PfBlockerNG v2.0 w/DNSBL


  • Banned

    Uhm??? And what output exactly are you expecting? This is NORMAL! If there are no errors, there won't be any output. How exactly are you determining that your service is NOT running?



  • Than you for your answer,
    attached picture is showing that the services is not running .
    when i try to run the service manually it said it started but nothings happend

    thank you

    ![Screen Shot 2015-11-25 at 9.13.32 PM.png](/public/imported_attachments/1/Screen Shot 2015-11-25 at 9.13.32 PM.png)
    ![Screen Shot 2015-11-25 at 9.13.32 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-11-25 at 9.13.32 PM.png_thumb)



  • Hi!

    I am having a short question to the different aliases for the different lists as suggested here https://forum.pfsense.org/index.php?topic=102470.msg573159#msg573159.
    So, apart from having the possibility to set a different update-interval is thtere another benefitout of it?

    thanks in advance and many thanks to BBCan177  :)!


  • Banned

    V@schnubert:

    So, apart from having the possibility to set a different update-interval is thtere another benefitout of it?

    The Alexa whitelisting is also per-alias. (You normally do NOT want to whitelist most "popular" advertising sites…)



  • Valid point…  ;)

    I wasnt investing Alexa so far, it seems I should!

    thanks!  :D



  • Today I updated PfblockerNG to version 2.0.1 and enabled and configured DNSBL like BBcan177 explained at https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943 after some fiddling around (I exchanged dnsforwarder with dnsresolver) it started. But now I have another problem I can't solve. I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

    How can I make reverse lookups work again?


  • Moderator

    @trinidadrancheria:

    I was thinking about using the new features of pfBlockerNG 2.0 to stop spam at the firewall since the current version of PostFix does not yet support DNSBL out of the box..

    IP lists and DNSBL feeds can protect a Mail server, but it won't replace DNS RBL functionality of Postfix/SpamAssassin etc…

    @AndrewZ:

    Re-installed and re-configured from scratch, nothing helps, the warning is still there.
    No error in the log.
    /var/db/pfblockerng/deny is empty (I have permit aliases only).

    @AndrewZ,
    De-duplication is only used for Deny rules. So just disable dedup to clear that warning message.

    @ha11oga11o:

    Dear BBcan177 i just want to express my huge gratitude to you incorporating DNSBL. Im using it for couple of days so far. It is insane how god is behave on my network. It is really insane how good it is. It simply work and it blocks so much garbage that is almost impossible to believe.

    THANK YOU!

    Thanks!

    @doktornotor:

    Yes. Because a variable is undefined on install (see the first line in the code below), so it creates a broken /usr/local/etc/rc.d/dnsbl.sh with missing path to the lighttpd config file.

    Thanks Dok… I will get that variable fixed asap.

    @schnubert:

    So, apart from having the possibility to set a different update-interval is there another benefit out of it?

    @schnubert,
    Most DNSBL lists are updated on a daily basis… hpHosts has a partial feed that updates more frequently. You can see the last updated timestamp for IP/DNSBL Lists/feeds at the end of the pfBlockerng.log after any Cron event.

    @Gé:

    I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

    Probably best to ask for help in the DNS forum section for this issue.

    @Jamerson:

    Than you for your answer, attached picture is showing that the services is not running .
    when i try to run the service manually it said it started but nothings happened

    @Jamerson,
    Please edit the following file  /usr/local/etc/rc.d/dnsbl.sh

    and add the line in red as shown below:

    186 update_static_output(" done.\nCreating DNSBL web server start-up script…");
          $pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
    187 $rc = array();

    Then run:

    /usr/local/etc/rc.d/dnsbl.sh start
    

    Also did you follow the checklist here:
    https://forum.pfsense.org/index.php?topic=102470.msg573776#msg573776



  • @Panja:

    Is there a way, or will there be a way (in a future release) to add our own EasyList?
    As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

    Thanks

    Can this be done?



  • @BBcan177:

    @Gé:

    I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

    Probably best to ask for help in the DNS forum section for this issue.

