pfSense Support Subscription

Author Topic: pfBlockerNG v2.0 w/DNSBL  (Read 285720 times)

0 Members and 3 Guests are viewing this topic.

Offline Atlan

  • Newbie
  • *
  • Posts: 4
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #45 on: November 21, 2015, 12:16:06 pm »
I am receiving certificate invalid errors after enabling the DNSBL when navigating certain sites - so far the culprit seems to mainly be googleads.g.doubleclick.net when trying to serve content over an HTTPS enabled website.

The attempt still shows in the Alerts tab of pfBlockerNG, the main site still loads, but it seems to be wanting to use the firewall's self signed certificate as the certificate for the ad server host.

Did I miss a setting somewhere to prevent this from happening?




Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #46 on: November 21, 2015, 12:25:51 pm »
There's no such setting anywhere and no way to prevent this from happening really, except for whitelisting the domain.
Do NOT PM for help!

Offline reggie14

  • Full Member
  • ***
  • Posts: 125
  • Karma: +12/-5
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #47 on: November 21, 2015, 01:17:36 pm »
@Atlan

To a certain extent, this isn't surprising.  pfBlockerNG essentially has to Man-in-the-Midde HTTPS.  If the ad is being loaded from an HTTPS server (I don't necessarily mean the page you're viewing, rather where the ad itself is coming from), then pfBlockerNG redirects you to its own little webserver running on your pfsense box, and, since is done over HTTPS, that webserver uses a generic, default certificate.  It's a different cert than what is used for the pfsense WebGUI.  For various reasons, pfBlockerNG uses the same certifcate for every blocked HTTPS resource.  This creates a problem because the name in the certificate doesn't match the domain name of the blocked resource, which is why you see certificate warnings.  There's no good way around this, though.  Attempting to dynamically create valid certs off a CA running on the pfsense box would be both complicated and slow.

But, I'm a little surprised you're seeing warnings.  I used to see warnings occasionally, but I haven't for a while.  I thought browsers just started silently dropping HTTPS connections to external resources when there's a bad certificate.

Can you provide additional information to reproduce this?  What browser are you using?  What webpage were you accessing?  If I can see an example, and maybe inspect a packet capture and page source code may be I can see what's going on.
« Last Edit: November 21, 2015, 01:21:15 pm by reggie14 »

Offline mtfs

  • Newbie
  • *
  • Posts: 23
  • Karma: +2/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #48 on: November 21, 2015, 01:27:26 pm »
What about setting your virtual address to 0.0.0.0? As that whole /8 is non-routable, you wouldn't get the cert error. It would just silently fail to load ads.

Offline reggie14

  • Full Member
  • ***
  • Posts: 125
  • Karma: +12/-5
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #49 on: November 21, 2015, 04:42:57 pm »
What about setting your virtual address to 0.0.0.0? As that whole /8 is non-routable, you wouldn't get the cert error. It would just silently fail to load ads.

While that might hide the cert error, there would be downsides.  First, some some pages will hang as they wait for the ad server to respond.  Second, blackholing the traffic completely by setting the VIP to something other than the DNSBL webserver will disable alerts.  That would create problems, because the regular ad-blocking lists WILL break some sites and mobile apps.  The alerts are, by far, the easiest way to track down problems.

There are better plausible workarounds, but we need to see some examples to understand under what circumstances people run into cert errors.

Offline BIGGRIMTIM

  • Newbie
  • *
  • Posts: 13
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #50 on: November 21, 2015, 08:05:37 pm »
Sorry if this is stupid question.  I am using OpenDNS and wondered if I can use DNSBL along with it?  The only way I was able to get alert data was by changing the DNS settings on my PC.

Thanks.

Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #51 on: November 21, 2015, 09:00:00 pm »
Sorry if this is stupid question.  I am using OpenDNS and wondered if I can use DNSBL along with it?  The only way I was able to get alert data was by changing the DNS settings on my PC.

Not in this way. If you point your clients to pfSense as DNS server and use OpenDNS as forwarders for Unbound, then yes it should work.
Do NOT PM for help!

Offline tonymorella

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +12/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #52 on: November 21, 2015, 09:21:52 pm »
I am receiving certificate invalid errors after enabling the DNSBL when navigating certain sites - so far the culprit seems to mainly be googleads.g.doubleclick.net when trying to serve content over an HTTPS enabled website.

The attempt still shows in the Alerts tab of pfBlockerNG, the main site still loads, but it seems to be wanting to use the firewall's self signed certificate as the certificate for the ad server host.

Did I miss a setting somewhere to prevent this from happening?

