PfBlockerNG v2.0 w/DNSBL



  • @reggie14:

    @Harvy66:

    I manually set ad domains to 127.0.0.1, which results in a "Non-existent domain" response from Unbound. No waiting for timeouts. A website or app that breaks if ads can't be reached is a site or app I don't care about. Others may not be able to say that.

    Every website that has annoying ads, I've been blackholing DNS for over a year without issues. Results may vary.

    Truth be told, I suspect blackholing undesirable traffic along those lines should work for most things.  I haven't tried it myself to see what could go wrong.  But, that kind of blackholing would kill the logging system pfBlockerNG uses for the Alerts page.  For non-HTTPS traffic, pfBlockerNG logs blocked traffic when an endpoint pulls down the php page that its redirected to.  This logging method has the advantage of logging blocked traffic even when DNS entries are cached by an endpoint, and also captures other useful diagnostic information, such as the referrer URL, which tells you what page you were looking at that had the blocked traffic.

    Redirection doesn't work for HTTPS traffic, as the browser won't complete a TLS handshake with the DNSBL webserver due to the certificate issue.  So, BBcan177 came up with a workaround that basically logs the failed HTTPS connection.  But, while alerts are still logged, this method doesn't provide the same amount of information.

    Getting the Alerts working reliably is very important.  The common DNS blocklists include things that definitely will break stuff.  Many include various AWS domains, which breaks all kinds of things.  Separate from that, I found that the Amazon and HBO Go apps did not work properly until I unblocked a few domains.  I'm sure those aren't the only examples.

    My guess is my limited list doesn't cause issues, but when you feed a list of 1k+ records, one of those may break a page. In general, web pages should function on their own, except when referencing CDN resources.

    The only time I care about logging is when debugging an issue. Being a home user, I have the convenience of debugging after the fact instead of digging through logs for a one-off that needs to be solved.

    What I really don't want is yet another service listening to a port on my firewall. But if there is a high enough risk of breaking popular sites, then I guess I'd rather not blackhole. I'd be interested to know what that risk is. How many of the top 1000 sites completely break when blackholing DNS instead of redirecting?

    There is also the issue that Chrome and others are looking at making self-signed certs virtually useless in the near future. I'd rather not have to install a self-signed CA to every device on my network, especially when visitors come over.

    "Hey bro, I have this ad block on my network, you'll need to add my self-signed root-CA to your computer, otherwise your browser is going to throw a tantrum on every site you visit"

    Just saying.


  • Moderator

    @Harvy66:

    "Hey bro, I have this ad block on my network, you'll need to add my self-signed root-CA to your computer, otherwise your browser is going to throw a tantrum on every site you visit"

    Hi Harvey, there is nothing in the Instructions to require adding any self-signed CAs to any browser? As reggie14 has stated, adding a Self-Signed CA to a browser will not achieve anything either.

    There is a self-signed CA for DNSBL but that is only there so that the Browser will terminate the connection when it sees that it is not a valid cert for HTTPs. Without a DNSBL Cert, the Browser will take more time to terminate the session. DNSBL then uses the Lighttpd error.conditional log to find the Domains that failed and log those requests to the Alerts Tab.

    I think its best not to base everything on a few exceptions that break browsing, or cause some nuisance alerts. Most of those seem to be on Safari anyways. Suppressing those domains is also easy to accomplish.

    And if you have a Guest network, and you wanted to bypass DNSBL, then you would just assign a different DNS server (ISP or Google) for that LAN segment via DHCP and the issue is moot.



  • Getting back to the main issue, I'd be curious to see some examples of websites that generate a HTTPS/TLS warning/error message.  I haven't had any recently, except for when I click on a link that redirects me through tracking domains (SlickDeals.net are a good example of this).  I haven't gotten any error messages when there's simply an ad on a page that gets blocked.



  • Hi, I'm a bit confused as how to configure pfBlockerNG.

    I run a server, just a Mumble and a game server. I only wish them to be port-forwarded for IPs of my country (Sweden).

    For instance, Mumble runs on the default 64738. I have it port-forwarded in firewall NAT. With pfBlockerNG running, I select 'Sweden' under Countries->Europe. Under 'List Action' I select 'Permit Both'. I Force Update.

    Rule order is default pfB_Pass/Match | pfB_Block/Reject | pfSense Pass/Match.

    My UK-based friend has no issues connecting, which is not my intention.  How exactly would I go about to configure this?

    Thanks a bunch in advance.



  • Select all countries except Sweden. Set action to deny inbound.


  • Banned

    @Gé:

    Select all countries except Sweden. Set action to deny both.

    Nooooooooooooooooooooooooooooo!!! Here we go again.

    Look. This is absolutely absurd. Use the Sweden as alias for the traffic source on the port-forwarding rule, instead of blocking the entire world. WTF.



  • Again?
    Geez  :o



  • @doktornotor:

    @Gé:

    Select all countries except Sweden. Set action to deny both.

    Nooooooooooooooooooooooooooooo!!! Here we go again.

    Look. This is absolutely absurd. Use the Sweden as alias for the traffic source on the port-forwarding rule, instead of blocking the entire world. WTF.

    This much I've realized. It's just that exactly how I would go about doing what you just described? Does it mean 'List Action' be 'Alias'? Do these aliases have anything to do with the aliases in Advanced Inbound Firewall Rule Settings? I apologize for my ignorance, it's just that the one sentence "Use the Sweden as alias for the traffic source on the port-forwarding rule" doesn't explain it enough for me, unforuntately.