    I could do that. This morning wen i woke up several wlan users complained they couldn't get on the internet. i can't see anything wrong in pfsense everything seems to work but i can't get to internet on wlan. To many trouble with DNSBL so i'm going to disable DNSBL and start using dns-forwarder again and pfblocker without dnsbl. I also had to stop using ram file system for /var and /tmp because here also trouble because /var was full all the time wen i use dnsbl. anyway to much problems.

    Edit: Wlan problems seem to be that pfsense local freeradius server can't be reached anymore.



  • @Jamerson,
    Please edit the following file  /usr/local/etc/rc.d/dnsbl.sh

    and add the line in red as shown below:

    186 update_static_output(" done.\nCreating DNSBL web server start-up script…");
          $pfb['dnsbl_conf'] = '/var/unbound/pfb_dnsbl_lighty.conf';
    187 $rc = array();

    Then run:

    /usr/local/etc/rc.d/dnsbl.sh start
    

    Also did you follow the checklist here:
    https://forum.pfsense.org/index.php?topic=102470.msg573776#msg573776

    thank you so much for your answer,
    the check list is already enabled ,
    I've checked the as show but can't seem the find the location on the code to add the red line
    below is what it shows on the dnsbl.sh file

    #!/bin/sh

    This file was automatically generated

    by the pfSense service handler.

    rc_start() {

    Start DNSBL Lighttpd webserver

    if [ -f '/var/unbound/pfb_dnsbl_lighty.conf' ]; then
    /usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
    fi

    Terminate DNSBL HTTPS Daemon if found

    pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
    if [ ! -z "${pidnum}" ]; then
    /bin/kill -9 "${pidnum}"
    /bin/sleep 2
    fi

    Start DNSBL HTTPS Daemon

    /usr/local/bin/php -f /usr/local/pkg/pfblockerng/pfblockerng.inc dnsbl &

    }

    rc_stop() {

    Terminate DNSBL Lighttpd webserver, if found.

    pidnum="$(/bin/pgrep lighttpd_pfb)"
    if [ ! -z "${pidnum}" ]; then
    /usr/bin/killall lighttpd_pfb
    fi

    Terminate DNSBL HTTPS Daemon, if found.

    pidnum="$(/bin/ps -wax | /usr/bin/grep '[p]fblockerng.inc dnsbl' | /usr/bin/awk '{print $1}')"
    if [ ! -z "${pidnum}" ]; then
    /bin/kill -9 "${pidnum}"
    /bin/sleep 2
    fi

    }

    case $1 in
    start)
    rc_start
    ;;
    stop)
    rc_stop
    ;;
    restart)
    rc_stop
    rc_start
    ;;
    esac



  • @Panja:

    Is there a way, or will there be a way (in a future release) to add our own EasyList?
    As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

    Thanks

    Concur to that as well!


  • Moderator

    @Ibor:

    @Panja:

    Is there a way, or will there be a way (in a future release) to add our own EasyList?
    As a Dutchman, I would like to add the Dutch EasyList, to block elements specially found on Dutch websites.

    Thanks

    Concur to that as well!

    @Panja @Ibor Daru,

    Yes this can be done. However, I am working on porting the package to 2.3 (Bootstrap) and trying to manage day-to-day life at the same time…  :)

    ADBlock works differently than DNSBL... ADBlock can filter domains as follows:

    www.cnn.com/banners/example.com

    AdBlock will filter any domain listed in the /banners folder, but DNSBL will need to know explicitly which Domains to block. ADBlock also has subdomains which if used in DNSBL will cause severe False Positives.

    So to use any of the other ADBlock EasyList feeds (Dutch, Chinese, German etc...) I have to know which categories are the actual ADvert domains. Not all of the ADBlock EasyList Feeds can be used...

    If you look at the DNSBL EasyList Tab, you can see which categories are being used for EasyList (w/o Elements) and EasyList Privacy.. You can compare this to the raw EasyList file and manually add the Dutch EasyList ADvert domains and add those to a Custom List for DNSBL. Just make sure that its formatted to one domain per line.

    It is something that I would like to do... Just need to find some time... But it will be added :)


  • Moderator

    @Gé:

    @BBcan177:

    @Gé:

    I have a local domain at a local bind9 I override my local domain in dnsresolver like I did before with dnsforwarder but now I can't do reverse lookups anymore.

    Probably best to ask for help in the DNS forum section for this issue.