Ya ran into the same problem while beta testing, completely forgot about this issue until I read your post :) For a quick fix I created a CA and web certificate via pfsense GUI then copies this cert to /var/unbound/dnsbl_cert.pem which dnsbl light http will use.  Then push out the CA to all the desktops, could be done via GPO or login scripts. With https://letsencrypt.org/ picking up traction, everything is going to be running over TLS or SSL soon going to have to implement this type of fix.

EDIT: Sorry guys did a bad job on this post and what I was doing, it does not fix the underlying issue with the TLS stream being bad because the cert is not valid, reggie14 did a much better job testing this than I. In my setup is simply helped limit the errors in Chrome. Again just a quick fix that might help. Again sorry for the confusion.

FYI the update from Chrome 45 to 46 made a difference in what come up under security warnings:
http://arstechnica.com/information-technology/2015/10/chrome-finally-kills-off-the-http-https-mixed-content-warning/


Thanks
Tony M
« Last Edit: November 22, 2015, 12:45:04 am by tonymorella »

Offline Asterix

  • Hero Member
  • *****
  • Posts: 888
  • Karma: +32/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #53 on: November 21, 2015, 10:57:54 pm »
Getting this EasyList error for w/o elements.

 [ DNSBL_EasyList - w/o Elements ] Download FAIL
  Could not determine IP address of host.
  Firewall and/or IDS are not blocking download.


Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #54 on: November 21, 2015, 11:02:34 pm »
Getting this EasyList error for w/o elements.

 [ DNSBL_EasyList - w/o Elements ] Download FAIL
  Could not determine IP address of host.
  Firewall and/or IDS are not blocking download.

Well that's not a package error. You need working DNS. :D

Code: [Select]
$ host easylist-downloads.adblockplus.org
easylist-downloads.adblockplus.org has address 148.251.139.76
easylist-downloads.adblockplus.org has address 144.76.100.145
easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:200:114f::2
easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:192:7126::2
Do NOT PM for help!

Offline tonymorella

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +12/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #55 on: November 22, 2015, 12:02:40 am »
Getting this EasyList error for w/o elements.

 [ DNSBL_EasyList - w/o Elements ] Download FAIL
  Could not determine IP address of host.
  Firewall and/or IDS are not blocking download.

Well that's not a package error. You need working DNS. :D

Code: [Select]
$ host easylist-downloads.adblockplus.org
easylist-downloads.adblockplus.org has address 148.251.139.76
easylist-downloads.adblockplus.org has address 144.76.100.145
easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:200:114f::2
easylist-downloads.adblockplus.org has IPv6 address 2a01:4f8:192:7126::2

Filter out easylist-downloads.adblockplus.org via DNSBL as well as add it to an allow alias and see if this helps. Depending out how you having things setup could be blocking.  Host lookup most likely works because it's doing is via unbound. Just a thought let us know :)

Tony M

Offline shopro

  • Newbie
  • *
  • Posts: 15
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #56 on: November 22, 2015, 12:07:15 am »
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.


I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?

Offline tonymorella

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +12/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #57 on: November 22, 2015, 12:24:26 am »
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.


I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?

dnsbl show as stopped is not a good sign, are you sure dnsbl check box is enabled as well as unbound (DNS Resolver)?

Offline shopro

  • Newbie
  • *
  • Posts: 15
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #58 on: November 22, 2015, 12:31:39 am »
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.


I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?

dnsbl show as stopped is not a good sign, are you sure dnsbl check box is enabled as well as unbound (DNS Resolver)?

Yes, both dnsbl and unbound check box's are checked. The funny thing is that it blocks the ad's when enabled, but doesn't seem to use the 1x1 gif and instead just times out the servers.

Offline tonymorella

  • Jr. Member
  • **
  • Posts: 36
  • Karma: +12/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #59 on: November 22, 2015, 12:50:59 am »
I must be doing something wrong as when I load a page containing ads the page load stops until ad servers are timed out. Also in Status -> Services, dnsbl is showed as stopped. Can't seem to find any error logs about it anywhere. Also my alerts tab is empty besides the Deny list.


I configured dnsbl as instructed on page 1 and have double checked everything to be the same way. Though maybe the reason is that my clients use my domain controller as their dns which forwards to pfsense which in turn forwards to OpenDNS. Any ideas where I went wrong?

dnsbl show as stopped is not a good sign, are you sure dnsbl check box is enabled as well as unbound (DNS Resolver)?

Yes, both dnsbl and unbound check box's are checked. The funny thing is that it blocks the ad's when enabled, but doesn't seem to use the 1x1 gif and instead just times out the servers.

If the dnsbl web server is not running this is what I would expect, request will not have a response and will time out.  Anything in /var/log/pfblockerng/dnsbl_error.log and dnsbl.log files?