  • Much as I hate to dip into this, it should be pointed out that high level statements like this should be viewed as guidelines rather than absolute rules. The reason for this guideline is to help keep the number of rules under control. Depending upon the reputation lists you have and your de-dup settings, you may end up with about the name number of rules either way. If you care about efficiency, the appropriate thing to do is to compare the number of resulting rules and choose your approach based on the actual numbers.

    @doktornotor:

    Nooooooooooooooooooooooooooooo!!! Here we go again.

    Look. This is absolutely absurd. Use the Sweden as alias for the traffic source on the port-forwarding rule, instead of blocking the entire world. WTF.


  • Moderator

    @superapan:

    I run a server, just a Mumble and a game server. I only wish them to be port-forwarded for IPs of my country (Sweden).

    See the following:
    https://forum.pfsense.org/index.php?topic=99987.msg572399#msg572399


  • Banned

    @dennypage:

    If you care about efficiency, the appropriate thing to do is to compare the number of resulting rules and choose your approach based on the actual numbers.

    Sigh… If you care about efficiency, you do NOT ever create a rule containing tens of thousands of huge CIDRs for absolutely no reason, when the same job can be done by a whitelist rule with many many many orders of magnitude lower overhead, not wasting your RAM and CPU for nothing. Only pass/forward traffic that you want, instead of blocking everything else. The rest will be taken care of by the implicit default deny rule. Really take a while and think about what you are doing before creating absurd setups.



  • My point exactly.

    @doktornotor:

    Really take a while and think about what you are doing before creating absurd setups.



  • Hi,

    I got the second crash report today since upgraded to V2, the first one was at: https://forum.pfsense.org/index.php?topic=102470.msg575377#msg575377

    PHP Errors:
    PHP Fatal error:  Maximum execution time of 900 seconds exceeded in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 1663


  • Moderator

    @pfcode:

    I got the second crash report today since upgraded to V2, the first one was at: https://forum.pfsense.org/index.php?topic=102470.msg575377#msg575377

    I had one other complain about this, but couldn't track down the issue. Send me an email and I will get some more details from you. Maybe its doing that during a Cron event and timing out on a download as the 900 seconds is the php cURL timeout limit.



  • @BBcan177:

    @pfcode:

    I got the second crash report today since upgraded to V2, the first one was at: https://forum.pfsense.org/index.php?topic=102470.msg575377#msg575377

    I had one other complain about this, but couldn't track down the issue. Send me an email and I will get some more details from you. Maybe its doing that during a Cron event and timing out on a download as the 900 seconds is the php cURL timeout limit.

    Dont know what exactly was happening when the crash occurred. I login to the pfSense web GUI, Status: Dashboard, and saw there was a prompt on the top of the page saying there was a crash report and then I just submitted the report….



  • Hi

    I have an issue trying to get Squid to play nice with pfB DNSBL. My DNSBL is configured to use ports 8081 and 8441. And this is also properly reflected under the "NAT: Port Forward" where port 80 is forwarded to 8081 and port 443 to 8441 (for LAN interface).

    However, Squid just won't seem to respect the Port Forward, hence, when the Resolver returns the IP 10.10.10.1 for an ad domain, Squid still insists to go out to 10.10.10.1:80 instead of 10.10.10.1:8081. The same applies to SSL connections i.e. it will use 443 instead of 8441.

    I'm already using ports 80 and 443 (pfSense GUI, etc) for other usages. So I rather than not use these ports for DNSBL.

    Do you have any ideas how I can get around this problem?


  • Banned

    @torsurfer:

    I have an issue trying to get Squid to play nice with pfB DNSBL. My DNSBL is configured to use ports 8081 and 8441. And this is also properly reflected under the "NAT: Port Forward" where port 80 is forwarded to 8081 and port 443 to 8441 (for LAN interface).

    However, Squid just won't seem to respect the Port Forward, hence, when the Resolver returns the IP 10.10.10.1 for an ad domain, Squid still insists to go out to 10.10.10.1:80 instead of 10.10.10.1:8081. The same applies to SSL connections i.e. it will use 443 instead of 8441.

    "For LAN interface" is useless when the traffic is from localhost. Perhaps tick and select LAN and loopback under DNSBL - DNS Block List Configuration - DNSBL Firewall Rule.



  • I noticed that when a download fail, the list is removed.

    [ PRI3_DangerRulez ]	 Downloading update  . cURL Error: 28
    Resolving timed out after 15567 milliseconds Retry in 5 seconds...
    . cURL Error: 28
    Resolving timed out after 15544 milliseconds Retry in 5 seconds...
    . cURL Error: 28
    Resolving timed out after 15580 milliseconds Retry in 5 seconds...
    .. unknown http status code 
    
     [ pfB_PRI3 - PRI3_DangerRulez ] Download FAIL [ 12/02/15 19:29:38 ]
      Firewall and/or IDS are not blocking download.
    
    The Following list has been REMOVED [ PRI3_DangerRulez ]
    
    

    If the list existed before the update, it could be useful to have an option to keep and use the previous file until the next update succeed?


  • Moderator

    @RonpfS:

    If the list existed before the update, it could be useful to have an option to keep and use the previous file until the next update succeed?

    Check the General Tab for that exact option :)  It should default to enable… Will have to check that...



  • It is enabled  ;)

    However it is not there at the end of the update.

    I did a reload at the end and it uploaded the list fine.

    [UpdateLog 20151202.txt](/public/imported_attachments/1/UpdateLog 20151202.txt)


  • Moderator

    @RonpfS:

    It is enabled  ;)

    I think the DangerRulz "State" needs to be set to "Flex"… If it was never downloaded in the first place, then there is nothing to restore... Some others seem to be failing also. Try those URLs in a browser tab and see if it works from there... If those DNSBL feeds still fail, send me the URLs, as the parser might have to be updated if those lists are formatted differently.

    nb- please edit your post and put the log into a code format... There is a "#" icon in the Message editor... It makes reading posts a lot cleaner...



  • I did but I probably copied over the [ /code] end, or 3000 lines was too much  :o
    I edited and put a attachment file instead

    DangerRulz was downloaded many times before.



  • @doktornotor:

    "For LAN interface" is useless when the traffic is from localhost. Perhaps tick and select LAN and loopback under DNSBL - DNS Block List Configuration - DNSBL Firewall Rule.

    I do have the LAN and loopback selected under the DNSBL Firewall Rule. This only ensures that the firewall doesn't prevent LAN and loopback from accessing the DNSBL VIP. It won't, however, 'make' Squid go to port 8081 for a blacklisted domain.

    I think a solution to this problem might be the use of a reverse proxy, which I'd have to look into to see if it's possible. But thanks Doc for your comment.


  • Banned

    @torsurfer:

    I think a solution to this problem might be the use of a reverse proxy, which I'd have to look into to see if it's possible. But thanks Doc for your comment.

    I think that will produce one giant kaboom, but whatever… You should rather look into NAT firewall rules with "This firewall" as source.



  • @doktornotor:

    @torsurfer:

    I think a solution to this problem might be the use of a reverse proxy, which I'd have to look into to see if it's possible. But thanks Doc for your comment.

    I think that will produce one giant kaboom, but whatever… You should rather look into NAT firewall rules with "This firewall" as source.

    Yeah, it involves some manual settings in lighttpd conf files to enable reverse proxy for 80 -> 8081 and 443 -> 8441. The settings will survive reboots, but won't survive any 'Save' done via the GUI. Still, it hasn't quite kaboom on me.  ;D But definitely not preferable.

    Re: NAT firewall rules. Unless there's something there at the NAT rules where it allows me to choose Localhost as the Interface, nothing that I've tinkered with so far has any effect on Squid. But thanks for the idea, Doc.

    Edit: I've said too soon, the manual settings in lighttpd conf files get 'refreshed' after reboot. So now I have to look for a different solution.  :(



  • Having problem with unbound that doesn't start on reboot

    I did a fresh install of  2.2.5-RELEASE (i386) built on Wed Nov 04 15:50:18 CST 2015 on a Asus P4P800 P4 3.0GHZ 2GB.

    On the old system, I had 2.2.5 x386 snort, suricata, NTopNG, PfBlockerNG v2.0.1 installed.
    When I restored the config, package re-installation failed, no resolver was running, so I set pfsense to use the resolver of the WAN DHCP interface.

    I reinstalled all package, remove the WAN DNS from General Setup, things run fine but when I reboot unbound isn't running, I can start it and it keep running.

    So I desintalled the packages, reinstall snort and suricata, reboot is fine, unbound is running .
    Installed pfBlockerNG v2.0.2, everything is fine, reboot , unbound isn't up, I start it and it is fine

