The pfSense Store

Author Topic: pfBlockerNG v2.0 w/DNSBL  (Read 284819 times)

0 Members and 2 Guests are viewing this topic.

Offline xchaz

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1035 on: September 27, 2017, 06:14:52 am »
Blocking via DNS is difficult with Domain based blocking, as Youtube/Google mix the webpages and ADs together, so blocking ADs may also block other webpages...

Agree. It's a challenge on how to make this work without affecting the entire/other webpages. I think its time to add an unofficial 3rd party package, E2******. Well see how the content-control software do.

Offline ASM_COPE

  • Newbie
  • *
  • Posts: 9
  • Karma: +0/-0
    • View Profile
Re: Whitelist
« Reply #1036 on: September 27, 2017, 06:21:48 am »
I've been trying to emulate the same configuration as this poster outlines, for the same reasons.  However the rule order preference that BBCan suggests doesn't seem to be followed, with the pfB alias_permit rule ("pfB AllowEmails") getting moved under the pfb block rules when the PFB cron update occurs.

I should probably first state that I'm not using the DNSBL option.

I have the latest version to date and wondering if there is a way, or if in the future, possible to whitelist IPs from companies like Teamviewer sending email from Germany when all countries are blocked?

I understand it sounds counter productive as pfSense blocks all by default but we want pfBlockerNG blocking all international traffic as we open ports for services and don't need the N. Koreans attempting any crazy stuff.  pfBlockerNG has done a marvelous in blocking unwanted international email spam which is an A+++!

To overcome an IP that is blocked by a GeoIP Alias, you can create a "Permit" Alias, and add the IPs to the customlist at the bottom of this new Alias. Then set the appropriate action such as "Permit Outbound". Then ensure that this Permit rule is above the other Block rules by setting the appropriate "Rule Order" setting in the general tab.

You can also use the "Whois" setting in the IPv4 tab to whitelist a particular ASN number.  Click on the blue infoblock icons in the IPv4 tab for further details.

I've attached image of rules as I would expect them to stay, given the selected PFB rule selection (image also attached).

I've struggled with this system due to lack of concrete documentation (possibly also lack of brain power!!) and trying to peg together info from many sources, many of which conflict in the approach.  I found this reddit post to be the most helpful so far: https://www.reddit.com/r/PFSENSE/comments/48iiq4/pfblockerng_exceptionswhitelist/

We host servers behind the pfSense box, so we have allow rules to forward specific service ports/virtual-IP's to those systems.  We now also need to block large attack volumes from countries/continents we have no business connection to - in particular people trying to hack into email accounts (causing account lockouts) and the VoIP server (which luckily provides its own blacklisting, but at penalty of additional network load).

I have tried using the main suggestion of "allowed countries" (rather than "block the world") - but this doesn't seem to provide enough protection, as with that approach we still see connections to our internal servers from countries that we don't want/need.  So the "block the world" approach and then allowing our own country (UK), plus adding some whitelisted addresses for known customer email sources (using services such as Messagelabs which use server presences across Europe) seems to be the configuration that works as we want.

I fully accept this whitelisting approach is not easy with need to keep our manual list updated - but once we get the main sources in the list it shouldn't need changing very often.

But I'm worried that the PFB rule priority setting seems to be ignored (or that the whitelist is not seen as a Pass/Match rule) - or simply I've not understood how to keep the Alias_Permit definition at the top of the rules.  I can't spend time resetting the rule several times a day.

So just in the time taken to write this, the PFB cron job has occurred and the rule order changed again (attachment "Rule order after PFB cron update.png)", once again moving our whitelist rule under the block rules.

Any ideas what I am doing wrong?  Could it be that using the Alias_Permit instead of "Allow Inbound" for the IPv4 custom list is the problem?

We are on pfSense version 2.3.4-p1, with PFB 2.1.1_10.  We also use SNORT (just updated from 3.2.9.3 to 3.2.9.5_1) and OpenVPN.

Thanks.

EDIT I experimented with changing the IPv4 alias list setting from "Alias_Permit" to "Permit_Inbound".  That then uses the PFB rule priority setting to place the whitelist at the top of the PFB "auto rules", as its now set by PFB itself.  My manually added rule was still present (but again had been moved below the PFB reject rules), so I've deleted it.

While it seems I've got things working, I'd still like to know if there is any better config I can define that still matches the desired protection as described above.
« Last Edit: September 27, 2017, 07:41:16 am by ASM_COPE »

Offline Riftcore34

  • Newbie
  • *
  • Posts: 17
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1037 on: November 10, 2017, 06:39:58 pm »
@BBcan177
First I wanted to thank you for the work you have put into this and as usual no real problems. I just wanted to ask about the gif image being pushed to the browser. When I browse to the VIP address I get a 1x1 pixel image.  Is this image a placecard holder that would be populated with info or should it be in a different scale. I run my browser locked down as much as possible so not having seen the image is not on my priority list. I can ping and browse to it but was wondering about the single pixel size. If this is normal unpopulated size no worries but if not where do you hide it and what size is the default.

