• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG v2.0 w/DNSBL

Scheduled Pinned Locked Moved
pfBlockerNG
192
1.1k
1.5m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • V
    varazir
    last edited by Aug 16, 2016, 3:17 PM

    Thanks it worked!!

    1 Reply Last reply Reply Quote 0
    • S
      surface
      last edited by Aug 16, 2016, 10:58 PM

      Hi all,

      I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

      Thanks in advance for your help!

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by Aug 16, 2016, 11:00 PM

        @surface:

        Hi all,

        I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

        Thanks in advance for your help!

        Maybe you should read this https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 again

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • V
          varazir
          last edited by Aug 17, 2016, 7:22 PM

          I made the mistake to reinstall the pkg. ( didn't take a snapshot before doing it) But I have a backup of the machine that I could restore and boot up.

          My idea was if it could be done to export the settings from the backuped VM ( running ) and import it in my live system?

          I can't find any way to extract the settings. found a way to sync the settings could try that but export import would be easier I think.

          1 Reply Last reply Reply Quote 0
          • RonpfSR
            RonpfS
            last edited by Aug 19, 2016, 6:44 AM Aug 17, 2016, 7:53 PM

            @varazir:

            I made the mistake to reinstall the pkg. ( didn't take a snapshot before doing it) But I have a backup of the machine that I could restore and boot up.

            My idea was if it could be done to export the settings from the backuped VM ( running ) and import it in my live system?

            I can't find any way to extract the settings. found a way to sync the settings could try that but export import would be easier I think.

            The settings for pfBlockerNG are stored in the config.xml file.

            But on a new installation, restoring the config file without modifications will not work with DNSBL enabled. The Resolver service (unbound) will not start as the unbound <custom_options>will try to load /var/unbound/pfb_dnsbl.conf which doesn't exist on a new installation. Without DNS Resolver running, the reinstallation of package on reboot will fail.
            One workaround is to```
            touch /var/unbound/pfb_dnsbl.conf

            
            Edit the config.xml to disable pfBlockerNG and DNSBL first.
            
            To disable pfBlockerNG in the config.xml change
            
            	 <pfblockerng><config><enable_cb>on</enable_cb>
            			<pfb_keep>on</pfb_keep></config></pfblockerng>
            
            	 <pfblockerng><config><enable_cb><pfb_keep>on</pfb_keep></enable_cb></config></pfblockerng>
            
            
            To disable DNSBL in the config.xml change
            
            	 <pfblockerngdnsblsettings><config><pfb_dnsbl>on</pfb_dnsbl></config></pfblockerngdnsblsettings>
            
            
            **AND** change custom_options :
            
             <unbound><active_interface>lan,opt1,lo0</active_interface>
            	<outgoing_interface>wan</outgoing_interface>
            	<custom_options>c2VydmVyOmluY2x1ZGU6IC92YXIvdW5ib3VuZC9wZmJfZG5zYmwuY29uZg==</custom_options></unbound> 
            
             <unbound><active_interface>lan,opt1,lo0</active_interface>
            	<outgoing_interface>wan</outgoing_interface></unbound> 
            
            
            On reboot the package installation should proceed and pfBlockerNG will rebuild the MaxMind database. If you had memory issues, you will have to apply the other fixes for memory issues https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 **before** restoring the config.xml file to the new installation.
            
            Then you re enable pfBlockerNG and DNSBL, do a Force Update to download the Tables and rebuild the pfBlockerNG database.</custom_options>

            2.4.5-RELEASE-p1 (amd64)
            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

            1 Reply Last reply Reply Quote 0
            • M
              matt.will
              last edited by Aug 18, 2016, 1:39 AM

              Hey Ron,

              Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

              M

              1 Reply Last reply Reply Quote 0
              • D
                duanes
                last edited by Aug 18, 2016, 2:34 PM

                My system has 8GB of RAM.  This is very frustrating.

