Netgate SG-1000 microFirewall

Author Topic: pfBlockerNG v2.0 w/DNSBL  (Read 285540 times)

0 Members and 2 Guests are viewing this topic.

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #30 on: November 20, 2015, 06:18:46 pm »
Here is a PR to fix the Installation issue being reported...

https://github.com/pfsense/pfsense-packages/pull/1189

Once this is merged, if anyone has similar issues, please report back. Thanks!
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline fraglord

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +1/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #31 on: November 20, 2015, 06:25:04 pm »
If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver
pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

Offline Hugovsky

  • Full Member
  • ***
  • Posts: 264
  • Karma: +6/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #32 on: November 20, 2015, 06:30:17 pm »
Thanks BBcan177, and everyone that made this package possible. Great jpb.


If you move your configuration from DNS Forwarder to DNS Resolver in order to use pfBlockerNG: For multi-WAN configurations you have to have forwarding mode enabled. See also here: https://doc.pfsense.org/index.php/Unbound_DNS_Resolver

Can you elaborate? I have multi-wan and forwarding disabled and everything works.

Offline cmb

  • Hero Member
  • *****
  • Posts: 11230
  • Karma: +893/-7
    • View Profile
    • Chris Buechler
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #33 on: November 20, 2015, 06:32:51 pm »
Latest PR merged.

Offline Dpain

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #34 on: November 20, 2015, 06:42:09 pm »
There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate? I'd like to thank you, you have no idea I've been trying to block ads on my wireless devices and had been trying to do this on an Asus RT-68U (AP mode)  with both tomato and merlin and was having issues.  PfBlockerNG 2.0 has solved this issue for me, I no longer have to mess around with the Asus router and don't have to worry bout getting ads on my sons ipad/pc. I added a feed from http://winhelp2002.mvps.org/hosts.htm would this work for host files as well? In the log it does seem to have downloaded the .txt file (see attached screenshot)  Thanks  again  BBcan177 for your work!
« Last Edit: November 20, 2015, 06:45:38 pm by Dpain »

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #35 on: November 20, 2015, 06:49:56 pm »
Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)

1) Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"

hpHosts
http://hosts-file.net/download/hosts.zip

SWC
http://someonewhocares.org/hosts/hosts

spam404
https://spam404bl.com/blacklist.txt
https://raw.githubusercontent.com/Dawsey21/Lists/master/main-blacklist.txt

malc0de
https://malc0de.com/bl/BOOT

MDS (use 'Flex' state)
https://mirror1.malwaredomains.com/files/justdomains

MVPS
http://winhelp2002.mvps.org/hosts.txt

MDL
http://www.malwaredomainlist.com/hostslist/hosts.txt

Discontinued
GJTech
http://adblock.gjtech.net/?format=unix-hosts


dShield_SD   (They also have a conservative list available)
https://www.dshield.org/feeds/suspiciousdomains_High.txt

Zeus
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist


2) These two feeds post full URLs, so there can be some more false positives.
Create a new Alias, and use Alexa as a recommendation.

PhishTank
https://data.phishtank.com/data/online-valid.csv.bz2

OpenPhish
https://www.openphish.com/feed.txt

MPatrol (You need to register - Free or Paid subscription. Use Danguardian feed)
https://lists.malwarepatrol.net


3) This is a feed that I manage (as time permits)
MS_2
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw


4) Use this in its own Alias:

BBC_DGA  (This is a large feed of DGA for the likes of Cryptolocker et al...)
http://osint.bambenekconsulting.com/feeds/dga-feed.gz

BBC_C2
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt


5) Use this feed in its own alias as it is updated more frequently.
So you can update it more often than once per day.

hpHosts_partial
http://hosts-file.net/hphosts-partial.asp


If users find other feeds, please post back so that others may benefit also.
Its also important to donate to the feeds provider (IP and/or Domain) as they all need support.
« Last Edit: February 22, 2017, 10:36:51 am by BBcan177 »
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline tonymorella

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +12/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #36 on: November 20, 2015, 06:51:30 pm »
Here are some basic instructions to get started with DNSBL.

1) Open the pfBNG "DNSBL" Tab:

(Use the defaults unless you have a need to use otherwise)
Enter the DNSBL VIP as 10.10.10.1
Enter the DNSBL Listening Port as 8081
Enter the DNSBL SSL Listening port as 8443
Select the DNSBL Listening Interface as Lan

For the DNSBL Firewall Rule select all of the LAN subnets that access the DNS Resolver.
Ensure that all Devices that use the DNS Resolver, have the Resolver as its only DNS setting for DNSBL to function properly.