Where is this 1x1 Pixel option? I don't see it anywhere.

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1038 on: November 12, 2017, 05:36:10 pm »
@BBcan177
First I wanted to thank you for the work you have put into this and as usual no real problems. I just wanted to ask about the gif image being pushed to the browser. When I browse to the VIP address I get a 1x1 pixel image.  Is this image a placecard holder that would be populated with info or should it be in a different scale. I run my browser locked down as much as possible so not having seen the image is not on my priority list. I can ping and browse to it but was wondering about the single pixel size. If this is normal unpopulated size no worries but if not where do you hide it and what size is the default.

Where is this 1x1 Pixel option? I don't see it anywhere.

Some details here:
   https://forum.pfsense.org/index.php?topic=120253.msg665063#msg665063

With the current version its not practical since you will get this image instead of the 1x1 for blocked ADs also...

The next version has functionality to push a blocked page if the blocked page was say www.example.com... And if the blocked page was an AD, then it gets the 1x1 pixel instead...

The Blocked page is also customizable to what ever you want to add to it...
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline Cardnyl

  • Newbie
  • *
  • Posts: 6
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1039 on: November 12, 2017, 10:41:32 pm »
I set up pfBlockerNG using this guide https://www.tecmint.com/install-configure-pfblockerng-dns-black-listing-in-pfsense/. I saw it mentioned (somewhere around page 45ish) that one of the reasons why I might not be see any sort of output on the alerts or blocking in general was because I am running Squid (transparent mode, wpad, ssl filtering (splice all)) on LAN and loopback interfaces. Do I need to adjust Squid to also filter on WAN interface as well to get these two packages to play with one another or is it something else entirely?

I'm able to browse and ping the VIP address with no problems. I attempted to ping and nslookup something off of the yoyo list which I have added on my feeds and both went through okay.

Offline Paul007

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1040 on: November 13, 2017, 03:33:54 pm »
I have new hardware with a new installation.
I restore de backup file.
But on the new installation pfblockerNG  geoIP is missing.
Code: [Select]
>>> Installing pfSense-pkg-pfBlockerNG...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking integrity... done (0 conflicting)
The following 9 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
pfSense-pkg-pfBlockerNG: 2.1.2_1 [pfSense]
lighttpd: 1.4.45_1 [pfSense]
lua52: 5.2.4 [pfSense]
whois: 5.2.17 [pfSense]
GeoIP: 1.6.11 [pfSense]
grepcidr: 2.0 [pfSense]
aggregate: 1.6_1 [pfSense]
pecl-intl: 3.0.0_10 [pfSense]
icu: 59.1,1 [pfSense]

Number of packages to be installed: 9

The process will require 47 MiB more space.
[1/9] Installing lua52-5.2.4...
[1/9] Extracting lua52-5.2.4: ......... done
[2/9] Installing icu-59.1,1...
[2/9] Extracting icu-59.1,1: .......... done
[3/9] Installing lighttpd-1.4.45_1...
[3/9] Extracting lighttpd-1.4.45_1: .......... done
[4/9] Installing whois-5.2.17...
[4/9] Extracting whois-5.2.17: .......... done
[5/9] Installing GeoIP-1.6.11...
[5/9] Extracting GeoIP-1.6.11: .......... done
[6/9] Installing grepcidr-2.0...
[6/9] Extracting grepcidr-2.0: ..... done
[7/9] Installing aggregate-1.6_1...
[7/9] Extracting aggregate-1.6_1: .... done
[8/9] Installing pecl-intl-3.0.0_10...
[8/9] Extracting pecl-intl-3.0.0_10: .......... done
[9/9] Installing pfSense-pkg-pfBlockerNG-2.1.2_1...
[9/9] Extracting pfSense-pkg-pfBlockerNG-2.1.2_1: .......... done
Saving updated package information...
done.
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Executing custom_php_install_command()...
Downloading MaxMind GeoIP databases. This may take a minute...
 GeoIP.dat... cURL Error: 60.  cURL Error: 60.  cURL Error: 60.  Failed!
MaxMind download Failed! Fetching MaxMind archive from pfSense package repo...
/tmp/countrycodes.tar.bz2                                0  B    0  Bps
Fetch done.
Converting MaxMind GeoIP databases for pfBlockerNG.
 This may take a few minutes...
Country code update Start [ 11/13/17 22:00:44 ]
 [ MAXMIND UPDATE FAIL, Language File Missing, using previous Country code database ]
Creating pfBlockerNG Continent XML files...
 Creating pfBlockerNG Continent XML files
 IPv4 Africa
 IPv6 Africa [ 11/13/17 22:00:45 ]
 IPv4 Antarctica
grep: /usr/local/share/GeoIP/cc/Antarctica_v4.txt: No such file or directory
 IPv6 Antarctica
grep: /usr/local/share/GeoIP/cc/Antarctica_v6.txt: No such file or directory
 IPv4 Asia
 IPv6 Asia
 IPv4 Europe
 IPv6 Europe [ 11/13/17 22:00:48 ]
 IPv4 North America
 IPv6 North America [ 11/13/17 22:00:49 ]
 IPv4 Oceania
 IPv6 Oceania [ 11/13/17 22:00:50 ]
 IPv4 South America
 IPv6 South America
 IPv4 Proxy and Satellite
grep: /usr/local/share/GeoIP/cc/Proxy_and_Satellite_v4.txt: No such file or directory
 IPv6 Proxy and Satellite
grep: /usr/local/share/GeoIP/cc/Proxy_and_Satellite_v6.txt: No such file or directory
 IPv4 TOP 20
grep: /usr/local/share/GeoIP/cc/Top_20_v4.info: No such file or directory
 IPv6 TOP 20
grep: /usr/local/share/GeoIP/cc/Top_20_v6.info: No such file or directory
 pfBlockerNG Reputation Tab
Country Code Update Ended

