PfBlockerNG v2.0 w/DNSBL


  • Moderator

    @docjay:

    I will be donating to you if you accept donations. 
    –** Good Job**--

    NP :)



  • @BBcan177:

    Both IP Reputation and DNSBL achieve two different layer of protection.

    What are the differences? I'm just curious.
    I love your work btw! Great job.



  • @tonymorella:

    @doktornotor:

    @Asterix:

    Getting this EasyList error for w/o elements.

    [ DNSBL_EasyList - w/o Elements ] Download FAIL
      Could not determine IP address of host.
      Firewall and/or IDS are not blocking download.

    Well that's not a package error. You need working DNS. :D

    
    $ host easylist-downloads.adblockplus.org
    easylist-downloads.adblockplus.org has address 148.251.139.76
    easylist-downloads.adblockplus.org has address 144.76.100.145
    easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:200:114f::2
    easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:192:7126::2
    
    

    Filter out easylist-downloads.adblockplus.org via DNSBL as well as add it to an allow alias and see if this helps. Depending out how you having things setup could be blocking.  Host lookup most likely works because it's doing is via unbound. Just a thought let us know :)

    Tony M

    DNS is working fine. It downloads the "Privacy" list which is just after w/o Elements.



  • Some additional reading:
    https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

    thanks for that - useful reading for anyone thinking about using DNSBL.



  • Where can i find the list referred in your post.

    "See the script that I wrote to add over 50+ different blocklists for IP Reputation."

    Thanks

    cjb


  • Moderator

    @cjbujold:

    Where can i find the list referred in your post.

    https://forum.pfsense.org/index.php?topic=86212.msg549973#msg549973

    @Asterix:

    [ DNSBL_EasyList - w/o Elements ] Download FAIL
      Could not determine IP address of host.
      Firewall and/or IDS are not blocking download.

    Is the 'Header' set as "w/o Elements"… Don't add special characters or spaces... just call it "EasyList" and the other "EasyPrivacy" as the Header/Label. Did you configure the Categories for both lists? In the latest version 2.0.1, there is a fix which might help diagnose this issue for you.



  • @BBcan177:

    @michaelmullanyza:

    What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

    There are several other lists the perform better than IBlock lists. They have too many false positives. See the script that I wrote to add over 50+ different blocklists for IP Reputation.

    Both IP Reputation and DNSBL achieve two different layer of protection. Not too mention that DNSBL also properly handles ADvert blocking.

    Some additional reading:
    https://www.sans.org/reading-room/whitepapers/dns/dns-sinkhole-33523

    Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

    Finally server started and i got data at logs.

    Many thnx :)


  • Moderator

    @ha11oga11o:

    Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

    Finally server started and i got data at logs.

    When you were at the Dashboard: Services Status Widget, if DNSBL was not running, it would have shown a red "X" and a single "Start" Icon". The "Restart" Icon is only visible when the service is already started?  Can you try to stop/start the DNSBL service from the Dashboard? I can't duplicate this issue?



  • @BBcan177:

    @cjbujold:

    Where can i find the list referred in your post.

    https://forum.pfsense.org/index.php?topic=86212.msg549973#msg549973

    @Asterix:

    [ DNSBL_EasyList - w/o Elements ] Download FAIL
      Could not determine IP address of host.
      Firewall and/or IDS are not blocking download.

    Is the 'Header' set as "w/o Elements"… Don't add special characters or spaces... just call it "EasyList" and the other "EasyPrivacy" as the Header/Label. Did you configure the Categories for both lists? In the latest version 2.0.1, there is a fix which might help diagnose this issue for you.

    Removing "w/o" has fixed this. Thank you!



  • @BBcan177:

    @ha11oga11o:

    Had same issue. I tried to start it by pressing restart on dashboard, but no joy. But when i ran in console "/usr/local/etc/rc.d/dnsbl.sh start" it started service, but continue to load command prompt in web browser forever, so i got no output.

    Finally server started and i got data at logs.

    When you were at the Dashboard: Services Status Widget, if DNSBL was not running, it would have shown a red "X" and a single "Start" Icon". The "Restart" Icon is only visible when the service is already started?  Can you try to stop/start the DNSBL service from the Dashboard? I can't duplicate this issue?

    mine fault, it was only start which was doing nothing. Alsop nothing at system logs. Now, i tried to actually restart and works fine now.

    Cheers :)

    PS. At first post i wanted to quote this, sorry:

    Checklist:

    pfBlockerNG enabled in General Tab
        DNSBL enabled in DNSBL Tab
        VIP, port and ssl port defined in DNSBL Tab
        DNS Resolver enabled

    Then run a 'Force Update'. If it still doesn't start, execute the following and see if it shows any additional info:
    Code: [Select]

    /usr/local/etc/rc.d/dnsbl.sh start



  • I was thinking about using the new features of pfBlockerNG 2.0 to stop spam at the firewall since the current version of PostFix does not yet support DNSBL out of the box…
    I was thinking of setting the list action to alias, then putting the firewall rules in to block all incoming from the sites. Problem I think is that the SpamHaus DNS list is a live list (query).... Is this supported?



  • I have installed pfBlockerNG v2.01 on my APU1D4 pfSense 2.2.5

    I'm blocking a few countries for inbound traffic.
    I also setup DNSBL as per post: https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943

    I'm using OpenDNS in General Setup and DNS Resolver is enabled with the following options:
    Enable Forwarding Mode (this is needed for my OpenDNS filtering)
    Register DHCP leases in the DNS Resolver
    Register DHCP static mappings in the DNS Resolver

    All is working, ads are being blocked.
    Only problem is when I reboot my box the Unbound Service is not started automatically (or is being stopped).
    So with every reboot I do, I have to manually start the Unbound Service.

    What could be the problem?



  • @Panja:


    So with every reboot I do, I have to manually start the Unbound Service.

    What could be the problem?

    You lost the pfb_dnsbl.conf, in Unbound(Advanced) conf, due to /var in RAM ?
    Delete that line and do a pfB Force Update.



  • Nope… The line was there:
    server:include: /var/unbound/pfb_dnsbl.conf

    But I removed it, did a force update and rebooted.
    Same problem.
    Unbound is stopped when the reboot is done.


  • Moderator

    Try to set the Resolver without the two DHCP registration checkboxs enabled… See the first post in this thread :)



  • I have read that post. :)

    Disable the two "DHCP registrations" checkboxes, unless you really require those options.

    I really require those, thats the reason I left them checked…  8)
    Will uncheck them and check if it fixes things for me.



  • It indeed works now.  ;D
    I will leave the two checkboxes unchecked and live without them.

    Btw many thanks for bringing this awesome package to us BBcan177.
    Much appreciated!



  • @BBcan177:

    This warning indicates that the masterfile is out of sync with the files in the /deny folder. This is a new feature that was added to v2.0 to warn users about this issue. Usually running a 'Force Reload' is sufficient to fix that warning; however, clearing out all the files and starting fresh might be needed in certain conditions. If this is still an issue, please review the pfblockerng.log file for other clues.

    Re-installed and re-configured from scratch, nothing helps, the warning is still there.
    No error in the log.
    /var/db/pfblockerng/deny is empty (I have permit aliases only).



  • I'm having another problem.
    All is working on my LAN interface but I have created a WIFI_GUEST interface.
    On the WIFI_GUEST interface it's not working. Some sites won't load at all.
    I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

    WIFI_GUEST firewall rules:



  • Thank you so much,
    any suggestions how to configure this ?
    on the list of action, have to use disable or deny inbound ?

    I've configured deny inbound and enabled alexa list but the webserver isn't starting at all
    pfBlockerNG DNSBL Web Server is not started yet .

    what I am doing wrong ?



  • @Panja:

    I'm having another problem.
    All is working on my LAN interface but I have created a WIFI_GUEST interface.
    On the WIFI_GUEST interface it's not working. Some sites won't load at all.
    I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

    WIFI_GUEST firewall rules:

    You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.



  • Does this only work with lists, or will it work with live dnsbl queries?


  • Banned

    @trinidadrancheria:

    will it work with live dnsbl queries?

    No.



  • Dear BBcan177 i just want to express my huge gratitude to you incorporating DNSBL. Im using it for couple of days so far. It is insane how god is behave on my network. It is really insane how good it is. It simply work and it blocks so much garbage that is almost impossible to believe.

    THANK YOU!



  • cant get it to work,
    the service is not starting." pfBlockerNG DNSBL Web Server "

    rebooted the box, remove the package , reinstall it, no vail

    please advise



  • @Hugovsky:

    You need a rule interface WIFI_GUEST interface source WIFI_GUEST net destination 127.0.0.1ports 8081 8443 so dnsbl can work.

    Thanks! It's working now. Created an alias for port 8081 + 8443 and added it to a rule to allow to 127.0.0.1
    It was the "Block access to firewall" rule that prevented it to work, right?

    This is the setup now, which is working. :)


  • Banned

    I think you guys are missing this (on the DNSBL tab) with multiple LANs:



  • Nope, did not miss that.
    As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
    I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

    So I checked both interfaces (LAN + WIFI_GUEST) on the DNSBL tab.
    And after that I went to the floating rule and both interfaces were marked in that rule.


  • Banned

    @Panja:

    Nope, did not miss that.
    As I stated here: https://forum.pfsense.org/index.php?topic=102470.msg574241#msg574241
    I have checked the floating rule and both interfaces (LAN + WIFI_GUEST) are checked.

    Have hard time seeing how's that screenshot showing anything floating.




  • Banned

    Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.



  • Guys, any suggestions why the webserver is not starting ?
    pfBlockerNG DNSBL Web Server is not starting,
    I've reinstalled the package but still no vail !



  • @doktornotor:

    Yes, so that works, apparently. That "Block access to firewall" ain't doing any good there, clearly.

    How would you do it any differently than?
    I want my WIFI_GUEST interface to have no access to the firewall.
    Guests are not to be allowed to do anything except browse the internet.

    [UPDATE]

    Is this any better than.  8)
    I have blocked the admin ports (http/https + ssh) to the firewall instead of all.



  • @Panja:

    I want my WIFI_GUEST interface to have no access to the firewall.
    Guests are not to be allowed to do anything except browse the internet.

    Understandable. I thing the same way.
    I did the same thing as you, and added 'sensitive ports' …..
    See image.




  • Thanks fellow Dutchman.  ;D
    I have created an alias with the admin ports now as well.
    See post above –> [UPDATE]


  • Banned

    @Jamerson:

    Guys, any suggestions why the webserver is not starting ?
    pfBlockerNG DNSBL Web Server is not starting,

    Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

    Copy and paste this to Diagnostics - Command Prompt - PHP Execute, click the 'Execute' button and problem fixed.

    
    $pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
    $rc = array();
    $rc['file'] = 'dnsbl.sh';
    $rc['start'] = << <eof<br># Start DNSBL Lighttpd webserver
    	if [ -f '{$pfb['dnsbl_conf']}' ]; then
    		/usr/local/sbin/lighttpd_pfb -f '{$pfb['dnsbl_conf']}'
    	fi
    
    	# Terminate DNSBL HTTPS Daemon if found
    	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
    	if [ ! -z "\${pidnum}" ]; then
    		/bin/kill -9 "\${pidnum}"
    		/bin/sleep 2
    	fi
    
    	# Start DNSBL HTTPS Daemon
    	/usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &
    
    EOF;
    
