PfBlockerNG v2.0 w/DNSBL
-
Hey Ron,
Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.
M
The tables are built from MaxMind GeoIPLite2 database, pfblockerNG just take the db and create the files for it's usage. MaxMind support has been contacted about the size being 3x larger than before.
-
In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?
Cheers Qinn
-
In the Status/System Logs / Settings there is the option "Show log entries in reverse order" is this possible for the log browser in pfBlockerNG?
Cheers Qinn
System logs are one liner, pfblockerng.log is formated to be read top to bottom.
-
Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)- Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"
hpHosts
http://hosts-file.net/download/hosts.zipSWC
http://someonewhocares.org/hosts/hostsspam404
https://spam404bl.com/blacklist.txt
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txtmalc0de
https://malc0de.com/bl/BOOTMDS (use 'Flex' state)
https://mirror1.malwaredomains.com/files/justdomainsMVPS
http://winhelp2002.mvps.org/hosts.txtMDL
http://www.malwaredomainlist.com/hostslist/hosts.txtGJTech
http://adblock.gjtech.net/?format=unix-hostsdShield_SD (They also have a conservative list available)
https://www.dshield.org/feeds/suspiciousdomains_High.txtZeus
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist- These two feeds post full URLs, so there can be some more false positives.
Create a new Alias, and use Alexa as a recommendation.
PhishTank
https://data.phishtank.com/data/online-valid.csv.bz2OpenPhish
https://www.openphish.com/feed.txtMPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
https://lists.malwarepatrol.net-
This is a feed that I manage (as time permits)
MS_2
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw -
Use this in its own Alias:
BBC_DGA (This is a large feed of DGA for the likes of Cryptolocker et al…)
http://osint.bambenekconsulting.com/feeds/dga-feed.gzBBC_C2
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt- Use this feed in its own alias as it is updated more frequently.
So you can update it more often than once per day.
hpHosts_partial
http://hosts-file.net/hphosts-partial.aspIf users find other feeds, please post back so that others may benefit also.
Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.I got a
[ DNSBL FAIL ] [ Skipping : GJTech ]
[1471592032] unbound-checkconf[36350:0] error: error parsing local-data at 30 '}).filter(' 60 IN A 10.10.10.1': Syntax error, could not parse the RR's TTL
[1471592032] unbound-checkconf[36350:0] error: Bad local-data RR }).filter(' 60 IN A 10.10.10.1
[1471592032] unbound-checkconf[36350:0] fatal error: failed local-zone, local-data configuration
[ dShield_SD ] exists. [ 08/19/16 09:33:52 ]…..are the use of the sources mentioned above still to be advised? My Count went from 78k to a 476k and looking at the packets those extra 400k doesn't seem to be highly effective.
Thanks for any advise,
Cheers Qinn
- Create a new alias for these.
-
The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
Just turn the list state to OFF. -
The http://adblock.gjtech.net/?format=unix-hosts doesn't seem to be available anymore.
Just turn the list state to OFF.Thanks RonpfS for the reply.
-
I set this up last night and so far good other than certification error pop ups i keep getting on certain sites. Anyone know if there is a fix for this?
Also, do you guys use IPv4 lists and DNSBL or just one?
-
Try Chrome or Firefox.
-
-
-
The way I resolved it is to permanently add cert… click show cert and choose trust check box this will add trust but when it resolves it is handeled dnsbl and returns 1x1pixel.
-
Here is a link to PR # 175 for pfBlockerNG v2.1.1_3
https://forum.pfsense.org/index.php?topic=115357.msg649167#msg649167
-
2.1.1_4 is out , hopefully the answer to all
-
Good morning. I'm having the cannot allocate memory issue after upgrading from 2.1.1_2 to 2.1.1_3, then to 2.1.1_4. Uninstalling and reinstalling with and without keep settings checked off and i am still getting the cannot allocate memory error in pfsense. I've also been doing a force update after each try just in case.
Looking at the pfblockerng.log i cannot see any errors or failures. see below for exact error from pfsense.
There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18
if it helps i have 16GB in the FW.
Thanks.
-
There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table pfB_SAmerica_v6: Cannot allocate memory - The line in question reads [46]: table <pfB_SAmerica_v6> persist file "/var/db/aliastables/pfB_SAmerica_v6.txt" @ 2016-08-26 09:28:18
if it helps i have 16GB in the FW.
Thanks.
You should have leave you original post in the pfBlockerNG v2.1 w/TLD thread.
It is mentionned many many times that if you are using GeoIP tables, you need to raise Firewall Maximum Table Entries in System / Advanced / Firewall & NAT
The file on my pfsense is called South_America_v6.txt, maybe you have leftover from the previous installation. Open the Africa GeoIP tab, verify your selections and hit save, this will update the table. Then run Force Reload IP.
I just enabled the South America GeoIP table on my system and it has the same name as yours pfB_SAmerica_v6, so it is probably just a table size issue. -
Thank you I raised it to 4.5M to be safe.
I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.
I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.
Once again thank you.
-
I pulled it out of there because it looked like that forum was for the dnsbl tld. Many people get annoyed when something is posted in the wrong place.
2.1.1_4 is pfBlockerNG with DNSBL and TLD. No harm done, one thread or the other will do. But it may be better to use the pfBlockerNG v2.1 w/TLD in the future.
I also saw that but thought it may no longer applicable once the php updates for pfblockerng were released. I thought that was a short term fix only until the next release.
The size of MaxMind GeoIP database is 3-5x larger than previously, that used to make php crashes with the 2.1.1_2 version, this has been fixed.
However the tables generated are 3-5x larger as well, that requires an increase to the Firewall Maximum Table Entries as the default value isn't enough.
-
Thank you for the clarification. I appreciate it. I will endeavor to use that forum for these posts in the future. ;D
-
Hi all,
It's there a way to uninstall this from cli?
I did a mistake and loaded all Africa from geoip section and now Pfsense is not accessible anymore. I suspect it's overloaded. -
my issue seems to be fixed now thanks to BBcan177 and RonpfS who ware supporting me with all posted issues.
As a resume here what i did as a short recap:-
fresh install 2.1.1_4 !!!
-
SystemAdvancedFirewall & NAT change 2 values:
Firewall Maximum States : 2000000 # this ca be leave as default…i prefered to make the change.
Firewall Maximum Table Entries : 10000000 -
reboot sistem if you can if not just enable pfblokerng and run a manual update.
Everything seems to run pretty well now.
Thanks again guys. -