Adding pfBlockerNG Widget to the Dashboard... done.
Remove any existing and create link for DNSBL lighttpd executable... done.
Creating DNSBL web server start-up script... done.
Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
Custom commands completed ... done.
Executing custom_php_resync_config_command()...done.
Menu items... done.
Services... done.
Writing configuration... done.
Message from lua52-5.2.4:
===>   NOTICE:

The lua52 port currently does not have a maintainer. As a result, it is
more likely to have unresolved issues, not be up-to-date, or even be removed in
the future. To volunteer to maintain this port, please create an issue at:

https://bugs.freebsd.org/bugzilla

More information about port maintainership is available at:

https://www.freebsd.org/doc/en/articles/contributing/ports-contributing.html#maintain-port
Message from GeoIP-1.6.11:
GeoIP does not ship with the actual data files. You must download
them yourself! Please run:
# /usr/local/bin/geoipupdate.sh
Message from pecl-intl-3.0.0_10:
****************************************************************************

The following line has been added to your /usr/local/etc/php/ext-20-intl.ini
configuration file to automatically load the installed extension:

extension=intl.so

****************************************************************************
>>> Cleaning up cache... done.
Success

Is there anything else I can do in the pfBlockerNG settings to sort this out?
 

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1041 on: November 13, 2017, 03:38:01 pm »
From your logs... Something is blocking the MaxMind download... So need to see what is causing that...

Code: [Select]
Downloading MaxMind GeoIP databases. This may take a minute...
 GeoIP.dat... cURL Error: 60.  cURL Error: 60.  cURL Error: 60.  Failed!
MaxMind download Failed! Fetching MaxMind archive from pfSense package repo...
/tmp/countrycodes.tar.bz2     

The backup archive that is located on pfSense's servers is a little out of date... I should fix that.

Here is one of the files that you can test with to see why its failing to download:
https://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip

MaxMind does rate-limit if you attempt too many downloads in a day...
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline StylesNZ

  • Newbie
  • *
  • Posts: 10
  • Karma: +1/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1042 on: November 24, 2017, 11:47:36 pm »
So, I don't wanna be one the one to ask this, but I am so eager to try 3.0. Any update when this will be released?  I just did a clean install of the newest pfSense and like the changes and fixes in place but I didn't think to save all my config etc before I did it. (I know, really dumb of me). Would this of worked anyway? It's really tedious going through and looking for the lists again, so I'm feeling hopeful here it's coming soon as I really love pfBlockerNG and the work you do BBCan177!!! :)

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #1043 on: November 25, 2017, 11:14:56 pm »
So, I don't wanna be one the one to ask this, but I am so eager to try 3.0. Any update when this will be released?  I just did a clean install of the newest pfSense and like the changes and fixes in place but I didn't think to save all my config etc before I did it. (I know, really dumb of me). Would this of worked anyway? It's really tedious going through and looking for the lists again, so I'm feeling hopeful here it's coming soon as I really love pfBlockerNG and the work you do BBCan177!!! :)

Thanks,  I am hoping to get this out shortly... Just trying to clean up a couple loose ends.... Stay tuned!
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |