PfBlockerNG v2.0 w/DNSBL

gcu_greyarea

pfBlockerNG on Bridge

Just wondering if anybody else has seen this.

I run a Bridged Setup (WAN-LAN) and have setup the Management IP on the Bridge Interface (192.168.15.215). This Interface also listens on other ports (OpenVPN , NTP) including 53 for unbound.

DNSBL listens on the default ports and the VIP is 192.168.15.216. I know that ideally this would be a different net, but DNSBL appears to work fine.

I do get strange DNSBL Log entries which I do not understand:
e.g.
DNSBL Recject,Oct 22 16:09:42,192.168.15.216,192.168.15.1, | / |

The pfBlcokerNG Alerts Tab shows the same entry with "No Match" . i.e. unable to determine which DNSBL Feed triggered the "Reject"

Ip Address 192.168.15.1 is the gateway (an ISP Provided router I cannot replace). I don't know why 192.168.15.1 would want to contact the DNSBL VIP?

gcu_greyarea

I was able to narrow down the issue through further testing.

The log entry and its assorted Alert ("No Match") …

DNSBL Recject,Oct 22 16:09:42,192.168.15.216,192.168.15.1, | / |

... can be reproduced by manually testing the DNSBL VIP Ports. e.g. http://vip-ip:80 (8081) . The error is generated for both https and https on ports (80, 8081, 443, 8433)

As it turns out our ISP Provided router wants to connect to the DNSBL VIP IP via port 80 (Seen via packet capture)...
Since WAN and LAN Interfaces are Bridged and filtering is done on the Bridge IF I have no way of blocking the Routers connection attempts...

blueduckdock

Quick Q- in the sync section there is "Sync to configured backup server." Is this for CARP installs?
I'd like to have my HQ box sync not only to the other carp member but also our regional offices. Wondering if/how this works.

xbipin

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

blueduckdock

@xbipin:

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

You could put those hosts on a separate interface. I would think that'd be easy enough.

xbipin

@blueduckdock:

@xbipin:

sorry if this seems like a basic question as this thread is extremely long so just managed to read around 20% of it.

im new to pfblockerng and what i was looking for is be able to block DNS on a per host basis which i dont seem to be able to make it work, as soon as i try to block youtube.com it aplies to unbound in general for every1.

is it even possible to block dns on a per host basis as most other threads i read was using opendns but that too it applies in general for every1

You could put those hosts on a separate interface. I would think that'd be easy enough.

well we have a small LAN and creating separate interfaces using vlans would be some what of a overkill.
if unbound could serve DNS queries per host that would solve this as i believe it would be a very useful feature and many would be interested in.

gcu_greyarea

You could Configure your DHCP server and specify the DNS option as external DNS server e.g. Google DNS.
For the small number if hosts you need to filter create a static DHCP Mapping(Reservation) and specify the unbound DNS server on the LAN Address.
Create an IP alias for these hosts and create a firewall rule to stop them acciessing any other DNS servers.

Obviously this creates a problem when all hosts must use the unbound resolver.

Other options would be - running a few virtual instances of pfSense -each with their own DnS resolver and DNSBLs. Then specify custom DNS servers via DHCP mappings.

xbipin

we currently block external DNS access from LAN and force every1 to use unbound and i guess unbound config doesnt mention any option to filter dns per host or probably run multiple instances of it which would seem like a more easier option without the complexities do multiple other things for same effect.

cyber roam i guess does this dns filtering per host so curious on how do they achieve it as many other ppl in my region use that just for the purpose of blocking certain domains per host

BBcan177

There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....

xbipin

@BBcan177:

There is no option in The Unbound Resolver to "Filter by host"…. So if you want to bypass DNSBL for some hosts... You need to define a different DNS server for those LAN devices....

thanks for the info, is there any such feature request at unbound side or probably any plans to add it in the future?

pfBasic

I just ran into an issue and wanted to put it out here.

I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.

I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".

Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.

BBcan177

@pfBasic:

I just ran into an issue and wanted to put it out here.

I run Private Internet Access as a VPN for one of my interfaces, I also use their DNS's.

I guess it's not really too surprising that this happened but my internet went down due to DNS and it was because the PIA DNS were being blocked by one of my pfBlockerNG lists, specifically "http://www.stopforumspam.com/downloads/bannedips.zip".

Anyways I know I'm not the only person who uses PIA DNS so I thought I'd put it out on here.

Best to submit this to Stop Forum Spam.

hulleyrob

Is anyone else seeing this lately after a cron?

There were error(s) loading the rules: pfctl: DIOCXCOMMIT: Device busy - The line in question reads [0]:

Has only started happening in the last few weeks.

Some googling suggested setting NIC speed manually from auto.

If anyone has got any other ideas please post.

Thanks

Rob

BBcan177

Looks like a bad aliastable possibly. Try a Force reload and/or a reboot.

Check the pfblockerng.log and system logs for further clues. If you hover over the Firewall rules, do you get the aliastable popup? Could also be unrelated to the package. You could temporarily disable the package and see if it re occurs.

hulleyrob

Ok thanks for that does this look ok as it is the only alias that didn't look right to me?

It only seemed to appear after i ticked de-duplication is it.

Rob

![Screen Shot 2016-11-07 at 13.19.46.jpg](/public/imported_attachments/1/Screen Shot 2016-11-07 at 13.19.46.jpg)
![Screen Shot 2016-11-07 at 13.19.46.jpg_thumb](/public/imported_attachments/1/Screen Shot 2016-11-07 at 13.19.46.jpg_thumb)

BBcan177

That is used for the IP Suppression… Its ok as is...

erwintwr

Hi guys

i am busy running a test server where i plan to simulate our current Squid+squidguard setup, but add DNSBL to it.

one think i note is that some ad's are still getting through ( comparing with AdBlock on chrome)

Is it possible to load an AdBlock list ( and from where?) , so that user experience is similar to having AdBlock extension activate?

Thx

pfBasic

It looks like I got one thing working on my setup but killed DNSBL in the process.

I recently setup policy based routing where my pass firewall rules determine the Gateway to be used. I did this so that I could have one interface route all traffic through my VPN client and another interface not utilize the VPN at all. That works great, but ever since I set that up I have 0 hits on all of my DNSBL feeds and ads are coming through.

Any ideas on how I can use pfBlockerNG DNSBL while still utilizing policy based routing for my purposes?

XmickS

My DNSBL has stopped working. When I do a Fprce Update, I get this in the log

------------------------------------------
Assembling database... completed
Validating database... completed
Reloading Unbound... Failed to Reload... Restoring previous database.... Not completed.

*** DNSBL update [ 0 ] [ 8654 ] ... OUT OF SYNC ! ***
------------------------------------------

When I execute "Shell Output - unbound-control -c /var/unbound/unbound.conf status"
I get this:

error: SSL handshake failed
34386131464:error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed:/builder/pfsense-232/tmp/FreeBSD-src/secure/lib/libssl/../../../crypto/openssl/ssl/s3_clnt.c:1191:

I've just uninstalled PfBlockerNG and after that a reboot, but it still persists. Any ideas?

laviniuc

the cron/reload/update job stalls for me. no error, just stops at dnsbl. works if i disable alexa whitelist or if i stop the dnsbl component. anyone else having this problem?