                I have adjusted the max table entries to 70000000
                and in php.ini and php setup files suhosin.memory_limit = 1024000000
                Also, changed the config.inc file so that AMD64 = 4096M

                Then reinstall pfBlockerNG and I still get this near the end.  It is still

                Executing custom_php_install_command()…
                MaxMind GeoIP databases previously downloaded.
                Adding pfBlockerNG Widget to the Dashboard... done.
                Remove any existing and create link for DNSBL lighttpd executable... done.
                Creating DNSBL web server start-up script... done.
                Creating DNSBL web server config ... done.
                Starting DNSBL Service... done.
                Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
                Custom commands completed ... done.
                Executing custom_php_resync_config_command()...1 table created.
                1/1 addresses added.
                PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed

                1 Reply Last reply Reply Quote 0
                • R
                  Ramosel
                  last edited by Aug 18, 2016, 2:36 PM

                  It's not something I use all the time but I KNOW there used to be links on one of the pfBlockerNG screens to get you to an external lookup for finding AS numbers.  Has that moved?  Been dropped?  I can't find it anywhere…..

                  1 Reply Last reply Reply Quote 0
                  • V
                    varazir
                    last edited by Aug 18, 2016, 3:59 PM

                    @RonpfS:

                    Ahh ok, so I just thought I missed something well, and you was right when I turned on my backup it had the same settings as I hade after the reinstallation.

                    Everything is purring like kitten again. :)

                    1 Reply Last reply Reply Quote 0
                    • C
                      cmpufxr
                      last edited by Aug 18, 2016, 6:04 PM

                      I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

                      I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

                      Everything works as it should now, even blocking the youtube ads and porn.

                      I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

                      1 Reply Last reply Reply Quote 0
                      • RonpfSR
                        RonpfS
                        last edited by Aug 18, 2016, 8:55 PM

                        @cmpufxr:

                        I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

                        I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

                        Everything works as it should now, even blocking the youtube ads and porn.

                        I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

                        A fix for this issue is being tested.

                        2.4.5-RELEASE-p1 (amd64)
                        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                        1 Reply Last reply Reply Quote 0
                        • RonpfSR
                          RonpfS
                          last edited by Aug 18, 2016, 9:04 PM Aug 18, 2016, 8:58 PM

                          @duanes:

                          Also, changed the config.inc file so that AMD64 = 4096M

                          PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed

                          Did you reboot after making the modifications ? Maybe the ini settings are not loaded without the reboot.

                          134217728 show that the max memory configured somewhere is still 128M.
                          Maybe you are pushing the limit too far and it resets to 128M
                          Most users are running fine with 512M, 640M or maybe 768M, using 4096M per PHP process on a 4GB system doesn't make sense.

                          Double check the modifications you made and try again.

                          2.4.5-RELEASE-p1 (amd64)
                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                          1 Reply Last reply Reply Quote 0
                          • S
                            surface
                            last edited by Aug 18, 2016, 10:07 PM

                            @RonpfS:

                            @surface:

                            Hi all,

                            I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

                            Thanks in advance for your help!

                            Maybe you should read this https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 again

                            I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

                            1 Reply Last reply Reply Quote 0
                            • RonpfSR
                              RonpfS
                              last edited by Aug 18, 2016, 10:13 PM

                              @surface:

                              I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

                              I made modifications to the post in the last days to better explain the fixes.

                              2.4.5-RELEASE-p1 (amd64)
                              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                              1 Reply Last reply Reply Quote 0
                              • RonpfSR
                                RonpfS
                                last edited by Aug 18, 2016, 10:44 PM

                                @matt.will:

                                Hey Ron,

                                Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

                                M

                                The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.

                                2.4.5-RELEASE-p1 (amd64)
                                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                1 Reply Last reply Reply Quote 0
                                • QinnQ
                                  Qinn
                                  last edited by Aug 19, 2016, 6:42 AM

                                  In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

                                  Cheers Qinn

                                  Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                  Firmware: Latest-stable-pfSense CE (amd64)
                                  Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                  1 Reply Last reply Reply Quote 0
                                  • RonpfSR
                                    RonpfS
                                    last edited by Aug 19, 2016, 6:51 AM

                                    @Qinn:

                                    In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

                                    Cheers Qinn

                                    System logs are one liner, pfblockerng.log is formated to be read top to bottom.