    System General

    Dec  5 13:36:50 pfSense php-fpm[19202]: /reboot.php: Stopping all packages.
    Dec  5 13:36:50 pfSense SnortStartup[38735]: Snort STOP for WAN(33233_sk0)...
    Dec  5 13:36:51 pfSense snort[92226]: *** Caught Term-Signal
    Dec  5 13:36:53 pfSense SuricataStartup[47549]: Suricata STOP for WAN(63282_sk0)...
    Dec  5 13:36:54 pfSense kernel: sk0: promiscuous mode disabled
    Dec  5 13:36:59 pfSense shutdown: reboot by root: 
    Dec  5 13:36:59 pfSense shutdown: reboot by root: 
    Dec  5 13:36:59 pfSense syslogd: exiting on signal 15
    Dec  5 13:38:42 pfSense syslogd: kernel boot file is /boot/kernel/kernel
    Dec  5 13:38:42 pfSense kernel: Copyright (c) 1992-2014 The FreeBSD Project.
    Dec  5 13:38:42 pfSense kernel: Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    Dec  5 13:38:42 pfSense kernel: The Regents of the University of California. All rights reserved.
    Dec  5 13:38:42 pfSense kernel: FreeBSD is a registered trademark of The FreeBSD Foundation.
    Dec  5 13:38:42 pfSense kernel: FreeBSD 10.1-RELEASE-p24 #0 f27a67c(releng/10.1)-dirty: Wed Nov  4 16:13:40 CST 2015
    Dec  5 13:38:42 pfSense kernel: root@pfs22-i386-builder:/usr/obj.RELENG_2_2.i386/usr/pfSensesrc/src.RELENG_2_2/sys/pfSense_SMP.10 i386
    Dec  5 13:38:42 pfSense kernel: FreeBSD clang version 3.4.1 (tags/RELEASE_34/dot1-final 208032) 20140512
    Dec  5 13:38:42 pfSense kernel: CPU: Intel(R) Pentium(R) 4 CPU 3.00GHz (3006.87-MHz 686-class CPU)
    Dec  5 13:38:42 pfSense kernel: Origin = "GenuineIntel"  Id = 0xf41  Family = 0xf  Model = 0x4  Stepping = 1
    Dec  5 13:38:42 pfSense kernel: Features=0xbfebfbff <fpu,vme,de,pse,tsc,msr,pae,mce,cx8,apic,sep,mtrr,pge,mca,cmov,pat,pse36,clflush,dts,acpi,mmx,fxsr,sse,sse2,ss,htt,tm,pbe>Dec  5 13:38:42 pfSense kernel: Features2=0x441d <sse3,dtes64,mon,ds_cpl,cnxt-id,xtpr>Dec  5 13:38:42 pfSense kernel: TSC: P-state invariant
    Dec  5 13:38:42 pfSense kernel: real memory  = 2147483648 (2048 MB)
    Dec  5 13:38:42 pfSense kernel: avail memory = 2072236032 (1976 MB)
    Dec  5 13:38:42 pfSense kernel: Event timer "LAPIC" quality 400
    Dec  5 13:38:42 pfSense kernel: ACPI APIC Table: <a m="" i ="" oemapic="">
    Dec  5 13:38:42 pfSense kernel: FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
    Dec  5 13:38:42 pfSense kernel: FreeBSD/SMP: 1 package(s) x 1 core(s) x 2 HTT threads
    Dec  5 13:38:42 pfSense kernel: cpu0 (BSP): APIC ID:  0
    Dec  5 13:38:42 pfSense kernel: cpu1 (AP/HT): APIC ID:  1
    Dec  5 13:38:42 pfSense kernel: ioapic0 <version 2.0="">irqs 0-23 on motherboard
    Dec  5 13:38:42 pfSense kernel: wlan: mac acl policy registered
    Dec  5 13:38:42 pfSense kernel: kbd1 at kbdmux0
    Dec  5 13:38:42 pfSense kernel: random: <software, yarrow="">initialized
    Dec  5 13:38:42 pfSense kernel: cryptosoft0: <software crypto="">on motherboard
    Dec  5 13:38:42 pfSense kernel: padlock0: No ACE support.
    Dec  5 13:38:42 pfSense kernel: acpi0:</software></software,></version> </a><a m="" i="" oemxsdt="">on motherboard
    Dec  5 13:38:42 pfSense kernel: acpi0: Power Button (fixed)
    Dec  5 13:38:42 pfSense kernel: acpi0: reservation of 0, a0000 (3) failed
    Dec  5 13:38:42 pfSense kernel: acpi0: reservation of 100000, 7fef0000 (3) failed
    Dec  5 13:38:42 pfSense kernel: cpu0: <acpi cpu="">on acpi0
    Dec  5 13:38:42 pfSense kernel: cpu1: <acpi cpu="">on acpi0
    Dec  5 13:38:42 pfSense kernel: attimer0: <at timer="">port 0x40-0x43 irq 0 on acpi0
    Dec  5 13:38:42 pfSense kernel: Timecounter "i8254" frequency 1193182 Hz quality 0
    Dec  5 13:38:42 pfSense kernel: Event timer "i8254" frequency 1193182 Hz quality 100
    Dec  5 13:38:42 pfSense kernel: atrtc0: <at realtime="" clock="">port 0x70-0x71 irq 8 on acpi0
    Dec  5 13:38:42 pfSense kernel: Event timer "RTC" frequency 32768 Hz quality 0
    Dec  5 13:38:42 pfSense kernel: Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
    Dec  5 13:38:42 pfSense kernel: acpi_timer0: <24-bit timer at 3.579545MHz> port 0x808-0x80b on acpi0
    Dec  5 13:38:42 pfSense kernel: pcib0: <acpi host-pci="" bridge="">port 0xcf8-0xcff on acpi0
    Dec  5 13:38:42 pfSense kernel: pci0: <acpi pci="" bus="">on pcib0
    Dec  5 13:38:42 pfSense kernel: agp0: <intel 82865="" host="" to="" agp="" bridge="">on hostb0
    Dec  5 13:38:42 pfSense kernel: pcib1: <acpi pci-pci="" bridge="">at device 1.0 on pci0
    Dec  5 13:38:42 pfSense kernel: pci1: <acpi pci="" bus="">on pcib1
    Dec  5 13:38:42 pfSense kernel: vgapci0: <vga-compatible display="">mem 0xfa000000-0xfaffffff,0xf6000000-0xf7ffffff at device 0.0 on pci1
    Dec  5 13:38:42 pfSense kernel: vgapci0: Boot video device
    Dec  5 13:38:42 pfSense kernel: uhci0: <intel 82801eb="" (ich5)="" usb="" controller="" usb-a="">port 0xeec0-0xeedf irq 16 at device 29.0 on pci0
    Dec  5 13:38:42 pfSense kernel: usbus0 on uhci0
    Dec  5 13:38:42 pfSense kernel: uhci1: <intel 82801eb="" (ich5)="" usb="" controller="" usb-b="">port 0xef00-0xef1f irq 19 at device 29.1 on pci0
    Dec  5 13:38:42 pfSense kernel: usbus1 on uhci1
    Dec  5 13:38:42 pfSense kernel: uhci2: <intel 82801eb="" (ich5)="" usb="" controller="" usb-c="">port 0xef20-0xef3f irq 18 at device 29.2 on pci0
    Dec  5 13:38:42 pfSense kernel: usbus2 on uhci2
    Dec  5 13:38:42 pfSense kernel: uhci3: <intel 82801eb="" (ich5)="" usb="" controller="" usb-d="">port 0xef40-0xef5f irq 16 at device 29.3 on pci0
    Dec  5 13:38:42 pfSense kernel: usbus3 on uhci3
    Dec  5 13:38:42 pfSense kernel: ehci0: <intel 82801eb="" r="" (ich5)="" usb="" 2.0="" controller="">mem 0xfbfff800-0xfbfffbff irq 23 at device 29.7 on pci0
    Dec  5 13:38:42 pfSense kernel: usbus4: EHCI version 1.0
    Dec  5 13:38:42 pfSense kernel: usbus4 on ehci0