    I could do that. This morning wen i woke up several wlan users complained they couldn't get on the internet. i can't see anything wrong in pfsense everything seems to work but i can't get to internet on wlan. To many trouble with DNSBL so i'm going to disable DNSBL and start using dns-forwarder again and pfblocker without dnsbl. I also had to stop using ram file system for /var and /tmp because here also trouble because /var was full all the time wen i use dnsbl. anyway to much problems.

    Edit: Wlan problems seem to be that pfsense local freeradius server can't be reached anymore.

    Sorry to hear that… Did you have DHCP registration enabled in the Resolver? There seems to be some underlying issues with that feature in the Resolver. DNSBL just does a Resolver reload to get its updates into the Resolver. Take a look at the resolver.log and the system.log to see what the error messages were... I added notes about this in the instructions posted in this thread.

    I do not have a lot of extra configuration in the Resolver for overrides and thats why I suggest you ask in the DNS forum as those guys live that stuff every day and can better reply to that particular issue...

    In regards to your issue with WLANs, make sure that those other LAN segments can see the DNSBL VIP or else DNSBL will not function. You can click the checkbox in the DNSBL tab to auto create a Floating firewall rule for that... But also make sure there are no other rules that can block access to the DNSBL VIP. Try to ping the DNSBL IP from thhe WLAN as a test...

    On another note: Seems someone recently gave a negative smite….  ???


  • Moderator

    @Jamerson:

    thank you so much for your answer,
    the check list is already enabled ,
    I've checked the as show but can't seem the find the location on the code to add the red line
    below is what it shows on the dnsbl.sh file

    Jamerson,  sorry about that… you can disregard those instructions... The key point here is that these lines in the dnsbl.sh file (in red) file are correct...

    if [ -f '[color=red]/var/unbound/pfb_dnsbl_lighty.conf' ]; then
          /usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
    fi

    I sent you a PM to see if we can work out this issue offline, and I can go from there… Thanks!



  • BBcan177 no worries!
    We all have lives to live.  8)
    So no pressure mate. Just wanted to check.
    Good to hear it's coming. I'll just wait. I'm a patient dude.  ;)



  • @BBcan177:

    @Jamerson:

    thank you so much for your answer,
    the check list is already enabled ,
    I've checked the as show but can't seem the find the location on the code to add the red line
    below is what it shows on the dnsbl.sh file

    Jamerson,  sorry about that… you can disregard those instructions... The key point here is that these lines in the dnsbl.sh file (in red) file are correct...

    if [ -f '[color=red]/var/unbound/pfb_dnsbl_lighty.conf' ]; then
          /usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
    fi

    I sent you a PM to see if we can work out this issue offline, and I can go from there… Thanks!

    much appreciate your support,
    will reply on the PM



  • Hi,

    i had installed pfblockerNG and setup  IPv4 Alias/List Configuration to create  IPv4 Lists (for example source: http://list.iblocklist.com/?list=xshktygkujudfnjfioro&fileformat=p2p&archiveformat=gz).But this rule block my important website (like Hotmail and  other ) i don't want to disable or delete this list. Do i have any other method?(like whitelist and how to do) Thanks!



  • @Jamerson:

    @BBcan177:

    @Jamerson:

    thank you so much for your answer,
    the check list is already enabled ,
    I've checked the as show but can't seem the find the location on the code to add the red line
    below is what it shows on the dnsbl.sh file

    Jamerson,  sorry about that… you can disregard those instructions... The key point here is that these lines in the dnsbl.sh file (in red) file are correct...

    if [ -f '[color=red]/var/unbound/pfb_dnsbl_lighty.conf' ]; then
          /usr/local/sbin/lighttpd_pfb -f '/var/unbound/pfb_dnsbl_lighty.conf'
    fi

    I sent you a PM to see if we can work out this issue offline, and I can go from there… Thanks!

    much appreciate your support,
    will reply on the PM

    thank you so much for your help,
    I didn't read the instruction carefully ,
    the servers is on and everything is working fine

    thank you so much BBCAN



  • @BBcan177:

    Sorry to hear that… Did you have DHCP registration enabled in the Resolver? There seems to be some underlying issues with that feature in the Resolver. DNSBL just does a Resolver reload to get its updates into the Resolver. Take a look at the resolver.log and the system.log to see what the error messages were... I added notes about this in the instructions posted in this thread.