                                    2.4.5-RELEASE-p1 (amd64)
                                    Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                    Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                    1 Reply Last reply Reply Quote 0
                                    • QinnQ
                                      Qinn
                                      last edited by Aug 19, 2016, 7:51 AM Aug 19, 2016, 7:41 AM

                                      @BBcan177:

                                      Here are more DNSBL Feeds that can be used in pfBlockerNG.
                                      (Copy and paste URLS as plain text)

                                      1. Create a new alias for these.
                                        These are not necessarily ADvert domains. So I named mine "Malicious"

                                      hpHosts
                                      http://hosts-file.net/download/hosts.zip

                                      SWC
                                      http://someonewhocares.org/hosts/hosts

                                      spam404
                                      https://spam404bl.com/blacklist.txt
                                      https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

                                      malc0de
                                      https://malc0de.com/bl/BOOT

                                      MDS (use 'Flex' state)
                                      https://mirror1.malwaredomains.com/files/justdomains

                                      MVPS
                                      http://winhelp2002.mvps.org/hosts.txt

                                      MDL
                                      http://www.malwaredomainlist.com/hostslist/hosts.txt

                                      GJTech
                                      http://adblock.gjtech.net/?format=unix-hosts

                                      dShield_SD  (They also have a conservative list available)
                                      https://www.dshield.org/feeds/suspiciousdomains_High.txt

                                      Zeus
                                      https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

                                      1. These two feeds post full URLs, so there can be some more false positives.
                                        Create a new Alias, and use Alexa as a recommendation.

                                      PhishTank
                                      https://data.phishtank.com/data/online-valid.csv.bz2

                                      OpenPhish
                                      https://www.openphish.com/feed.txt

                                      MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
                                      https://lists.malwarepatrol.net

                                      1. This is a feed that I manage (as time permits)
                                        MS_2
                                        https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

                                      2. Use this in its own Alias:

                                      BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al…)
                                      http://osint.bambenekconsulting.com/feeds/dga-feed.gz

                                      BBC_C2
                                      http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

                                      1. Use this feed in its own alias as it is updated more frequently.
                                        So you can update it more often than once per day.

                                      hpHosts_partial
                                      http://hosts-file.net/hphosts-partial.asp

                                      If users find other feeds, please post back so that others may benefit also.
                                      Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

                                      I got a

                                      [ DNSBL FAIL ] [ Skipping : GJTech ]

                                      [1471592032] unbound-checkconf[36350:0] error: error parsing local-data at 30 '}).filter(' 60 IN A 10.10.10.1': Syntax error, could not parse the RR's TTL
                                      [1471592032] unbound-checkconf[36350:0] error: Bad local-data RR }).filter(' 60 IN A 10.10.10.1
                                      [1471592032] unbound-checkconf[36350:0] fatal error: failed local-zone, local-data configuration
                                      [ dShield_SD ]      exists. [ 08/19/16 09:33:52 ]

                                      …..are the use of the sources mentioned above still to be advised? My Count went from 78k to a 476k and looking at the packets those extra 400k doesn't seem to be highly effective.

                                      Thanks for any advise,

                                      Cheers Qinn

                                      Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                      Firmware: Latest-stable-pfSense CE (amd64)
                                      Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                      1 Reply Last reply Reply Quote 0
                                      • RonpfSR
                                        RonpfS
                                        last edited by Aug 19, 2016, 4:22 PM

                                        The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
                                        Just turn the list state to OFF.

                                        2.4.5-RELEASE-p1 (amd64)
                                        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                        1 Reply Last reply Reply Quote 0
                                        • QinnQ
                                          Qinn
                                          last edited by Aug 19, 2016, 5:40 PM

                                          @RonpfS:

                                          The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
                                          Just turn the list state to OFF.

                                          Thanks RonpfS for the reply.

                                          Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                          Firmware: Latest-stable-pfSense CE (amd64)
                                          Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jrdnlc
                                            last edited by Aug 20, 2016, 9:31 PM

                                            I set this up last night and so far good other than certification error pop ups i keep getting on certain sites. Anyone know if there is a fix for this?

                                            Also, do you guys use IPv4 lists and DNSBL or just one?

                                            1 Reply Last reply Reply Quote 0
                                            • RonpfSR
                                              RonpfS
                                              last edited by Aug 20, 2016, 11:38 PM

                                              Try Chrome or Firefox.