    Dec  5 13:38:42 pfSense kernel: pcib2: <acpi pci-pci="" bridge="">at device 30.0 on pci0
    Dec  5 13:38:42 pfSense kernel: pci2: <acpi pci="" bus="">on pcib2
    Dec  5 13:38:42 pfSense kernel: skc0: <marvell gigabit="" ethernet="">port 0xd800-0xd8ff mem 0xfbefc000-0xfbefffff irq 22 at device 5.0 on pci2
    Dec  5 13:38:42 pfSense kernel: skc0: Marvell Yukon Lite Gigabit Ethernet rev. A3(0x7)
    Dec  5 13:38:42 pfSense kernel: sk0: <marvell semiconductor,="" inc.="" yukon="">on skc0
    Dec  5 13:38:42 pfSense kernel: sk0: Ethernet address: 00:11:d8:0a:75:40
    Dec  5 13:38:42 pfSense kernel: miibus0: <mii bus="">on sk0
    Dec  5 13:38:42 pfSense kernel: e1000phy0: <marvell 88e1011="" gigabit="" phy="">PHY 0 on miibus0
    Dec  5 13:38:42 pfSense kernel: e1000phy0:  none, 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseT, 1000baseT-master, 1000baseT-FDX, 1000baseT-FDX-master, auto
    Dec  5 13:38:42 pfSense kernel: re0: <d-link dge-530(t)="" gigabit="" ethernet="" adapter="">port 0xd400-0xd4ff mem 0xfbefbc00-0xfbefbcff irq 22 at device 10.0 on pci2
    Dec  5 13:38:42 pfSense kernel: re0: Chip rev. 0x10000000
    Dec  5 13:38:42 pfSense kernel: re0: MAC rev. 0x00000000
    Dec  5 13:38:42 pfSense kernel: miibus1: <mii bus="">on re0
    Dec  5 13:38:42 pfSense kernel: rgephy0: <rtl8169s 8211="" 8110s="" 1000base-t="" media="" interface="">PHY 1 on miibus1
    Dec  5 13:38:42 pfSense kernel: rgephy0:  none, 10baseT, 10baseT-FDX, 10baseT-FDX-flow, 100baseTX, 100baseTX-FDX, 100baseTX-FDX-flow, 1000baseT, 1000baseT-master, 1000baseT-FDX, 1000baseT-FDX-master, 1000baseT-FDX-flow, 1000baseT-FDX-flow-master, auto, auto-flow
    Dec  5 13:38:42 pfSense kernel: re0: Ethernet address: 1c:7e:e5:1f:fa:d5
    Dec  5 13:38:42 pfSense kernel: isab0: <pci-isa bridge="">at device 31.0 on pci0
    Dec  5 13:38:42 pfSense kernel: isa0: <isa bus="">on isab0
    Dec  5 13:38:42 pfSense kernel: atapci0: <intel ich5="" udma100="" controller="">port 0xeff0-0xeff7,0xefe4-0xefe7,0xefa8-0xefaf,0xefe0-0xefe3,0xef90-0xef9f irq 18 at device 31.1 on pci0
    Dec  5 13:38:42 pfSense kernel: ata2: <ata channel="">at channel 0 on atapci0
    Dec  5 13:38:42 pfSense kernel: ata3: <ata channel="">at channel 1 on atapci0
    Dec  5 13:38:42 pfSense kernel: pcm0: <intel ich5="" (82801eb)="">port 0xe800-0xe8ff,0xee80-0xeebf mem 0xfbfff400-0xfbfff5ff,0xfbfff000-0xfbfff0ff irq 17 at device 31.5 on pci0
    Dec  5 13:38:42 pfSense kernel: pcm0: <analog devices="" ad1985="" ac97="" codec="">Dec  5 13:38:42 pfSense kernel: acpi_button0: <power button="">on acpi0
    Dec  5 13:38:42 pfSense kernel: uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
    Dec  5 13:38:42 pfSense kernel: uart1: <16550 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
    Dec  5 13:38:42 pfSense kernel: fdc0: <floppy drive="" controller="" (fde)="">port 0x3f0-0x3f5,0x3f7 irq 6 drq 2 on acpi0
    Dec  5 13:38:42 pfSense kernel: pmtimer0 on isa0
    Dec  5 13:38:42 pfSense kernel: sc0: <system console="">at flags 0x100 on isa0
    Dec  5 13:38:42 pfSense kernel: sc0: VGA <16 virtual consoles, flags=0x300>
    Dec  5 13:38:42 pfSense kernel: vga0: <generic isa="" vga="">at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
    Dec  5 13:38:42 pfSense kernel: ata0: <ata channel="">at port 0x1f0-0x1f7,0x3f6 irq 14 on isa0
    Dec  5 13:38:42 pfSense kernel: ata1: <ata channel="">at port 0x170-0x177,0x376 irq 15 on isa0
    Dec  5 13:38:42 pfSense kernel: atkbdc0: <keyboard controller="" (i8042)="">at port 0x60,0x64 on isa0
    Dec  5 13:38:42 pfSense kernel: atkbd0: <at keyboard="">irq 1 on atkbdc0
    Dec  5 13:38:42 pfSense kernel: kbd0 at atkbd0
    Dec  5 13:38:42 pfSense kernel: atkbd0: [GIANT-LOCKED]
    Dec  5 13:38:42 pfSense kernel: ppc0: parallel port not found.
    Dec  5 13:38:42 pfSense kernel: p4tcc0: <cpu frequency="" thermal="" control="">on cpu0
    Dec  5 13:38:42 pfSense kernel: p4tcc1: <cpu frequency="" thermal="" control="">on cpu1
    Dec  5 13:38:42 pfSense kernel: Timecounters tick every 1.000 msec
    Dec  5 13:38:42 pfSense kernel: IPsec: Initialized Security Association Processing.
    Dec  5 13:38:42 pfSense kernel: random: unblocking device.
    Dec  5 13:38:42 pfSense kernel: usbus0: 12Mbps Full Speed USB v1.0
    Dec  5 13:38:42 pfSense kernel: usbus1: 12Mbps Full Speed USB v1.0
    Dec  5 13:38:42 pfSense kernel: usbus2: 12Mbps Full Speed USB v1.0
    Dec  5 13:38:42 pfSense kernel: usbus3: 12Mbps Full Speed USB v1.0
    Dec  5 13:38:42 pfSense kernel: usbus4: 480Mbps High Speed USB v2.0
    Dec  5 13:38:42 pfSense kernel: ugen0.1: <intel>at usbus0
    Dec  5 13:38:42 pfSense kernel: uhub0: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus0
    Dec  5 13:38:42 pfSense kernel: ugen4.1: <intel>at usbus4
    Dec  5 13:38:42 pfSense kernel: uhub1: <intel 1="" 9="" ehci="" root="" hub,="" class="" 0,="" rev="" 2.00="" 1.00,="" addr="">on usbus4
    Dec  5 13:38:42 pfSense kernel: ugen3.1: <intel>at usbus3
    Dec  5 13:38:42 pfSense kernel: uhub2: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus3
    Dec  5 13:38:42 pfSense kernel: ugen2.1: <intel>at usbus2
    Dec  5 13:38:42 pfSense kernel: uhub3: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus2
    Dec  5 13:38:42 pfSense kernel: ugen1.1: <intel>at usbus1
    Dec  5 13:38:42 pfSense kernel: uhub4: <intel 1="" 9="" uhci="" root="" hub,="" class="" 0,="" rev="" 1.00="" 1.00,="" addr="">on usbus1
    Dec  5 13:38:42 pfSense kernel: uhub0: 2 ports with 2 removable, self powered
    Dec  5 13:38:42 pfSense kernel: uhub2: 2 ports with 2 removable, self powered
    Dec  5 13:38:42 pfSense kernel: uhub3: 2 ports with 2 removable, self powered
    Dec  5 13:38:42 pfSense kernel: uhub4: 2 ports with 2 removable, self powered