    I do not have a lot of extra configuration in the Resolver for overrides and thats why I suggest you ask in the DNS forum as those guys live that stuff every day and can better reply to that particular issue...

    In regards to your issue with WLANs, make sure that those other LAN segments can see the DNSBL VIP or else DNSBL will not function. You can click the checkbox in the DNSBL tab to auto create a Floating firewall rule for that... But also make sure there are no other rules that can block access to the DNSBL VIP. Try to ping the DNSBL IP from thhe WLAN as a test...

    On another note: Seems someone recently gave a negative smite….  ???

    Thank you BBcan177 for the information I wil try it soon again. I had to do a full backup restore to get pfSense back on track. I have to get some new courage to give it another shot.

    I selected all the network segments and as long as the wlan client were still connected they could reach the vip address the dnsbl webserver. Wen the wlan client reconnects it got a authentication error because pfsense could not reach the local radius server. I searched for hours to find what cause this but couldn't find it.

    It wasn't me btw who gave you the childish smite you do and did a GREAT job!


  • Banned

    @csircc:

    i had installed pfblockerNG and setup  IPv4 Alias/List Configuration to create  IPv4 Lists (for example source: http://list.iblocklist.com/?list=xshktygkujudfnjfioro&fileformat=p2p&archiveformat=gz).But this rule block my important website (like Hotmail and  other ) i don't want to disable or delete this list. Do i have any other method?(like whitelist and how to do) Thanks!



  • Passing my comment from the other topic to this one

    Somtimes the reporting of the Alerts misses the list matching! I had this problem today.

    List 1 - Alias_Deny (De-Duplication enabled)
    List 2 - Alias_Native

    Interface 1
    Block List 1

    The IP1 is in both lists, because Alias_Native does not passes by the De-Duplication process.

    I had a hit on Interface 1 of IP1 and in the alert tab appeared the information that the hit is from List 2 (that does not even appears on the Interface)

    Thank You all



  • One extra that would be very useful is the ability to export (automatic) the lists to the webserver of PFSense, that way I could use the same list on other computers and only maintain it in pfsense. This is useful because when I'm not at home I like to use on my personal laptop the lists with PeerBlock!

    Nice Job



  • Hi, BBCan77

    I got first crash report since upgraded to v2:

    PHP Errors:
    [27-Nov-2015 12:14:53 America/Toronto] PHP Fatal error:  Maximum execution time of 900 seconds exceeded in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 1662



  • Thank you BBCAN,
    I've tested it and it works fine really clean internet.
    the only think I notice is the DHCP server stops sharing IPS,
    is this related to the DNSBL ?
    please advise.



  • Any1 has the issue about failed to download Snort rules from Snort website since Nov. 24?  It seemed this is an issue after upgrading to pfBlockerNG v2.0. but I'm not sure, don't know which dns feed block it, and I don't have any clue from the Alert tab either.

    EDIT:  Its the DNS: s3.amazonaws.com, was blocked by the DNSBL MPatrol feed. Adding it to the suppression list solves.



  • I've sorted the issue with the snortBL by setting the state to FLEX. It had a curl ssl error code 200 . This could be seen in view log in the update tab. So setting to FLEX also resolves a curl 200 status code.

    -John-


  • Moderator

    @pfcode:

    Any1 has the issue about failed to download Snort rules from Snort website since Nov. 24?  It seemed this is an issue after upgrading to pfBlockerNG v2.0. but I'm not sure, don't know which dns feed block it, and I don't have any clue from the Alert tab either.

    I posted in the IDS forum… Try to avoid double posting...

    @JohnPFsense:

    I've sorted the issue with the snortBL by setting the state to FLEX.

    The issue that pfcode is having, is with the Snort VRT rulesets for the IDS/IPS Snort… not the snort IP list. But yes the Snort IP list needs to use 'Flex'... Would be nice if Snort actually had a proper cert for their HTTPS site :)


  • Moderator

    @Jamerson:

    Thank you BBCAN,
    I've tested it and it works fine really clean internet.
    the only think I notice is the DHCP server stops sharing IPS,
    is this related to the DNSBL ?
    please advise.

