PfBlockerNG v2.0 w/DNSBL

RonpfS

I read it, but only for the amd64, not the i386. But started over and noticed it. Thanks again for your help and patience!

I made modifications to the post in the last days to better explain the fixes.

RonpfS

@matt.will:

Hey Ron,

Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

M

The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.

Qinn

In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

Cheers Qinn

RonpfS

@Qinn:

In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?

Cheers Qinn

System logs are one liner, pfblockerng.log is formated to be read top to bottom.

Qinn

@BBcan177:

Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)

Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"

hpHosts
http://hosts-file.net/download/hosts.zip

SWC
http://someonewhocares.org/hosts/hosts

spam404
~~https://spam404bl.com/blacklist.txt~~
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

malc0de
https://malc0de.com/bl/BOOT

MDS (use 'Flex' state)
https://mirror1.malwaredomains.com/files/justdomains

MVPS
http://winhelp2002.mvps.org/hosts.txt

MDL
http://www.malwaredomainlist.com/hostslist/hosts.txt

GJTech
http://adblock.gjtech.net/?format=unix-hosts

dShield_SD (They also have a conservative list available)
https://www.dshield.org/feeds/suspiciousdomains_High.txt

Zeus
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist

These two feeds post full URLs, so there can be some more false positives.
Create a new Alias, and use Alexa as a recommendation.

PhishTank
https://data.phishtank.com/data/online-valid.csv.bz2

OpenPhish
https://www.openphish.com/feed.txt

MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
https://lists.malwarepatrol.net

This is a feed that I manage (as time permits)
MS_2
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

Use this in its own Alias:

BBC_DGA (This is a large feed of DGA for the likes of Cryptolocker et al…)
http://osint.bambenekconsulting.com/feeds/dga-feed.gz

BBC_C2
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt

Use this feed in its own alias as it is updated more frequently.
So you can update it more often than once per day.

hpHosts_partial
http://hosts-file.net/hphosts-partial.asp

If users find other feeds, please post back so that others may benefit also.
Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.

I got a

[ DNSBL FAIL ] [ Skipping : GJTech ]

[1471592032] unbound-checkconf[36350:0] error: error parsing local-data at 30 '}).filter(' 60 IN A 10.10.10.1': Syntax error, could not parse the RR's TTL
[1471592032] unbound-checkconf[36350:0] error: Bad local-data RR }).filter(' 60 IN A 10.10.10.1
[1471592032] unbound-checkconf[36350:0] fatal error: failed local-zone, local-data configuration
[ dShield_SD ] exists. [ 08/19/16 09:33:52 ]

…..are the use of the sources mentioned above still to be advised? My Count went from 78k to a 476k and looking at the packets those extra 400k doesn't seem to be highly effective.

Thanks for any advise,

Cheers Qinn

RonpfS

The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
Just turn the list state to OFF.

Qinn

@RonpfS:

The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
Just turn the list state to OFF.

Thanks RonpfS for the reply.

jrdnlc

I set this up last night and so far good other than certification error pop ups i keep getting on certain sites. Anyone know if there is a fix for this?

Also, do you guys use IPv4 lists and DNSBL or just one?

RonpfS

Try Chrome or Firefox.

jrdnlc

@RonpfS:

Try Chrome or Firefox.

Not a fan or either. Any other option?

Qinn

@jrdnlc:

@RonpfS:

Try Chrome or Firefox.

Not a fan or either. Any other option?

Nope, take a look at Reply #161 https://forum.pfsense.org/index.php?topic=102470.msg575727#msg575727

filthyskillet

The way I resolved it is to permanently add cert… click show cert and choose trust check box this will add trust but when it resolves it is handeled dnsbl and returns 1x1pixel.

BBcan177

Here is a link to PR # 175 for pfBlockerNG v2.1.1_3

https://forum.pfsense.org/index.php?topic=115357.msg649167#msg649167

PF64

2.1.1_4 is out , hopefully the answer to all

srit

Good morning. I'm having the cannot allocate memory issue after upgrading from 2.1.1_2 to 2.1.1_3, then to 2.1.1_4. Uninstalling and reinstalling with and without keep settings checked off and i am still getting the cannot allocate memory error in pfsense. I've also been doing a force update after each try just in case.

Looking at the pfblockerng.log i cannot see any errors or failures. see below for exact error from pfsense.

There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18

if it helps i have 16GB in the FW.

Thanks.

RonpfS

@srit:

There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18

if it helps i have 16GB in the FW.

Thanks.

You should have leave you original post in the pfBlockerNG v2.1 w/TLD thread.

It is mentionned many many times that if you are using GeoIP tables, you need to raise Firewall Maximum Table Entries in System / Advanced / Firewall & NAT

The file on my pfsense is called South_America_v6.txt, maybe you have leftover from the previous installation. Open the Africa GeoIP tab, verify your selections and hit save, this will update the table. Then run Force Reload IP.
I just enabled the South America GeoIP table on my system and it has the same name as yours pfB_SAmerica_v6, so it is probably just a table size issue.

srit

Thank you I raised it to 4.5M to be safe.

I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.

I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.

Once again thank you.

RonpfS

@srit:

I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.

2.1.1_4 is pfBlockerNG with DNSBL and TLD. No harm done, one thread or the other will do. But it may be better to use the pfBlockerNG v2.1 w/TLD in the future.

@srit:

I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.

The size of MaxMind GeoIP database is 3-5x larger than previously, that used to make php crashes with the 2.1.1_2 version, this has been fixed.

However the tables generated are 3-5x larger as well, that requires an increase to the Firewall Maximum Table Entries as the default value isn't enough.

srit

Thank you for the clarification. I appreciate it. I will endeavor to use that forum for these posts in the future. ;D

nikkon

Hi all,
It's there a way to uninstall this from cli?
I did a mistake and loaded all Africa from geoip section and now Pfsense is not accessible anymore. I suspect it's overloaded.