                                              2.4.5-RELEASE-p1 (amd64)
                                              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                              1 Reply Last reply Reply Quote 0
                                              • J
                                                jrdnlc
                                                last edited by Aug 21, 2016, 6:13 AM

                                                @RonpfS:

                                                Try Chrome or Firefox.

                                                Not a fan or either. Any other option?

                                                1 Reply Last reply Reply Quote 0
                                                • QinnQ
                                                  Qinn
                                                  last edited by Aug 21, 2016, 11:54 AM

                                                  @jrdnlc:

                                                  @RonpfS:

                                                  Try Chrome or Firefox.

                                                  Not a fan or either. Any other option?

                                                  Nope, take a look at Reply #161 https://forum.pfsense.org/index.php?topic=102470.msg575727#msg575727

                                                  Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                                  Firmware: Latest-stable-pfSense CE (amd64)
                                                  Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                                  1 Reply Last reply Reply Quote 0
                                                  • F
                                                    filthyskillet
                                                    last edited by Aug 21, 2016, 7:06 PM

                                                    The way I resolved it is to permanently add cert… click show cert and choose trust check box this will add trust but when it resolves it is handeled dnsbl and returns 1x1pixel.

                                                    1 Reply Last reply Reply Quote 0
                                                    • BBcan177B
                                                      BBcan177 Moderator
                                                      last edited by Aug 22, 2016, 2:55 AM

                                                      Here is a link to PR # 175 for pfBlockerNG v2.1.1_3

                                                      https://forum.pfsense.org/index.php?topic=115357.msg649167#msg649167

                                                      "Experience is something you don't get until just after you need it."

                                                      Website: http://pfBlockerNG.com
                                                      Twitter: @BBcan177  #pfBlockerNG
                                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                                      1 Reply Last reply Reply Quote 0
                                                      • P
                                                        PF64
                                                        last edited by Aug 24, 2016, 12:00 PM

                                                        2.1.1_4 is out , hopefully the answer to all

                                                        1 Reply Last reply Reply Quote 0
                                                        • S
                                                          srit
                                                          last edited by Aug 26, 2016, 1:51 PM

                                                          Good morning. I'm having the cannot allocate memory issue after upgrading from 2.1.1_2 to 2.1.1_3, then to 2.1.1_4. Uninstalling and reinstalling with and without keep settings checked off and i am still getting the cannot allocate memory error in pfsense. I've also been doing a force update after each try just in case.

                                                          Looking at the pfblockerng.log i cannot see any errors or failures. see below for exact error from pfsense.

                                                          There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18

                                                          if it helps i have 16GB in the FW.

                                                          Thanks.

                                                          1 Reply Last reply Reply Quote 0
                                                          • RonpfSR
                                                            RonpfS
                                                            last edited by Aug 26, 2016, 3:36 PM Aug 26, 2016, 2:32 PM

                                                            @srit:

                                                            There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18

                                                            if it helps i have 16GB in the FW.

                                                            Thanks.

                                                            You should have leave you original post in the pfBlockerNG v2.1 w/TLD thread.

                                                            It is mentionned many many times that if you are using GeoIP tables, you need to raise Firewall Maximum Table Entries in System / Advanced / Firewall & NAT

                                                            The file on my pfsense is called South_America_v6.txt, maybe you have leftover from the previous installation. Open the Africa GeoIP tab, verify your selections and hit save, this will update the table. Then run Force Reload IP.
                                                            I just enabled the South America GeoIP table on my system and it has the same name as yours pfB_SAmerica_v6, so it is probably just a table size issue.

                                                            2.4.5-RELEASE-p1 (amd64)
                                                            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                                            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                                            1 Reply Last reply Reply Quote 0
                                                            • S
                                                              srit
                                                              last edited by Aug 26, 2016, 3:05 PM

                                                              Thank you I raised it to 4.5M to be safe.

                                                              I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.

                                                              I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.

                                                              Once again thank you.

                                                              1 Reply Last reply Reply Quote 0
                                                              • RonpfSR
                                                                RonpfS
                                                                last edited by Aug 26, 2016, 3:31 PM Aug 26, 2016, 3:18 PM

                                                                @srit:

                                                                I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.