    Not related to DNSBL… Only thing that I suggest, is not to use the two "DHCP Registration" checkboxes in the Resolver, as that seems to have issues on Reload.


  • Moderator

    @soloam:

    One extra that would be very useful is the ability to export (automatic) the lists to the webserver of PFSense, that way I could use the same list on other computers and only maintain it in pfsense. This is useful because when I'm not at home I like to use on my personal laptop the lists with PeerBlock!

    Nice Job

    Peerblock would probably need the files to be formatted in a certain way? There is a file in:    /var/db/pfblockerng/mastercat  which is a complete list of IPs (Deny).


  • Moderator

    @soloam:

    Passing my comment from the other topic to this one

    Somtimes the reporting of the Alerts misses the list matching! I had this problem today.

    List 1 - Alias_Deny (De-Duplication enabled)
    List 2 - Alias_Native

    Interface 1
    Block List 1

    The IP1 is in both lists, because Alias_Native does not passes by the De-Duplication process.

    I had a hit on Interface 1 of IP1 and in the alert tab appeared the information that the hit is from List 2 (that does not even appears on the Interface)

    Thank You all

    This is a hard one to solve when "Alias Native" lists are used since multiple lists can have the same IP.. Alerts tab is not superhuman :)



  • Trouble with whitelist

    Since the update to pfBlockerNG v2.0 w/DNSBL I'm having a problem whitelisting some IPs. I'm not sure exactly if the problem started before I tried using the DNS blocklist option, or purely from updating pfBlockerNG.
    I turned off the dns forwarder and turned on the dns resolver and the DNSBL worked nicely, some alerts appeared in the alert tab. Besides updating PfBlockerNG and trying the DNSBL option I did not change anything to my IP blocklists or whitelist.
    I noticed that my whitelist wasn't working anymore. No more green icons in the firewall log dashboard gadget and nothing in the permit section of the pfBlockerNG: Alerts tab. I disabled the DNSBL and went back to the dns forwarder. This didn't help. I tried rebooting, flusing the firewall state table and reinstalling pfBlockerNG (keeping the settings tab checked). This didn't help either.

    When I look at the iplist update log, my whitelist shows up in the Permit List with the correct number of IPs.
    The blocked IPs that I want to whitelist  are blocked by the country list.

    Does anyone have the same problem? Searching the forum I get the impression this is not a universal problem.

    Suggestions would be greatly appreciated.

    • John -

  • Moderator

    JohnPFsense,

    For this whitelist, did you select "permit_outbound" in the alias? Does it create a firewall permit rule in the outbound firewall tab? Also ensure that the 'Rule order' is set to order the Permit rules above the block/reject rules.



  • @BBcan177:

    JohnPFsense,

    For this whitelist, did you select "permit_outbound" in the alias? Does it create a firewall permit rule in the outbound firewall tab? Also ensure that the 'Rule order' is set to order the Permit rules above the block/reject rules.

    I did select permit_outbound, I also tried permit_both just to check. That did not help. I can see a permit rule in the Firewall: Rules tab.  After some fiddling around I figured it out thanks to your suggestion. It was te "Rule order" The original setting apparently doesn't work as it used to. I left it at default after my pfBlockerNG update.
    I also figured out that using the pfSense Pass/Match first order totally negates any block rule if "default pass LAN to any rule" is present. This could not be seen in the firewall dashboard widget. The last blocked packet was shown from before the settings change. Some vague memories about ipchains are coming to the surface, but I am not a networking expert.

    Thanks a lot for your quick response, knowing what to do and teaching me something on top of it.

    • John -


  • I get an error when updating the BBC_DGA list as follows:

    [ DNSBL FAIL ] [ Skipping : BBC_DGA  ]

    /var/unbound/check.conf:6: error: cannot open include file '/var/db/pfblockerng/dnsbl/BBC_DGA': No such file or directory
    /var/unbound/check.conf:6: error: unknown keyword '.bk'
    read /var/unbound/check.conf failed: 2 errors in configuration file

    Anyone got a clue ?


  • Moderator

    @azmo:

    I get an error when updating the BBC_DGA list as follows:

    [ DNSBL FAIL ] [ Skipping : BBC_DGA  ]

    /var/unbound/check.conf:6: error: cannot open include file '/var/db/pfblockerng/dnsbl/BBC_DGA': No such file or directory
    /var/unbound/check.conf:6: error: unknown keyword '.bk'
    read /var/unbound/check.conf failed: 2 errors in configuration file

    Anyone got a clue ?

    BBC DGA is a large GZ download (16M Extracted - I don't readily have the gz file size). Maybe its timing out on you? Do you have a slow connection?



  • @reggie14:

    @mbarnes:

    What about setting your virtual address to 0.0.0.0? As that whole /8 is non-routable, you wouldn't get the cert error. It would just silently fail to load ads.

    While that might hide the cert error, there would be downsides.  First, some some pages will hang as they wait for the ad server to respond.  Second, blackholing the traffic completely by setting the VIP to something other than the DNSBL webserver will disable alerts.  That would create problems, because the regular ad-blocking lists WILL break some sites and mobile apps.  The alerts are, by far, the easiest way to track down problems.

    There are better plausible workarounds, but we need to see some examples to understand under what circumstances people run into cert errors.

    I manually set ad domains to 127.0.0.1, which results in a "Non-existent domain" response from Unbound. No waiting for timeouts. A website or app that breaks if ads can't be reached is a site or app I don't care about. Others may not be able to say that.

    Every website that has annoying ads, I've been blackholing DNS for over a year without issues. Results may vary.



  • @BBcan177:

    @Jamerson:

    Thank you BBCAN,
    I've tested it and it works fine really clean internet.
    the only think I notice is the DHCP server stops sharing IPS,
    is this related to the DNSBL ?
    please advise.

    Not related to DNSBL… Only thing that I suggest, is not to use the two "DHCP Registration" checkboxes in the Resolver, as that seems to have issues on Reload.

    i've noticed the LAN had the same IP as the DNSBL.
    change it to 10.10.30.1 now let test.
    i'll report back
    one notice MAC book users keep getting error certificate when they visit youtube.
    certificate can't be identified  " Safari can't identify the website certificate "
    anyway of avoiding this ? is kinda frustrating.
    thank you
    thank you



  • When I select Match Both, with Floating Rules enabled, 1 rule is generated Source on the Wan interface. Same as Match Inbound. If I select Match Outbound, no rule is created ?

    With Deny Both 2 rules are created:  Source on WAN  and Destination on LAN.
    I was expecting that Match Both would also create 2 rules.

    The other odd thing is that the match rules are shown as Block with the Red X, maybe because there is no Match icon in the System Logs/Firewall GUI. This is confusing as it is not blocked at that stage.

    pfBlockerNG 2.0.1
    2.2.5-RELEASE (i386)



  • @Harvy66:

    I manually set ad domains to 127.0.0.1, which results in a "Non-existent domain" response from Unbound. No waiting for timeouts. A website or app that breaks if ads can't be reached is a site or app I don't care about. Others may not be able to say that.

    Every website that has annoying ads, I've been blackholing DNS for over a year without issues. Results may vary.

    Truth be told, I suspect blackholing undesirable traffic along those lines should work for most things.  I haven't tried it myself to see what could go wrong.  But, that kind of blackholing would kill the logging system pfBlockerNG uses for the Alerts page.  For non-HTTPS traffic, pfBlockerNG logs blocked traffic when an endpoint pulls down the php page that its redirected to.  This logging method has the advantage of logging blocked traffic even when DNS entries are cached by an endpoint, and also captures other useful diagnostic information, such as the referrer URL, which tells you what page you were looking at that had the blocked traffic.

    Redirection doesn't work for HTTPS traffic, as the browser won't complete a TLS handshake with the DNSBL webserver due to the certificate issue.  So, BBcan177 came up with a workaround that basically logs the failed HTTPS connection.  But, while alerts are still logged, this method doesn't provide the same amount of information.

    Getting the Alerts working reliably is very important.  The common DNS blocklists include things that definitely will break stuff.  Many include various AWS domains, which breaks all kinds of things.  Separate from that, I found that the Amazon and HBO Go apps did not work properly until I unblocked a few domains.  I'm sure those aren't the only examples.




Log in to reply