    Dec  5 13:38:42 pfSense kernel: uhub1: 8 ports with 8 removable, self powered
    Dec  5 13:38:42 pfSense kernel: ugen2.2: <ortek>at usbus2
    Dec  5 13:38:42 pfSense kernel: ukbd0: <ep1 interrupt="">on usbus2
    Dec  5 13:38:42 pfSense kernel: kbd2 at ukbd0
    Dec  5 13:38:42 pfSense kernel: ada0 at ata2 bus 0 scbus0 target 0 lun 0
    Dec  5 13:38:42 pfSense kernel: ada0: <st340016a 3.10="">ATA-5 device
    Dec  5 13:38:42 pfSense kernel: ada0: Serial Number 3HS49BWJ
    Dec  5 13:38:42 pfSense kernel: ada0: 100.000MB/s transfers (UDMA5, PIO 8192bytes)
    Dec  5 13:38:42 pfSense kernel: ada0: 38166MB (78165360 512 byte sectors: 16H 63S/T 16383C)
    Dec  5 13:38:42 pfSense kernel: ada0: Previously was known as ad4
    Dec  5 13:38:42 pfSense kernel: cd0 at ata3 bus 0 scbus1 target 0 lun 0
    Dec  5 13:38:42 pfSense kernel: cd0: <hl-dt-st dvd-ram="" gh22np20="" 2.00="">Removable CD-ROM SCSI-0 device 
    Dec  5 13:38:42 pfSense kernel: cd0: 66.700MB/s transfers (UDMA4, ATAPI 12bytes, PIO 65534bytes)
    Dec  5 13:38:42 pfSense kernel: cd0: Attempt to query device size failed: NOT READY, Medium not present - tray closed
    Dec  5 13:38:42 pfSense kernel: SMP: AP CPU #1 Launched!
    Dec  5 13:38:42 pfSense kernel: Timecounter "TSC-low" frequency 1503437224 Hz quality 1000
    Dec  5 13:38:42 pfSense kernel: Trying to mount root from ufs:/dev/ufsid/566228d1397a31e0 [rw]...
    Dec  5 13:38:42 pfSense check_reload_status: Linkup starting sk0
    Dec  5 13:38:44 pfSense check_reload_status: Linkup starting sk0
    Dec  5 13:38:44 pfSense kernel: 
    Dec  5 13:38:44 pfSense kernel: sk0: link state changed to UP
    Dec  5 13:38:44 pfSense check_reload_status: rc.newwanip starting sk0
    Dec  5 13:38:44 pfSense php: rc.bootup: Accept router advertisements on interface sk0 
    Dec  5 13:38:44 pfSense check_reload_status: Linkup starting re0
    Dec  5 13:38:44 pfSense kernel: re0: link state changed to DOWN
    Dec  5 13:38:46 pfSense check_reload_status: Linkup starting re0
    Dec  5 13:38:46 pfSense kernel: 
    Dec  5 13:38:46 pfSense kernel: re0: link state changed to UP
    Dec  5 13:38:46 pfSense php-fpm[245]: /rc.newwanip: rc.newwanip: Info: starting on sk0.
    Dec  5 13:38:47 pfSense php: rc.bootup: Resyncing OpenVPN instances.
    Dec  5 13:38:47 pfSense kernel: done.
    Dec  5 13:38:47 pfSense kernel: pflog0: promiscuous mode enabled
    Dec  5 13:38:47 pfSense kernel: ...
    Dec  5 13:38:53 pfSense kernel: .done.
    Dec  5 13:38:55 pfSense kernel: done.
    Dec  5 13:38:56 pfSense kernel: done.
    Dec  5 13:38:57 pfSense lighttpd[28659]: (log.c.194) server started 
    Dec  5 13:38:57 pfSense kernel: done.
    Dec  5 13:38:57 pfSense php: rc.bootup: ROUTING: setting default route to 172.25.0.254
    Dec  5 13:38:57 pfSense kernel: done.
    Dec  5 13:39:00 pfSense php: rc.bootup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1449340740] unbound[30863:0] error: bind: address already in use [1449340740] unbound[30863:0] fatal error: could not open ports' 
    Dec  5 13:39:00 pfSense kernel: done.
    Dec  5 13:39:00 pfSense kernel: done.
    Dec  5 13:39:00 pfSense check_reload_status: Updating all dyndns
    Dec  5 13:39:06 pfSense kernel: .done.
    Dec  5 13:39:11 pfSense php: rc.bootup: Creating rrd update script
    Dec  5 13:39:11 pfSense php: rc.bootup: miniupnpd: Starting service on interface: lan
    Dec  5 13:39:11 pfSense kernel: done.
    Dec  5 13:39:11 pfSense kernel: done.
    Dec  5 13:39:11 pfSense syslogd: exiting on signal 15
    Dec  5 13:39:11 pfSense syslogd: kernel boot file is /boot/kernel/kernel
    Dec  5 13:39:11 pfSense php-fpm[31202]: /rc.start_packages: Restarting/Starting all packages.
    Dec  5 13:39:11 pfSense kernel: done.
    Dec  5 13:39:12 pfSense check_reload_status: Syncing firewall
    Dec  5 13:39:12 pfSense SnortStartup[70337]: Snort START for WAN(33233_sk0)...
    Dec  5 13:39:15 pfSense check_reload_status: Syncing firewall
    Dec  5 13:39:15 pfSense check_reload_status: Syncing firewall
    Dec  5 13:39:15 pfSense SuricataStartup[79006]: Suricata START for WAN(63282_sk0)...
    Dec  5 13:39:15 pfSense php-fpm[31202]: [pfBlockerNG] Starting sync process.
    Dec  5 13:39:19 pfSense check_reload_status: Reloading filter
    Dec  5 13:39:40 pfSense login: login on ttyv0 as root
    Dec  5 13:39:40 pfSense sshlockout[53762]: sshlockout/webConfigurator v3.0 starting up
    Dec  5 13:39:53 pfSense kernel: sk0: promiscuous mode enabled
    Dec  5 13:43:45 pfSense php-fpm[10393]: /index.php: Successful login for user 'admin' from: 172.24.48.84
    Dec  5 13:43:45 pfSense php-fpm[10393]: /index.php: Successful login for user 'admin' from: 172.24.48.84
    Dec  5 13:44:32 pfSense php-fpm[8855]: /status_services.php: NTPD is starting up.
    Dec  5 13:50:26 pfSense check_reload_status: Syncing firewall
    Dec  5 13:50:26 pfSense check_reload_status: Reloading filter
    Dec  5 14:00:54 pfSense php-fpm[26326]: /index.php: Successful login for user 'admin' from: 172.24.48.84
    Dec  5 14:00:54 pfSense php-fpm[26326]: /index.php: Successful login for user 'admin' from: 172.24.48.84</hl-dt-st></st340016a></ep1></ortek></intel></intel></intel></intel></intel></intel></intel></intel></intel></intel></cpu></cpu></at></keyboard></ata></ata></generic></system></floppy></power></analog></intel></ata></ata></intel></isa></pci-isa></rtl8169s></mii></d-link></marvell></mii></marvell></marvell></acpi></acpi></intel></intel></intel></intel></intel></vga-compatible></acpi></acpi></intel></acpi></acpi></at></at></acpi></acpi></a></sse3,dtes64,mon,ds_cpl,cnxt-id,xtpr></fpu,vme,de,pse,tsc,msr,pae,mce,cx8,apic,sep,mtrr,pge,mca,cmov,pat,pse36,clflush,dts,acpi,mmx,fxsr,sse,sse2,ss,htt,tm,pbe> 
    ``` <a m="" i="" oemxsdt="">Resolver
    

    Dec  5 12:38:36 pfSense unbound: [26765:0] info: service stopped (unbound 1.5.4).
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 0: 34 queries, 15 answers from cache, 19 recursions, 1 prefetch
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 0: requestlist max 11 avg 0.9 exceeded 0 jostled 0
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: average recursion processing time 0.211307 sec
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: histogram of recursion processing times
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: [25%]=0.0503223 median[50%]=0.144179 [75%]=0.283989
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: lower(secs) upper(secs) recursions
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.016384    0.032768 1
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.032768    0.065536 7
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.065536    0.131072 1
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.131072    0.262144 5
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.262144    0.524288 3
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.524288    1.000000 2
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 1: 5 queries, 3 answers from cache, 2 recursions, 1 prefetch
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: server stats for thread 1: requestlist max 0 avg 0 exceeded 0 jostled 0
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: average recursion processing time 0.156386 sec
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: histogram of recursion processing times
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: [25%]=0 median[50%]=0 [75%]=0
    Dec  5 12:38:36 pfSense unbound: [26765:0] info: lower(secs) upper(secs) recursions
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.065536    0.131072 1
    Dec  5 12:38:36 pfSense unbound: [26765:0] info:    0.131072    0.262144 1
    Dec  5 12:39:06 pfSense unbound: [52118:0] notice: init module 0: validator
    Dec  5 12:39:06 pfSense unbound: [52118:0] notice: init module 1: iterator
    Dec  5 12:39:06 pfSense unbound: [52118:0] info: start of service (unbound 1.5.4).
    Dec  5 13:44:49 pfSense unbound: [25393:0] notice: init module 0: validator
    Dec  5 13:44:49 pfSense unbound: [25393:0] notice: init module 1: iterator
    Dec  5 13:44:49 pfSense unbound: [25393:0] info: start of service (unbound 1.5.4).

    
    This did not happen with the old system, but I can no longer do any test on that system, today it has disk error when I boot it  :-\
    
    On a few reboot, unbound was running at bootup but it silently died, a restart keep it running.</a>

  • Moderator

    Hi RonpfS,

    When you restored the backup config, was DNSBL installed? If not, then in the Resolver Adv. settings, there would have been this line:

    server:include: /var/unbound/pfb_dnsbl.conf

    but that file would not exist yet. So Unbound would fail to start.

    Since installing DNSBL, did you enable any of the 'DHCP Registration' options in the Resolver? There are some issues with those options.



  • Yeah I figured out it would have been better to disable pfBlockerNG before saving the old config.

    No I don't have the DHCP registration ticked nor Static DHCP.

    I am having trouble with the Suppression List.

    Do I need to create a rule with pfBlockerNGSuppress to permit traffic or is this done by pfBlockerNG. If this is the case, I don't see any rules generated that let the traffic pass.

    Adding an IP to the suppression list doesn't seems to let it pass.


  • Moderator

    @RonpfS:

    Do I need to create a rule with pfBlockerNGSuppress to permit traffic or is this done by pfBlockerNG. If this is the case, I don't see any rules generated that let the traffic pass.

    Adding an IP to the suppression list doesn't seems to let it pass.

    The suppresion alias does not need to be referenced to a rule. Please read the description for "Suppression" in the General tab…

    "Do not use the pfBlockerNGSuppress Alias in a Firewall Rule. This alias is used during the cron download process only."

    There are more details on how to suppress, in the Alerts Tab, when you hover-over the Lists Column.



  • I read it  ;)

    However the suppression only seems to happen when you do a force reload, not when you click on the suppress icon

    IBlock_Badpeer       47283      47283      195706 
     Suppression IBlock_Ads: 50.31.164.0/24
     Suppression IBlock_Ads: 50.31.164.0/24
     Suppression IBlock_Ads: 50.31.164.0/24
     Suppression IBlock_Ads: 50.31.164.0/24
     Suppression IBlock_Ads: 50.31.164.0/24
    IBlock_Ads           3217       3211       195955   
    

    This take a few minutes to get online suppression results  :-\


  • Moderator

    @RonpfS:

    However the suppression only seems to happen when you do a force reload, not when you click on the suppress icon

    Check your pfBlockerNGSuppress alias and remove all of the single /32 addresses in 50.31.164.x and just use a single /24



  • Hello all, I have my rules now allowing and not blocking, as we should do, I just have one question. Should I add a default reject all to the end of my LAN interfaces? Since I only allow, the traffic that does not match my allow rules will be blocked by default by pfsense, making my browser (for example) wait for a timeout (for example blocked IP's). If I add a reject all to the end of my rules, the request on the browser will be a lot faster, returning a rejected error.

    Thank you all



  • Thank you so much for the great tools, it works great so far two weeks now no complains.
    i have a request, can we use the DNSBL to block Microsoft Telemtry ?



  • http://someonewhocares.org/hosts/

    search near the bottom. There might be more lists out there.



  • @Jamerson:

    Thank you so much for the great tools, it works great so far two weeks now no complains.
    i have a request, can we use the DNSBL to block Microsoft Telemtry ?

    https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist
    Taken from project - https://github.com/WindowsLies/BlockWindows



  • @f34rinc:

    @Jamerson:

    Thank you so much for the great tools, it works great so far two weeks now no complains.
    i have a request, can we use the DNSBL to block Microsoft Telemtry ?

    https://raw.githubusercontent.com/WindowsLies/BlockWindows/master/hostslist
    Taken from project - https://github.com/WindowsLies/BlockWindows

    those are domains, I have plenty of them :)
    can those be blocked using DNSBL ?



  • @Jamerson:

    can those be blocked using DNSBL ?

    Yes it can



  • Is-it normal that during boot, Resolver start twice?

    
    Configuring WAN interface...done.
    Configuring LAN interface...Starting DNS Resolver...done.
    Starting DHCPv6 service...done.
    done.
    Configuring CARP settings...done.
    Configuring OpenVPN settings...done.
    Configuring firewall......done.
    Starting PFLOG...done.
    Setting up gateway monitors...done.
    Synchronizing user settings...done.  
    Starting webConfigurator...done.
    Configuring CRON...done
    Starting DNS resolver...done.
    Starting NTP time client....done.
    Starting DCHP service....done.
    Starting DHCPv6 service...done.
    Configuring firewall......done.
    
    

    and when I access the Webconfigurator, resolver and ntp are both stopped.

    I added Unbound under Service Watchdog and unbound start within 5 min of bootup.

    Strange output from starting pfBlockerNG :

    
    Starting package pfBlockerNG...            ?done.
    
    


  • @f34rinc:

    @Jamerson:

    can those be blocked using DNSBL ?

    Yes it can

    just post them on the block domain DNS feed ?



  • Hey all!

    This is just what the doctor ordered! Thans BBcan177, great job!

    I have a dumb question. I was looking over the default settings and had a question about the below. If you're going to protect against spam, wouldn't you select "Inbound" as the default instead of "Outbound"? I want to prevent stuff from coming in to the network. I know I'm missing something here, just don't know what it is.

    DNSBL IP Firewall Rule Settings:
    Select Deny outbound or as per your requirements
    select Enable logging

    Thanks!


Log in to reply