The pfSense Store

Author Topic: pfBlockerNG v2.0 w/DNSBL  (Read 286331 times)

0 Members and 1 Guest are viewing this topic.

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
pfBlockerNG v2.0 w/DNSBL
« on: November 15, 2015, 04:50:54 pm »
pfBlockerNG v2.0

This release brings several improvements and enhancements to the existing pfBlockerNG IP Download manager capabilities, and also introduces domain name blocking ("DNSBL") via Unbound DNS Resolver. Domain blocking can be used for ADvert servers, malicious domains and/or domain filtering.

DNSBL overview: When a DNS request is made for a domain that is listed in DNSBL, the request is redirected to a Virtual IP address where an instance of Lighttpd Web Server will collect the packet statistics and push a '1x1' GIF image to the Browser. Rejected domain activity can be viewed in the "Alerts" tab along with the IP Alerts.

Due to the increased security measures in Browsers, HTTPS alerts will not display the SRC IP or Requested URL, however, the Requested Domain name will be logged to the Alerts tab along with all HTTP alerts.

To reduce False Positives, the "Alexa" Top 1M sites can be used to suppress the most popular sites. Settings allow for the number of Top sites and which TLDs (.com, .org etc) to include in the Alexa Suppression list.


Improved Features

[ cURL ]

PHP cURL library is now used to download all Lists/Feeds/Maxmind/Alexa files. This allows for increased security settings and collection of HTTP response codes.  Allowed SSL Ciphers (TLSv1.2 and TLSv1) and default settings (SSL_VERIFYPEER, SSL_VERIFYHOST). 

Added a "Flex" option to allow for the downgrade of the SSL connection, if required. The "Flex" option (when enabled) will downgrade on the following HTTP (RFC7231) response codes:
  • 35 - GET_SERVER_HELLO:sslv3
  • 51 - NO alternative certificate
  • 60 - Local Issuer Certificate Subject
The following settings will be downgraded:
  • disable verifypeer
  • disable verifyhost
  • adds SSLv3 SSL Cipher.
(It is not recommended to use the "Flex" setting; however not all Lists/Feeds support the increased security measures. Expect overtime that these Lists/Feeds will improve their security.)

[ Alerts Tab ]

The Alerts tab has been refactored. Improvements in efficiency and accuracy in the IP/CIDR for the reported Alerts. The Suppression Icon is now only visible for /32 and /24 CIDRS, all other suppression's require an 'Outbound' allow firewall rule to circumvent the blocklist. Hostnames for local devices are now displayed under each Alerted IP. When 'Filter options' are used, they will be preserved on page refreshes.

[ Reputation ]

All reputation functions have been refactored and improvements made to the overall efficiency.

[ IP Parser ]

The IP parser has been converted to use String functions vs regex functions, for a significant improvement in efficiency.

[ List/Feed Format ]

The package will now "automagically" determine what 'Format' is required to extract and parse any given URL.

[ Firewall Rules ]

The "Firewall Rule" creation function has been improved. Please verify your firewall rules post installation to ensure they are as expected.

[ Config Save ]

Only when changes are made to the settings, will pfBlockerNG save its settings to the pfSense config file. This will reduce the spammed backups that were being created at each hourly CRON task interval.

[ XMLRPC ]

XMLRPC sync has been improved to include support for hostnames and IPv6 addresses.

[ XSS potential ]

Fixed XSS potentials in several functions of the code.


New Features


[ Whois ]

A whois feature has been added to convert an AS number into its respective IP Addresses. Entering a Domain name will also collect its host IP Address.

[ CIDR Aggregation ]

Aggregation will optimize contiguous network prefixes in a List, and remove any superfluous prefixes which are already included in another prefix. Depending on the hardware used, Aggregation can use a significant amount of resources if the list being aggregated is large.

[ Max daily download failure attempts

Allows for the configuration of a "max daily download failure threshold" for the CRON updates. If this setting is defined, attempts will be made to re-download up-to the threshold defined. The 'failed download' counters can be clearing in the widget.

[ Restore previous download on failure

When enabled, the previously downloaded file contents are used on a download failure. (Defaulted to 'on')

[ Kill States ]

After a cron event or any 'Force' commands (when enabled), any IPs listed in any Blocklists; if found in the Firewall states will be cleared and logged. States removal can be bypassed on an alias by alias basis if required.

[ Tracker IDs ]

The pfBlockerNG Firewall Rules now include a 'Tracker ID', this ID is based upon the Alias name (Sum of the ASCII characters ORD values). This ID is a 10 digit number, prefixed with '177'. This ID will remain static unless the Alias name is changed. If the Firewall Logs are pushed to a remote syslog, you can use the Tracker ID as a reference to the pfBlockerNG Alias.

Further details are available in the following forum thread:
https://forum.pfsense.org/index.php?topic=86212.0
« Last Edit: November 25, 2015, 10:07:52 pm by BBcan177 »
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline q54e3w

  • Full Member
  • ***
  • Posts: 157
  • Karma: +14/-1
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1 on: November 15, 2015, 05:54:58 pm »
awesome job, thanks BBCan!

Offline mygeeknc

  • Newbie
  • *
  • Posts: 23
  • Karma: +0/-1
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #2 on: November 16, 2015, 08:34:01 am »
Great work sir! I'm looking forward to this release. Will there be any special instructions for upgrading?

Offline trinidadrancheria

  • Jr. Member
  • **
  • Posts: 39
  • Karma: +2/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #3 on: November 16, 2015, 02:31:12 pm »
Guess I will hold off manually editing the INC file then to add DNSBL :)
Any ETA on this new version?

THANKS!!!

Offline pfcode

  • Full Member
  • ***
  • Posts: 236
  • Karma: +11/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #4 on: November 16, 2015, 09:04:21 pm »
Great. Thanks!
Release: pfSense 2.4.2(amd64)
M/B: Supermicro A1SRi-2558F
HDD: Intel X25-M 160G
RAM: 2x8Gb Kingston ECC ValueRAM
AP: Netgear R7000 (XWRT), Unifi AC Pro

Offline wcrowder

  • Full Member
  • ***
  • Posts: 118
  • Karma: +12/-5
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #5 on: November 17, 2015, 05:08:24 pm »
ETA is as soon as the Dev's validate the package, package has been submitted... Yeah!!!!! :)

https://github.com/pfsense/pfsense-packages/pull/1174

Offline trinidadrancheria

  • Jr. Member
  • **
  • Posts: 39
  • Karma: +2/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #6 on: November 17, 2015, 07:22:53 pm »
ETA is as soon as the Dev's validate the package, package has been submitted... Yeah!!!!! :)

https://github.com/pfsense/pfsense-packages/pull/1174

HOLY Poop!!! 23 changed files  with 8,591 additions and 5,267 deletions Total re-write? :D

Offline Panja

  • Full Member
  • ***
  • Posts: 259
  • Karma: +9/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #7 on: November 18, 2015, 02:20:51 am »
Looking forward to this release!
Keep up the good work mate. Awesome!  8)
 
Qotom Q355G4 - 8GB ram - 64GB ssd
pfSense v2.4.2-p1
TP-Link TL-SG108E
2x TP-Link Archer C7: LEDE Reboot 17.01.4

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #8 on: November 18, 2015, 06:43:07 pm »
Great work sir! I'm looking forward to this release. Will there be any special instructions for upgrading?

There should be no concerns in migrating to pfBNG v2.0 from the existing v1.10.

pfSense has two types of DNS Services
  • DNS Forwarder
  • DNS Resolver
If you plan on using the DNSBL feature, you will need to use the DNS Resolver for your DNS queries, the DNS Forwarder is not an option for DNSBL. Its probably best to ensure that the DNS Resolver is working before using DNSBL.

The DNS Resolver is developed by NLnet Labs and is named 'Unbound'. It is a validating, recursive and caching DNS resolver.   https://www.unbound.net/index.html

Some recommendations:
  • The DNS Resolver can also be used in 'Forwardering mode'; however its best to not use this 'Forwarding mode' and keep it in 'resolver mode' as this will query the Root DNS servers for the DNS queries instead of relying on an ISPs DNS etc...
  • If you use the 'DNS Resolver Forwarder mode', only configure 'DNSSEC' if the configured DNS servers support DNSSEC. The enabling of 'DNSSEC' to harden your DNS security is highly recommended.
  • Disable the two "DHCP registrations" checkboxes, unless you really require those options.
Here is a good primer about the DNS Resolver (Unbound) https://calomel.org/unbound_dns.html
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline gsiemon

  • Jr. Member
  • **
  • Posts: 79
  • Karma: +13/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #9 on: November 18, 2015, 10:28:31 pm »
If you plan on using the DNSBL feature, you will need to use the DNS Resolver for your DNS queries, the DNS Forwarder is not an option for DNSBL. Its probably best to ensure that the
I'm using the Bind package instead of Unbound.  Will V2.0 support that or is it hard coded to use only Unbound?  If it only supports Unbound, is it possible to support Bind in the future?

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #10 on: November 19, 2015, 02:26:06 am »
I'm using the Bind package instead of Unbound.  Will V2.0 support that

No.
Do NOT PM for help!

Offline fraglord

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +1/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #11 on: November 19, 2015, 12:56:23 pm »
You doin a great job! I appreciate it and many others do so as well. It is a leightweight alternative to squid when it comes to ad-blocking.
I was allowed ot participate in the beta test program and the DNSBL feature is my favourite. Minor issues have been ironed out with the latest upgdates so it for sure feels ready to be released.
pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

Offline Aaron M.

  • Jr. Member
  • **
  • Posts: 72
  • Karma: +2/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #12 on: November 19, 2015, 01:10:14 pm »
You doin a great job! I appreciate it and many others do so as well. It is a leightweight alternative to squid when it comes to ad-blocking.
I was allowed ot participate in the beta test program and the DNSBL feature is my favourite. Minor issues have been ironed out with the latest upgdates so it for sure feels ready to be released.

Same here, it was a pleasure to help BBcan177. Hopefully I wasn't too much of a pain :D

Offline Music Wizard

  • Jr. Member
  • **
  • Posts: 87
  • Karma: +1/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #13 on: November 19, 2015, 04:49:28 pm »
yup the beta one works really nice :)
Running my own DNS server and not from my ISP/google/ etc
so dnsbl is really nice on it also. Keep it up BBcan

Offline cmb

  • Hero Member
  • *****
  • Posts: 11230
  • Karma: +893/-7
    • View Profile
    • Chris Buechler
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #14 on: November 20, 2015, 04:18:13 am »
This has been merged, it'll be live in the package repo within at most ~15 minutes of the time of this post.

I largely relied on all your reports here for testing, only checking that the basics function and there isn't anything malicious, or grossly wrong at a glance. If there are issues, BBCan, please follow up with pull requests and I'll make sure one of us gets them merged promptly. Those who were beta testing, it'd help if you can reinstall latest from the standard package repo and report back.

Thanks BBCan!