PfBlockerNG v2.0 w/DNSBL

RonpfS

Mithrondil

Is there a patch comming anytime soon to fix this?

JscoLP

Hi Everyone,

I just wanted to share another source of feeds that you can pull in. Register for free at https://otx.alienvault.com. Once you get logged in start searching the pulses for ipv4 or domain etc to pull the lists you want. When you hit the download page click download, right click CSV; this is the feed you want to load into your DNSBL.

Also note that IOCs can contain file hashes and other types of data not useful to pfblockerng. In that case you can click "create pulse", copy the CSV feed you want to include, and follow the wizard through to remove any of the IOCs that cant be read by pfblockerng.

Edit: Ah nevermind, these don't parse clean

local-data: "'domain','akamaitechnologysupport.com','' 60 IN A 10.10.10.1"

RonpfS

@Mithrondil:

Is there a patch comming anytime soon to fix this?

In a week or two.

RonpfS

@JscoLP:

Hi Everyone,

I just wanted to share another source of feeds that you can pull in. Register for free at https://otx.alienvault.com. Once you get logged in start searching the pulses for ipv4 or domain etc to pull the lists you want. When you hit the download page click download, right click CSV; this is the feed you want to load into your DNSBL.

Also note that IOCs can contain file hashes and other types of data not useful to pfblockerng. In that case you can click "create pulse", copy the CSV feed you want to include, and follow the wizard through to remove any of the IOCs that cant be read by pfblockerng.

Edit: Ah nevermind, these don't parse clean
local-data: "'domain','akamaitechnologysupport.com','' 60 IN A 10.10.10.1"

When BBcan177 return from vacation, he will look at this.

senser

Is it possible to use DNSBL on a transparent firewall (none of the NIC's has an IP except for the Bridge itself (10.1.0.10))? I am asking because I tried and I can't seem to access the VIP at 172.16.15.14. I guess NAT does not work with bridges.. hmm, any help appreciated. I'd really like to use DNSBL! Thanks!

RonpfS

@senser:

Is it possible to use DNSBL on a transparent firewall (none of the NIC's has an IP except for the Bridge itself (10.1.0.10))? I am asking because I tried and I can't seem to access the VIP at 172.16.15.14. I guess NAT does not work with bridges.. hmm, any help appreciated. I'd really like to use DNSBL! Thanks!

What are the choice available DNSBL Listening Interface ?
Did you look at the Firewall / NAT / Port Forward tab?

Nat.JPG_thumb

senser

@RonpfS:

What are the choice available DNSBL Listening Interface ?
Did you look at the Firewall / NAT / Port Forward tab?

My choice for the listening interface is LAN and BRIDGE. Tried both but no dice. The Port Forward tab lookes similar to yours (technically the same) when I enable DNSBL.

RonpfS

No clue, no bridge here.
Did you look at all posts in this thread and the pfBlockerNG thread to see if people had the same issues?

RonpfS

Can you ping the VIP ?
Can you access http://172.16.15.14
Are all clients DNS using pfsense with DNSBL ?
Anything in the Systems Log or Firewall Logs, pfblockerNG log files ?

senser

@RonpfS:

No clue, no bridge here.
Did you look at all posts in this thread and the pfBlockerNG thread to see if people had the same issues?

No, not yet.

@RonpfS:

Can you ping the VIP ?
Can you access http://172.16.15.14
Are all clients DNS using pfsense with DNSBL ?
Anything in the Systems Log or Firewall Logs, pfblockerNG log files ?

Can't ping or access it. I think it's because bridges usually don't do NAT and I don't think that there is a way to create the functionality DNSBL needs (services on port 80/443). but without using NAT. Please tell me I am wrong. :)

senser

I found a way to use DNSBL on my transparent bridge! :D
I configure DNSBL to listen on LAN at 10.10.10.1 as usual. But then (because I never get a reply from 10.10.10.1) I just reject all connections to "This Firewall" on ports 8081 and 8443.
I won't get any stats or 1x1 gifs but web sites load fast and without ads. :)

ProxyMoron

Hey all,
I'm trying to set up PFBlockerNG with GeoIP to block everything apart from my country by only PERMITTING my country, rather than selecting everything apart from my country and blocking inbound.

So under GeoIP i have selected <mycountry>under Top 20 and then Permit Inbound

This creates a permit rule under floating rules but i think im confusing myself as to what is happening here.

I have a web server running on the WAN, for which i have a WAN rule that permits any source to port 80 and 443. If there is a floating rule that allows UK IP's is that not allowing all UK IP's / Ports into my network? At what point does the float rule come into it?

What i want is for the firewall to check if the source is from the UK, if not block, then if its destined for port 80 or 443, if not block.

So under General - Rule Order should i select:-

pfB_Pass/Match | pfSense Pass/Match | pfB_Block/Reject | pfSense Block/Reject

or (leaning to this one)

pfSense Pass/Match | pfB_Pass/Match | pfB_Block/Reject | pfSense Block/Reject

Thinking it will match on 80 or 443 then match on UK.

Or something else, am i going about this the correct way? I kind of expected a blocking rule somewhere for ! <mycountry>Sorry - getting my head in a right pickle here. ;D</mycountry></mycountry>

RonpfS

https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719

Then you can install or re-install the pfBlockerNG 2.1.1_2.
The install should update the MaxMind (this take 5+ minutes) and proceed to completion.

nikkon

hi all,

i have performed this change, still the pfBlockerNG is not seen anymore in gui.
anyone had this before?

RonpfS

Where does it fails when you install it ? There must be some hints in the installation logs, system log or pfblockerng log.

nikkon

php /usr/local/www/pfblockerng/pfblockerng.php dc

and as it's shown in the logs :

Download Process Starting [ 08/15/16 21:18:57 ]
/usr/local/share/GeoIP/GeoIP.dat.gz 200 OK
/usr/local/share/GeoIP/GeoIPv6.dat.gz 200 OK
/usr/local/share/GeoIP/GeoLite2-Country-CSV.zip 200 OK
/var/db/pfblockerng/top-1m.csv.zip 200 OK
Download Process Ended [ 08/15/16 21:19:31 ]

Country code update Start
Converting MaxMind Country databases for pfBlockerNG.
Processing ISO IPv4 Continent/Country Data
Processing ISO IPv6 Continent/Country Data
Creating pfBlockerNG Continent XML files
IPv4 Africa
IPv6 Africa
IPv4 Antarctica
IPv6 Antarctica
IPv4 Asia
IPv6 Asia
IPv4 Europe
IPv6 Europe
IPv4 North America
IPv6 North America
IPv4 Oceania
IPv6 Oceania
IPv4 South America
IPv6 South America
IPv4 Proxy and Satellite
IPv6 Proxy and Satellite
IPv4 TOP 20
IPv6 TOP 20
Saving pfBlockerNG Reputation TAB
Country Code Update Ended - [ 08/15/16 21:24:37 ]

–-----

tail -f pfblockerng.log

DNSBL - Adding Unbound custom 'include' option

Saving new DNSBL web server configuration to port [ 8081 and 8443 ]
Saving pfSense config…
VIP address configured. Widget Packet statistics reset.
Restarting Service DNSBL...

**Saving configuration [ 08/15/16 19:16:28 ] …
Restarting Service DNSBL...

and stays like this for 20 minutes.

missing.png_thumb

RonpfS

Looks like the MaxMind database creation went ok.
Can you try to reinstall pfBlockerNG?

nikkon

Just did this:

install log looks like :

Upgrading pfSense-pkg-pfBlockerNG…
Updating pfSense-core repository catalogue...
pfSense-core repository is up-to-date.
Updating pfSense repository catalogue...
pfSense repository is up-to-date.
All repositories are up-to-date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
pfSense-pkg-pfBlockerNG-2.1.1_2 [pfSense]

Number of packages to be reinstalled: 1
[1/1] Reinstalling pfSense-pkg-pfBlockerNG-2.1.1_2…
[1/1] Extracting pfSense-pkg-pfBlockerNG-2.1.1_2: …....... done
Removing pfBlockerNG components...
Menu items... done.
Services... done.
Loading package instructions...
Removing pfBlockerNG...cat: /var/db/pfblockerng/dnsbl/.txt: No such file or directory
All customizations/data will be retained... done.
Saving updated package information...
overwrite!
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Executing custom_php_install_command()...
MaxMind GeoIP databases previously downloaded.
Adding pfBlockerNG Widget to the Dashboard... done.
Remove any existing and create link for DNSBL lighttpd executable... done.
Creating DNSBL web server start-up script... done.
Creating DNSBL web server config ... done.
Starting DNSBL Service... done.
Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
Custom commands completed ... done.
Executing custom_php_resync_config_command()...1 table created.
1/1 addresses added.
cat: /var/db/pfblockerng/dnsbl/.txt: No such file or directory
pkg: POST-INSTALL script failed

Cleaning up cache... done.
Success

just after the refresh i got a crash report:

Crash report begins. Anonymous machine information:

amd64
10.3-RELEASE-p5
FreeBSD 10.3-RELEASE-p5 #0 7307492(RELENG_2_3_2): Tue Jul 19 13:29:35 CDT 2016 root@ce23-amd64-builder:/builder/pfsense-232/tmp/obj/builder/pfsense-232/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors:
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP Fatal error: Allowed memory size of 104857600 bytes exhausted (tried to allocate 24 bytes) in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 3867
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP Stack trace:
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 1. {main}() /etc/rc.start_packages:0
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 2. sync_package() /etc/rc.start_packages:90
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 3. eval() /etc/inc/pkg-utils.inc:631
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 4. sync_package_pfblockerng() /etc/inc/pkg-utils.inc(631) : eval()'d code:3
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 5. file() /usr/local/pkg/pfblockerng/pfblockerng.inc:3867

RonpfS

Allowed memory size of 104857600 bytes exhausted (tried to allocate 24 bytes)

This tells me you only have 100M for memory limit.
What are the fixes you applied up to now to the system?

PfBlockerNG v2.0 w/DNSBL

We use the mighty pf, we cannot be fooled.

We use the mighty pf, we cannot be fooled.

We use the mighty pf, we cannot be fooled.

We use the mighty pf, we cannot be fooled.

tail -f pfblockerng.log