

        @BBcan177:

        @wolfsden3:

        Okay, that did not work. So the newer pfblocker versions are only available for the older pfsense versions? For your records as well, we see all of our newer pfsense versions not properly logging the DNSBL alerts as well. Maybe we will back date our pfsense versions as the pfblocker is our most important tool.

        @wolfsden3

        For pfSense 2.2.x, the package version is 2.0.6
        For pfSense 2.3.x, the package version is 2.0.17

        If you are not seeing the package, then you are having some connectivity issues connecting to the pfSense repos.

        Typically when DNSBL logging is not working, it's due to configuration issues. Ensure that the LAN devices only have the pfSense Resolver as its DNS server. Ensure that you can ping the DNSBL VIP, and also browse to the DNSBL VIP and get the 1x1 pix.

        • Update - I was able to clear the alerts by deselecting the "enable/disable" and "keep settings" boxes, saving, then re-check them. I did get updated log alerts. However, I did not get new ones after that, its as if the log gets full, is that possible? The installation is on a 60gb SSD that is only 6 months old or so now, and previously ran on a 4gb flash drive and lasted for about 2 or 3 years. Not sure if the hardware really has anything to do with the logging not working or not.

        -Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          @wolfsden3:

          -Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?

          The IP Alerts are taken from the pfSense Firewall Logs. So you can clear the firewall log to start fresh.

          For DNSBL the log is taken from /var/log/pfblockerng/dnsbl.log

          If you are getting sporatic DNSBL logging, ensure that your LAN device(s) only have pfSense as its DNS server, as any other DNS server settings could be round-robin to other DNS servers and will bypass DNSBL.

          Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @Pippin:

            @BBcan177:

            I don't think its a good idea to have your NAS provide DNS resolution for your Network.

            You are potentially opening yourself up to security implications by doing this…

            Appreciate the input.
            The NAS is in a remote location and except for OpenVPN its not open to the world. Its my backup target and also provides add blocking DNS over OpenVPN that runs on it.

            You should be able to utilize the pfSense Resolver for your OpenVPN connections (Which will use DNSBL). Just need to set those connections to use pfSense DNS. I am not sure what DNS server is used in your NAS, but you may be opening yourself to cache poisioning and other potential issues.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • PippinP
              Pippin
              last edited by

              Thanks,

              Not sure it belongs in this thread but I should elaborate.
              Currently pfS is not in active use except for learning/testing things out.
              Attached image shows current setup where the NAS is OVPN server and adblocking DNS server, HOME1-net is with family in another country and HOME2-net is my home, it does not provide DNS for HOME2-net. The Synology DNS server uses bind and provides adblocking DNS for OVPN clients and the HOME1 LAN/WiFi only.

              you may be opening yourself to cache poisioning and other potential issues.

              Curious if that is the case in the current situation, see image, thank you.

              @BBcan177:

              You should be able to utilize the pfSense Resolver for your OpenVPN connections (Which will use DNSBL).

              Yes, in the new setup pfS will be OVPN/DNS server for HOME2-net, the NAS will become OVPN client for my backup and I thinking about leaving the NAS adblock DNS server for the HOME1-net active, nice for the family.

              oldsetup1.jpg
              oldsetup1.jpg_thumb

              I gloomily came to the ironic conclusion that if you take a highly intelligent person and give them the best possible, elite education, then you will most likely wind up with an academic who is completely impervious to reality.
              Halton Arp

              1 Reply Last reply Reply Quote 0
              • W
                wolfsden3
                last edited by

                @BBcan177:

                @wolfsden3:

                -Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?

                The IP Alerts are taken from the pfSense Firewall Logs. So you can clear the firewall log to start fresh.

                For DNSBL the log is taken from /var/log/pfblockerng/dnsbl.log

                If you are getting sporatic DNSBL logging, ensure that your LAN device(s) only have pfSense as its DNS server, as any other DNS server settings could be round-robin to other DNS servers and will bypass DNSBL.

                Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.

                DNS is set correctly as suggested already. Looking at the log from the shell is the same.

                1 Reply Last reply Reply Quote 0
                • W
                  wolfsden3
                  last edited by

                  @BBcan177:

                  @wolfsden3:

                  -Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?

                  The IP Alerts are taken from the pfSense Firewall Logs. So you can clear the firewall log to start fresh.

                  Clearing the log only clears everything BUT DNSBL

                  1 Reply Last reply Reply Quote 0
                  • W
                    wolfsden3
                    last edited by

                    @BBcan177:

                    @wolfsden3:

                    -Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?

                    Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.

                    I can ping the VIP but cannot get the 1x1 pixel

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @Pippin:

                      The Synology DNS server uses bind

                      Well atleast its using a decent DNS Server, just ensure that DNSSEC is enabled… I'm always uneasy about these types of devices running the DNS role... Once you put pfSense into the mix, you could then utilize the pfBlockerNG package to get all the additional features it offers.

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        @wolfsden3:

                        @BBcan177:

                        @wolfsden3:

                        -Update- Logging worked for about 20 minutes, then stopped. It would actively update on what seemed to be about 30 second intervals. Is there a logging setting that needs to change?

                        Ensure that you can ping the DNSBL VIP, and browse to the DNSBL VIP and get the 1x1 pix.

                        I can ping the VIP but cannot get the 1x1 pixel

                        To clear the DNSBL log:

                        rm /var/log/pfblockerng/dnsbl.log

                        BY any chance do you have an Anti-virus/Firewall pkg on your desktop that might be causing issues… Seen someone who had Avast doing some 'DNS tunneling' and causing issues with DNSBL. Also check your browser Addons... If your not getting the 1x1, then DNSBL won't work as expected...

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • W
                          wolfsden3
                          last edited by

                          The only thing I have for AV is MS Security Essentials. Tried turning it off and no changes. The list has cleared and is now staying that way.

                          1 Reply Last reply Reply Quote 0
                          • W
                            wolfsden3
                            last edited by

                            To clear the DNSBL log:

                            rm /var/log/pfblockerng/dnsbl.log

                            BY any chance do you have an Anti-virus/Firewall pkg on your desktop that might be causing issues… Seen someone who had Avast doing some 'DNS tunneling' and causing issues with DNSBL. Also check your browser Addons... If your not getting the 1x1, then DNSBL won't work as expected...

                            What could possibly be blocking me to the DNSBL VIP?

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              If you are in a multi-segmented Lan network, there is a ☑ in the DNSBL tab to auto create a Floating allow rule for the selected Lan networks.

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • W
                                wolfsden3
                                last edited by

                                @BBcan177:

                                If you are in a multi-segmented Lan network, there is a ☑ in the DNSBL tab to auto create a Floating allow rule for the selected Lan networks.

                                That is already checked and created

                                1 Reply Last reply Reply Quote 0
                                • R
                                  renegade
                                  last edited by

                                  I have added all lists on my apu.
                                  Now my unbound is very slow. It takes more than 800ms to resolve a hostname.
                                  The flicker.conf list is about 60mb.
                                  I have increased some values like Message Cache Size and Number of Hosts to Cache. 50mb and 100000. But it is still so sloooow.
                                  Any ideas?
                                  Thank you

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    @renegade:

                                    I have added all lists on my apu.
                                    Now my unbound is very slow. It takes more than 800ms to resolve a hostname.
                                    The flicker.conf list is about 60mb.
                                    I have increased some values like Message Cache Size and Number of Hosts to Cache. 50mb and 100000. But it is still so sloooow.

                                    Ensure that your LAN devices can ping the DNSBL VIP, and also that they can browse to the DNSBL VIP and get the 1x1 pix.  If any of those two tests fail, you will see slowness as the browser is timing out waiting for the DNS resolution to the blocked Domains.

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • R
                                      renegade
                                      last edited by

                                      Thats works fine.
                                      I tested the dns resolution time in the Diagnostic menu.
                                      With top I can see that unbound takes a lot of cpu for some time.

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        Is the Resolver in "Forwarder" or "Resolver" mode?

                                        What DNS settings are defined in the pfSense General Tab? As these settings are used by the pfSense box itself…

                                        When testing the ping/browse to the DNSBL VIP, do that from the LAN clients and not from pfSense itself.

                                        If you're in a multi-segmented LAN, ensure to use the 'DNSBL Permit Rule' option in the DNSBL Tab. Also clear your Browser/OS cache.

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • R
                                          renegade
                                          last edited by

                                          Resolver Mode.
                                          No multi segmented LAN.
                                          VIP is tested from remote.
                                          I tested a dns resolution like www.IBM.com on pfsense box.
                                          The slow network is reproducible on many devices.
                                          Maybe there is a mistake in my config which unbound makes that slow.

                                          image.png
                                          image.png_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • W
                                            wolfsden3
                                            last edited by

                                            @BBcan177:

                                            Is the Resolver in "Forwarder" or "Resolver" mode?

                                            What DNS settings are defined in the pfSense General Tab? As these settings are used by the pfSense box itself…

                                            When testing the ping/browse to the DNSBL VIP, do that from the LAN clients and not from pfSense itself.

                                            If you're in a multi-segmented LAN, ensure to use the 'DNSBL Permit Rule' option in the DNSBL Tab. Also clear your Browser/OS cache.

                                            Unfortunately not 100% sure of what fixed it, but the DNSBL alerts are current. On to the next…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post