                                                                2.1.1_4 is pfBlockerNG with DNSBL and TLD. No harm done, one thread or the other will do. But it may be better to use the pfBlockerNG v2.1 w/TLD in the future.

                                                                @srit:

                                                                I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.

                                                                The size of MaxMind GeoIP database is 3-5x larger than previously, that used to make php crashes with the 2.1.1_2 version, this has been fixed.

                                                                However the tables generated are 3-5x larger as well, that requires an increase to the Firewall Maximum Table Entries as the default value isn't enough.

                                                                2.4.5-RELEASE-p1 (amd64)
                                                                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                                                1 Reply Last reply Reply Quote 0
                                                                • S
                                                                  srit
                                                                  last edited by Aug 26, 2016, 3:21 PM

                                                                  Thank you for the clarification. I appreciate it. I will endeavor to use that forum for these posts in the future.  ;D

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • N
                                                                    nikkon
                                                                    last edited by Aug 27, 2016, 8:44 PM

                                                                    Hi all,
                                                                    It's there a way to uninstall this from cli?
                                                                    I did a mistake and loaded all Africa from geoip section and now Pfsense is not accessible anymore. I suspect it's overloaded.

                                                                    pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                                                                    Happy PfSense user :)

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • N
                                                                      nikkon
                                                                      last edited by Aug 29, 2016, 10:18 PM Aug 29, 2016, 10:12 PM

                                                                      my issue seems to be fixed now thanks to BBcan177 and RonpfS who ware supporting me with all posted issues.
                                                                      As a resume here what i did as a short recap:

                                                                      • fresh install 2.1.1_4 !!!

                                                                      • SystemAdvancedFirewall & NAT change 2 values:
                                                                        Firewall Maximum States : 2000000 # this ca be leave as default…i prefered to make the change.
                                                                        Firewall Maximum Table Entries : 10000000

                                                                      • reboot sistem if you can if not just enable pfblokerng and run a manual update.

                                                                      Everything seems to run pretty well now.
                                                                      Thanks again guys.

                                                                      pfsense 2.3.4 on Supermicro A1SRi-2758F + 8GB ECC + SSD

                                                                      Happy PfSense user :)

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • K
                                                                        khorton
                                                                        last edited by Aug 31, 2016, 6:54 PM

                                                                        @BBcan177:

                                                                        @D0X:

                                                                        But now when browsing I continuously get Safari telling me the certificate is invalid (as shown in the attached picture, it is in Dutch but I think you'll get it).

                                                                        Safari seems to be the only browser that has this issue. Doesn't seem to occur with Chrome/FF/IE/Edge etc…

                                                                        Are these cert popups happening when you browse to that blocked Domain directly, or when its blocking that Domain as part of the webpage?  Two checks to ensure DNBSL is working as expected... Ping the DNSBL VIP and get a proper response ... Browse to the DNSBL VIP and get the 1x1 pix...

                                                                        If the popups are from a few common Domains, try to whitelist those and see if that improves it.

                                                                        Also, in the IPv4 tab, you cannot enter any EasyList Feeds... the IPv4 tab is for IP based listed only.

                                                                        DNSBL is designed to block the DNS resolution to Advert/Malicious Domains. As such only a portion of the EasyList/Privacy Feeds can be used (Where the feeds lists the actual ADvert Domain). Browser-Addons like ADBlock/UBlock manipulate the elements that are displayed on the page. So they can block certain elements from a particular Domain, while DNSBL can only block the entire Domain.

                                                                        Only two EasyList feeds can be used with DNSBL and they are hardcoded in the EasyList Tab. There are several other DNSBL Feeds listed at the start of this thread that can fill in the gap to block the balance of the Domains from serving any ADs.  Plus its achieved at Network level, without any add-ons manipulating or potentially opening security holes in the browser.

                                                                        It would really be nice if Safari fixed this issue with their software... Not much I can do to fix that without killing the package logging feature and just NXDOMAIN the DNS requests.

                                                                        I'm running the latest pfBlockerNG package on pfSense 2.3, and I have the same issue with Safari on OS X and iOS complaining about invalid certificates from googleads.g.doubleclick.net.  The latest events were from a banking site and when reading an article on macgroup.org.

                                                                        I've confirmed that I can ping to the VIP, and a browser sent to the VIP:8081 gets a 1x1 favicon.  I've white listed googleads.g.doubleclick.net.

                                                                        Is there anything else I can do in the pfBlockerNG settings to sort this out?

                                                                        I'd send a bug report to Apple on this, but I don't understand the problem nearly well enough to know how to properly describe the issue.

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • RonpfSR
                                                                          RonpfS
                                                                          last edited by Aug 31, 2016, 7:35 PM Aug 31, 2016, 7:32 PM

                                                                          @khorton:

                                                                          I'm running the latest pfBlockerNG package on pfSense 2.3, and I have the same issue with Safari on OS X and iOS complaining about invalid certificates from googleads.g.doubleclick.net.  The latest events were from a banking site and when reading an article on macgroup.org.

                                                                          I've confirmed that I can ping to the VIP, and a browser sent to the VIP:8081 gets a 1x1 favicon.  I've white listed googleads.g.doubleclick.net.

                                                                          Is there anything else I can do in the pfBlockerNG settings to sort this out?

                                                                          I'd send a bug report to Apple on this, but I don't understand the problem nearly well enough to know how to properly describe the issue.

                                                                          When you whitelist using the Alerts Tab, pfBlockerNG will identify if there are CNAMEs for the domain name and whitelist the CNAME as well.

                                                                          However when you put a domainname in the Custom Domain Whitelist, you have to find the CNAMEs on your own:

                                                                          drill @8.8.8.8 googleads.g.doubleclick.net
                                                                          
                                                                          ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 19703
                                                                          ;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
                                                                          ;; QUESTION SECTION:
                                                                          ;; googleads.g.doubleclick.net.	IN	A
                                                                          
                                                                          ;; ANSWER SECTION:
                                                                          googleads.g.doubleclick.net.	299	IN	CNAME	pagead46.l.doubleclick.net.
                                                                          pagead46.l.doubleclick.net.	299	IN	A	172.217.1.98
                                                                          
                                                                          ;; AUTHORITY SECTION:
                                                                          
                                                                          ;; ADDITIONAL SECTION:
                                                                          
                                                                          ;; Query time: 74 msec
                                                                          ;; SERVER: 8.8.8.8
                                                                          ;; WHEN: Wed Aug 31 15:25:50 2016
                                                                          ;; MSG SIZE  rcvd: 86
                                                                          
                                                                          

                                                                          Then you add pagead46.l.doubleclick.net to the Custom Domain Whitelist

                                                                          2.4.5-RELEASE-p1 (amd64)
                                                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • K
                                                                            khorton
                                                                            last edited by Aug 31, 2016, 8:45 PM

                                                                            @RonpfS:

                                                                            @khorton:

                                                                            I'm running the latest pfBlockerNG package on pfSense 2.3, and I have the same issue with Safari on OS X and iOS complaining about invalid certificates from googleads.g.doubleclick.net.  The latest events were from a banking site and when reading an article on macgroup.org.

                                                                            I've confirmed that I can ping to the VIP, and a browser sent to the VIP:8081 gets a 1x1 favicon.  I've white listed googleads.g.doubleclick.net.

                                                                            Is there anything else I can do in the pfBlockerNG settings to sort this out?

                                                                            I'd send a bug report to Apple on this, but I don't understand the problem nearly well enough to know how to properly describe the issue.

                                                                            When you whitelist using the Alerts Tab, pfBlockerNG will identify if there are CNAMEs for the domain name and whitelist the CNAME as well.

                                                                            However when you put a domainname in the Custom Domain Whitelist, you have to find the CNAMEs on your own:

                                                                            drill @8.8.8.8 googleads.g.doubleclick.net
                                                                            
                                                                            ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 19703
                                                                            ;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0
                                                                            ;; QUESTION SECTION:
                                                                            ;; googleads.g.doubleclick.net.	IN	A
                                                                            
                                                                            ;; ANSWER SECTION:
                                                                            googleads.g.doubleclick.net.	299	IN	CNAME	pagead46.l.doubleclick.net.
                                                                            pagead46.l.doubleclick.net.	299	IN	A	172.217.1.98
                                                                            
                                                                            ;; AUTHORITY SECTION:
                                                                            
                                                                            ;; ADDITIONAL SECTION:
                                                                            
                                                                            ;; Query time: 74 msec
                                                                            ;; SERVER: 8.8.8.8
                                                                            ;; WHEN: Wed Aug 31 15:25:50 2016
                                                                            ;; MSG SIZE  rcvd: 86
                                                                            
                                                                            

                                                                            Then you add pagead46.l.doubleclick.net to the Custom Domain Whitelist

                                                                            Thanks for the info.  I've added pagead46.l.doubleclick.net to the Custom Domain Whitelist.  We'll see if that helps.

                                                                            But, I already had .doubleclick.net in the Custom Domain Whitelist.  I thought the "." at the start was supposed to cover all the sub-domains.  Does that not work?  Or, is this a hint that we're chasing the wrong fix to the problem?

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • BBcan177B
                                                                              BBcan177 Moderator
                                                                              last edited by Aug 31, 2016, 8:53 PM

                                                                              @khorton:

                                                                              But, I already had .doubleclick.net in the Custom Domain Whitelist.  I thought the "." at the start was supposed to cover all the sub-domains.  Does that not work?  Or, is this a hint that we're chasing the wrong fix to the problem?

                                                                              If you had the prefixed dot, then it should have cleared all of those Domains…

                                                                              You can check with the following cmd and see if there are any Domains ending with doubleclick.net in the DNSBL blocklist.

                                                                              grep "doubleclick.net" /var/unbound/pfb_dnsbl.conf
                                                                              

                                                                              You can also go into Dev mode in the Browser (then goto console), then see if it could be a different Domain that is causing this issue…

                                                                              "Experience is something you don't get until just after you need it."

                                                                              Website: http://pfBlockerNG.com
                                                                              Twitter: @BBcan177  #pfBlockerNG
                                                                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • K
                                                                                khorton
                                                                                last edited by Sep 1, 2016, 12:40 AM

                                                                                @BBcan177:

                                                                                If you had the prefixed dot, then it should have cleared all of those Domains…

                                                                                You can check with the following cmd and see if there are any Domains ending with doubleclick.net in the DNSBL blocklist.

                                                                                grep "doubleclick.net" /var/unbound/pfb_dnsbl.conf
                                                                                

                                                                                You can also go into Dev mode in the Browser (then goto console), then see if it could be a different Domain that is causing this issue…

                                                                                It looks like there was quite a long list of doubleclick.net domains already caught:

                                                                                grep "doubleclick.net" /var/unbound/pfb_dnsbl.conf
                                                                                local-data: "ad-apac.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "ad-emea.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "ad.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "ad.mo.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "gan.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "googleads.g.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "iv.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "n4403ad.doubleclick.net 60 IN A 10.10.10.1"
                                                                                local-data: "pubads.g.doubleclick.net 60 IN A 10.10.10.1"
                                                                                

                                                                                I am unable to trigger the SSL certificate error now, but next time it happens I'll check the Safari error console in Dev mode.

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • BBcan177B
                                                                                  BBcan177 Moderator
                                                                                  last edited by Sep 1, 2016, 1:14 AM

                                                                                  @khorton:

                                                                                  It looks like there was quite a long list of doubleclick.net domains already caught:

                                                                                  If you manually add any domains to the DNSBL Whitelist, you must execute a "Force Reload - DNSBL" for the whitelist to take effect.

                                                                                  If you added    .doubleclick.net  to the DNSBL Whitelist, then the grep command above should have returned no results, since that Domain is in the DNSBL whitelist…

                                                                                  "Experience is something you don't get until just after you need it."

                                                                                  Website: http://pfBlockerNG.com
                                                                                  Twitter: @BBcan177  #pfBlockerNG
                                                                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  866 out of 1077
                                                                                  • First post
                                                                                    Last post
                                                                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.

                                                                                  Looks like your connection to Netgate Forum was lost, please wait while we try to reconnect.