DNSBL IP Firewall Rule Settings:
Select Deny outbound or as per your requirements
select Enable logging

Alexa   (is optional, you can skip this until later if you wish)
Select Top 1K
Select the TLD Inclusions as ca,co,com,io,me,net,org or as required.

In the Custom List you may enter any domain you wish to Whitelist.

Save your settings


2) Open the "DNSBL Feeds" Tab:

Create a new DNSBL Alias

Enter DNS Group Name as ADs
Enter Description as DNSBL ADverts

DNSBL:

Enter the Header/Label and Source URL as follows:
(Use copy/paste as plain text for the URL)

Format Auto and State ON

yoyo
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext

hpHosts_ads
http://hosts-file.net/ad_servers.txt

Adaway
https://adaway.org/hosts.txt

Cameleon
http://sysctl.org/cameleon/hosts


Select List Action as Unbound
Select Update Frequency as Once a day
 
Alexa:
Do not enable the Alexa Whitelist for this ADverts based alias, as Alexa also posts the top ADvert servers. So using Alexa whitelist, will interfere with ADvert Blocking.

Add any other domains that you wish to block in the Custom List.

Save your settings


3) Open the "DNSBL" Tab:

Click DNSBL Enable checkbox.
Save your settings


4) Open the "Update" Tab:

Select Force Update

You should now see the DNSBL Feeds being downloaded and parsed. Once that is complete, goto the Dashboard, and confirm that the widget is populated correctly.

5) Goto the pfBlockerNG "Alerts" Tab:

Any domain that is blocked will be reported here. For HTTPS alerts, the SRC IP and URL are not captured due to Browser security measures.

As a test, goto www.aol.com  and www.yahoo.com  and see some alerts populate.

There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.


Have been using the beta code for some time and noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter.

Code: [Select]
popcash.net
www.popcash.net
outbrain.com
www.outbrain.com
onclickads.net
www.onclickads.net
googleadservices.com
www.googleadservices.com
adcash.com
www.adcash.com
popads.net
www.popads.net

To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #37 on: November 20, 2015, 06:54:36 pm »
There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?

  Thanks  again  BBcan177 for your work!

I could use a lifetime pfSense Gold subscription... :) But I think all developers should get that as a bonus :)

My email is at the bottom of the pfBNG general tab.
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline Dpain

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #38 on: November 20, 2015, 07:16:31 pm »
There are several other DNSBL Feeds that can be used with pfBNG DNSBL. I will post that at a later date, once users get their basic configurations working. There is also an ADBlock Easylist tab, which is pretty self-explanatory.

Huge thanks BBcan177!!! First off really looking forward to you posting more feeds, more importantly though where can I donate?

  Thanks  again  BBcan177 for your work!

I could use a lifetime pfSense Gold subscription... :) But I think all developers should get that as a bonus :)

My email is at the bottom of the pfBNG general tab.

 :o lifetime ?  That would be $99 x how many ever years you have left   ;D :P  so is the email there attached to a paypal account? Not sure if donation talk is allowed on forum if not, I apologize mods. Also , It does seem to be working for host files from http://winhelp2002.mvps.org/hosts.htm Thanks!

Offline fraglord

  • Jr. Member
  • **
  • Posts: 80
  • Karma: +1/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #39 on: November 20, 2015, 07:26:54 pm »
Quote
Can you elaborate? I have multi-wan and forwarding disabled and everything works.
If you enable forwarding mode then a foward-zone named "." is created as well as some forward-addr entries with the DNS servers you sepcified system->general setup.
Default behavior of unbound is to query the Root servers. But if you have a multi-WAN configuration and need to specifiy a different DNS server for each WAN(gateway) you need forwarding mode to be enabled. So yeah, works without forwarding mode for some multi-WAN configs that are fine with just the Root servers.
pfSense 2.4.0 (amd64) running on IGEL H710C | 1G RAM | 8G SSD | INTEL PRO/1000 PT Dual NIC

Offline vito

  • Full Member
  • ***
  • Posts: 198
  • Karma: +3/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #40 on: November 20, 2015, 07:38:24 pm »
BBCan177,
Any problems running your list import script on PFB 2.0?


Offline tonymorella

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +12/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #41 on: November 20, 2015, 07:47:48 pm »
Few things I found out while beta testing V2
  • First rule is take your time and be patient. Adding to may rules at once will casue alot of blocks you may or may not way. Wildcards are not supported, or wanted in most cases. For example adding google.com does not filter all the hosts for the domain, need to add each host that is being blocked to the filter lists
  • Make sure to double check ASN's, especially for large companies that have acquired other companies, more than one ASN might exist[/b]
  • Unbound has an issue in my setup using OpenVPN connected to PIA. It does not start correctly when a network issue is sensed,  em1 or openvpn interfaces flap for example. The core problem seems to be how the rc scripts handle unbound reload.  They do a HUP vs reload to get around the cache being lost. Disabling "DHCP Registration" or "Static DHCP" was a workaround that allowed unbound to start correctly.
  • Checking "DHCP Registration" or "Static DHCP" causes other issues with unbound, this is a know issue being talked about in the DNS forum.  I added all my hosts host to unbound statically as a work around
  • I wanted to have my allow rules > pfb block rules > my block rules > my per interface rules.  Did this by enabling "Floating Rules" and using "pfb_pass/match  | pfsense pass/match |  pfb_block/reject"
  • If you have WIFI make sure to enable "DNSBL Firewall Rule" and select both LAN and WIFI or the NAT: Port Forward rule for 10.10.10.1 is not setup correctly.  If you don't change this setting things still work but everything runs slow over wifi.
  • Make sure to whitelist all the DNSBL sites FQDN via an allow aliases, some IPv4 block-lists include the IP space the DNSBL are found in
  • DBSBL is basicly a man in the middle for DNS so any site that is block but running https will create warrnings. Depending on how the brower is setup it might just ignore or not display the error.  CTRL+SHIFT+I on both Chrome and Firebox will bring up dev panel where you can see which pages are not loading. Chrome will show an error, Firefox will show a red slash throught the lock icon.
  • Noticed a list of domains in the Alexa top 1K that serve up ads, since I don't want this I added the following custom block list to my Ads DNS Group which will remove them from any DNS group that is using the Alexa top 1K filter. To confirm make sure "Enable Alexa Whitelist" is NOT checked for this DNS group.
Code: [Select]
popcash.net
www.popcash.net
cdn.popcash.net
outbrain.com
www.outbrain.com
onclickads.net
www.onclickads.net
googleadservices.com
www.googleadservices.com
adcash.com
www.adcash.com
popads.net
www.popads.net
popmyads.com
www.popmyads.com
  • List of domains added to DNSBL Custom Domain Suppression to stop them from being blocked
Code: [Select]
goo.gl
google.com
www.google.com
mail.google.com
docs.google.com
sites.google.com
fonts.googleapis.com
cache.google.com
clients.google.com
clients0.google.com
clients1.google.com
clients2.google.com
clients3.google.com
clients4.google.com
clients5.google.com
clients6.google.com
clients7.google.com
clients8.google.com
clients9.google.com
www.maxmind.com
s3.amazonaws.com
fls-na.amazon.com
login.live.com
redis.io
pgl.yoyo.org
someonewhocares.org
www.thingamajob.com
winhelp2002.mvps.org
hosts-file.net
www.hosts-file.net
adaway.org
sysctl.org
adblock.gjtech.net
www.dshield.org
malwaredomainlist.com
malwaredomains.com
bambenekconsulting.com
malwarepatrol.net
zeustracker.abuse.ch
malc0de.com
curl.haxx.se
dl.dropboxusercontent.com
whois.cymru.com
github.com
collector-cdn.github.com
pivotal.github.com
cloud.github.com
raw.githubusercontent.com
raw.github.com
stopforumspam.com
www.stopforumspam.com
sourceforge.net
www.sourceforge.net
iweb.dl.sourceforge.net
chase.com
www.chase.com
mint.com
www.mint.com
americanexpress.com
www.americanexpress.com
online.americanexpress.com
linuxquestions.org
www.linuxquestions.org
optimizely.com
www.optimizely.com
api.optimizely.com
cdn.optimizely.com
cdn2.optimizely.com
cdn3.optimizely.com
slashdot.org
www.slashdot.org
ebay.com
www.ebay.com
rover.ebay.com
srx.main.ebayrtm.com
openbl.org
www.openbl.org
www.us.openbl.org
delta.com
www.delta.com
aa.com
www.aa.com
cruisesonly.com
www.cruisesonly.com
ripe.net
www.ripe.net
weather.com
www.weather.com
lacnic.net
www.lacnic.net
tvrage.com
services.tvrage.com
www.tvrage.com
publicbt.com
device.maxmind.com
www.boingo.com
xda-developers.com
www.xda-developers.com
forum.xda-developers.com
opengapps.org
download.mono-project.com
  • Ads DNS Group
    • Update Frequency: Once a Day
    • Enable Alexa Whitelist: NOT Enabled
    • Add Custom Block List noted above
Code: [Select]
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintextoup yoyo
http://hosts-file.net/ad_servers.txt hphosts_ats
https://adaway.org/hosts.txt adaway
http://sysctl.org/cameleon/hosts syctrl
http://adblock.gjtech.net/?format=unix-hosts gjtech
  • Privacy Fraud DNS Group
    • Update Frequency: Once a Day
    • Enable Alexa Whitelist: Enabled
Code: [Select]
https://s3.amazonaws.com/lists.disconnect.me/simple_tracking.txt disconnect_basic
http://hosts-file.net/fsa.txt hphost_fsa
http://hosts-file.net/hjk.txt hphost_hjk
http://hosts-file.net/pha.txt hphost_psh
https://www.dshield.org/feeds/suspiciousdomains_High.txt dshield_sdh
  • Malware Exploit DNS Group
    • Update Frequency: Once a Day
    • Enable Alexa Whitelist: Enabled
Code: [Select]
https://s3.amazonaws.com/lists.disconnect.me/simple_malvertising.txt disconnect_malvertising
http://www.malwaredomainlist.com/hostslist/hosts.txt malwaredomainlist
http://mirror1.malwaredomains.com/files/justdomains malwaredomains
https://s3.amazonaws.com/lists.disconnect.me/simple_malware.txt disconnect_malware
http://hosts-file.net/emd.txt hphosts_emd
http://hosts-file.net/exp.txt hphosts_exp
http://hosts-file.net/mmt.txt hphosts_mmt
https://lists.malwarepatrol.net/cgi/getfile?receipt=f1442112770&product=8&list=dansguardian malwarepatrol
https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist zeustracker
https://malc0de.com/bl/BOOT malc0de
  • SPAM DNS Group
    • Update Frequency: Once a Day
    • Enable Alexa Whitelist: Enabled
Code: [Select]
http://hosts-file.net/grm.txt hphost_grm
http://hosts-file.net/hfs.txt hphost_hfs
https://spam404bl.com/blacklist.txt spam_404
  • Malicious DNS Group
    • Update Frequency: Once a Day
    • Enable Alexa Whitelist: Enabled
Code: [Select]
http://hosts-file.net/hphosts-partial.txt hphost_partial
http://winhelp2002.mvps.org/hosts.txt mvps_hosts
http://someonewhocares.org/hosts/hosts SomeoneWhoCares
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw BBcan177
  • BambenekConsulting DNS Group
    • Update Frequency: Once a Day
    • Enable Alexa Whitelist: Enabled
Code: [Select]
http://osint.bambenekconsulting.com/feeds/dga-feed.gz bambenek_dga
http://osint.bambenekconsulting.com/feeds/c2-dommasterlist.txt bambenek_c2

Thanks
Tony M.
« Last Edit: November 22, 2015, 01:40:24 pm by tonymorella »

Offline tonymorella

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +12/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #42 on: November 20, 2015, 07:55:54 pm »
BBCan177,
Any problems running your list import script on PFB 2.0?

This scripted worked without an issue for me.

Offline ntct

  • Jr. Member
  • **
  • Posts: 64
  • Karma: +8/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #43 on: November 21, 2015, 01:50:04 am »
Oops! I found ZeuS Tracker is shut down, I hope it is only temporary.

Offline Hugovsky

  • Full Member
  • ***
  • Posts: 264
  • Karma: +6/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #44 on: November 21, 2015, 10:25:04 am »
Quote
Can you elaborate? I have multi-wan and forwarding disabled and everything works.
If you enable forwarding mode then a foward-zone named "." is created as well as some forward-addr entries with the DNS servers you sepcified system->general setup.
Default behavior of unbound is to query the Root servers. But if you have a multi-WAN configuration and need to specifiy a different DNS server for each WAN(gateway) you need forwarding mode to be enabled. So yeah, works without forwarding mode for some multi-WAN configs that are fine with just the Root servers.

Thank you.