PfBlockerNG v2.0 w/DNSBL
-
Hi.
I keep watching in the general system log entries like this:
*nginx: 2016/10/10 19:04:39 [error] 23499#100098: 737 open() "/usr/local/www/utsync.ashx" failed (2: No such file or directory),client: 10.10.10.1, server: , request: "GET /utsync.ashx?eid=50052&et=0&fp=2X9bJ6tnRz5B2L0llgZVTWayaMg4TcNYwOj-CDyEPl1k&return=http%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil HTTP/1.1", host: "ml314.com", referrer: "http://viraliq.com/15-musicians-didnt-know-passed?utm_source=revcontent&utm_medium=referral&utm_campaign=desktop&utm_content_id=996712&utm_boost_id=116872&utm_targeting=editorial%20news&utm_widget_id=31653"I understand that DNSBL has successfully diverted the DNS petition to server 10.10.10.1 and the requested file is not there but is, logging these messages, the right behavior?
Is there a way to disable them?. They are populating the system logs and hiding important stuff.
-
just wanted to give a personal thank you to bbcan for his committed FREE support on this amazing addon.
you sir are a legend :)
-
Just out of curiosity, is there any progress on this? I saw that MaxMind: Last-Modified: Tue, 02 Aug 2016 is still on August. Of course I could do a "php /usr/local/www/pfblockerng/pfblockerng.php dc", but everything is working fine (pfBlockerNG v2.1.1_4) so no need for it, as in ….if it ain't broke, than don't try to fix it ;)
Do you have any MaxMind update errors in /var/log/pfblockerng/geoip.log?
I would manually run the update and see if it reports any errors…
php /usr/local/www/pfblockerng/pfblockerng.php dcI encoutered no errors, so no log file. Btw I am on a APU2C4, 2.3.2-RELEASE-p1 (amd64) and pfBlockerNG 2.1.1_4
-
pfBlockerNG on Bridge
Just wondering if anybody else has seen this.
I run a Bridged Setup (WAN-LAN) and have setup the Management IP on the Bridge Interface (192.168.15.215). This Interface also listens on other ports (OpenVPN , NTP) including 53 for unbound.
DNSBL listens on the default ports and the VIP is 192.168.15.216. I know that ideally this would be a different net, but DNSBL appears to work fine.
I do get strange DNSBL Log entries which I do not understand:
e.g.
DNSBL Recject,Oct 22 16:09:42,192.168.15.216,192.168.15.1, | / |The pfBlcokerNG Alerts Tab shows the same entry with "No Match" . i.e. unable to determine which DNSBL Feed triggered the "Reject"
Ip Address 192.168.15.1 is the gateway (an ISP Provided router I cannot replace). I don't know why 192.168.15.1 would want to contact the DNSBL VIP?
-
I was able to narrow down the issue through further testing.
The log entry and its assorted Alert ("No Match") …
DNSBL Recject,Oct 22 16:09:42,192.168.15.216,192.168.15.1, | / |
... can be reproduced by manually testing the DNSBL VIP Ports. e.g. http://vip-ip:80 (8081) . The error is generated for both https and https on ports (80, 8081, 443, 8433)
As it turns out our ISP Provided router wants to connect to the DNSBL VIP IP via port 80 (Seen via packet capture)...
Since WAN and LAN Interfaces are Bridged and filtering is done on the Bridge IF I have no way of blocking the Routers connection attempts... -
Quick Q- in the sync section there is "Sync to configured backup server." Is this for CARP installs?
I'd like to have my HQ box sync not only to the other carp member but also our regional offices. Wondering if/how this works. -
sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.
im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.
is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1
-
sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.
im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.
is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1
You could put those hosts on a separate interface. I would think that'd be easy enough.
-
sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.
im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.
is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1
You could put those hosts on a separate interface. I would think that'd be easy enough.
well we have a small LAN and creating separate interfaces using vlans would be some what of a overkill.
if unbound could serve DNS queries per host that would solve this as i believe it would be a very useful feature and many would be interested in. -
You could Configure your DHCP server and specify the DNS option as external DNS server e.g. Google DNS.
For the small number if hosts you need to filter create a static DHCP Mapping(Reservation) and specify the unbound DNS server on the LAN Address.
Create an IP alias for these hosts and create a firewall rule to stop them acciessing any other DNS servers.Obviously this creates a problem when all hosts must use the unbound resolver.
Other options would be - running a few virtual instances of pfSense -each with their own DnS resolver and DNSBLs. Then specify custom DNS servers via DHCP mappings.
-
we currently block external DNS access from LAN and force every1 to use unbound and i guess unbound config doesnt mention any option to filter dns per host or probably run multiple instances of it which would seem like a more easier option without the complexities do multiple other things for same effect.
cyber roam i guess does this dns filtering per host so curious on how do they achieve it as many other ppl in my region use that just for the purpose of blocking certain domains per host
-
There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....
-
There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....
thanks for the info, is there any such feature request at unbound side or probably any plans to add it in the future?
-
I just ran into an issue and wanted to put it out here.
I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.
I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".
Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.
-
I just ran into an issue and wanted to put it out here.
I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.
I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".
Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.
Best to submit this to Stop Forum Spam.
-
Is anyone else seeing this lately after a cron?
There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]:
Has only started happening in the last few weeks.
Some googling suggested setting NIC speed manually from auto.
If anyone has got any other ideas please post.
Thanks
Rob
-
Looks like a bad aliastable possibly. Try a Force reload and/or a reboot.
Check the pfblockerng.log and system logs for further clues. If you hover over the Firewall rules, do you get the aliastable popup? Could also be unrelated to the package. You could temporarily disable the package and see if it re occurs.
-
Ok thanks for that does this look ok as it is the only alias that didn't look right to me?
It only seemed to appear after i ticked de-duplication is it.
Rob
 -
That is used for the IP Suppression… Its ok as is...
-
Hi guys
i am busy running a test server where i plan to simulate our current Squid+squidguard setup, but add DNSBL to it.
one think i note is that some ad's are still getting through ( comparing with AdBlock on chrome)
Is it possible to load an AdBlock list ( and from where?) , so that user experience is similar to having AdBlock extension activate?
Thx