    $rc['stop'] = << <eof<br># Terminate DNSBL Lighttpd webserver, if found.
    	pidnum="$(/bin/pgrep lighttpd_pfb)"
    	if [ ! -z "\${pidnum}" ]; then
    		/usr/bin/killall lighttpd_pfb
    	fi
    
    	# Terminate DNSBL HTTPS Daemon, if found.
    	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
    	if [ ! -z "\${pidnum}" ]; then
    		/bin/kill -9 "\${pidnum}"
    		/bin/sleep 2
    	fi
    
    EOF;
    
    write_rcfile($rc);
    
    mwexec("/usr/bin/sed -i -e 's/\r//g' /usr/local/etc/rc.d/dnsbl.sh");
    mwexec_bg("/usr/local/etc/rc.d/dnsbl.sh start");</eof<br></eof<br> 
    


  • Is there a way, or will there be a way (in a future release) to add our own EasyList?
    As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

    Thanks



  • @doktornotor:

    @Jamerson:

    Guys, any suggestions why the webserver is not starting ?
    pfBlockerNG DNSBL Web Server is not starting,

    Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

    Copy and paste this to Diagnostics - Command Prompt - PHP Execute, click the 'Execute' button and problem fixed.

    
    $pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
    $rc = array();
    $rc['file'] = 'dnsbl.sh';
    $rc['start'] = << <eof<br># Start DNSBL Lighttpd webserver
    	if [ -f '{$pfb['dnsbl_conf']}' ]; then
    		/usr/local/sbin/lighttpd_pfb -f '{$pfb['dnsbl_conf']}'
    	fi
    
    	# Terminate DNSBL HTTPS Daemon if found
    	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
    	if [ ! -z "\${pidnum}" ]; then
    		/bin/kill -9 "\${pidnum}"
    		/bin/sleep 2
    	fi
    
    	# Start DNSBL HTTPS Daemon
    	/usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &
    
    EOF;
    
    $rc['stop'] = << <eof<br># Terminate DNSBL Lighttpd webserver, if found.
    	pidnum="$(/bin/pgrep lighttpd_pfb)"
    	if [ ! -z "\${pidnum}" ]; then
    		/usr/bin/killall lighttpd_pfb
    	fi
    
    	# Terminate DNSBL HTTPS Daemon, if found.
    	pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
    	if [ ! -z "\${pidnum}" ]; then
    		/bin/kill -9 "\${pidnum}"
    		/bin/sleep 2
    	fi
    
    EOF;
    
    write_rcfile($rc);
    
    mwexec("/usr/bin/sed -i -e 's/\r//g' /usr/local/etc/rc.d/dnsbl.sh");
    mwexec_bg("/usr/local/etc/rc.d/dnsbl.sh start");</eof<br></eof<br> 
    

    thank you mate,
    runned the php code but nothing happens .

    I get this error

    Diagnostics: Execute command help

    Note: this function is unsupported. Use it on your own risk!

    rebooted the firewall but the services still not starting


  • Banned

    And what exactly did you expect to happen? Check that the service is running. If not, post the output of

    
    /usr/local/etc/rc.d/dnsbl.sh start
    
    

    here. And post the entire file here as attachment.



  • @doktornotor:

    And what exactly did you expect to happen? Check that the service is running. If not, post the output of

    
    /usr/local/etc/rc.d/dnsbl.sh start
    
    

    here. And post the entire file here as attachment.

    thank you for your answer,
    I was expecting the service would start after I run the command.
    isn't that the aim ?
    when I run the command the firewall doesn't respond at all !
    i'v tired different command to check if it will responde and it does.

    the command

    [2.2.5-RELEASE][root@firewall]/root: /usr/local/etc/rc.d/dnsbl.sh start

    [2.2.5-RELEASE][root@Pfsense]/root:
    [2.2.5-RELEASE][root@Pfsense]/root:

    is not responding at all.


Log in to reply