The pfSense Store

Author Topic: pfBlockerNG v2.0 w/DNSBL  (Read 286214 times)

0 Members and 2 Guests are viewing this topic.

Offline shopro

  • Newbie
  • *
  • Posts: 15
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #60 on: November 22, 2015, 01:01:36 am »
The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.

Offline shopro

  • Newbie
  • *
  • Posts: 15
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #61 on: November 22, 2015, 02:08:33 am »
The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.

Got it working by completely removing the package and settings and reinstalling, removing settings was the key though no idea what was wrong. Now it starts as it should.

Offline AndrewZ

  • Full Member
  • ***
  • Posts: 256
  • Karma: +19/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #62 on: November 22, 2015, 02:57:07 am »
Upgraded to 2.0, now always see the yellow sign on the status page with the following tooltip:
Quote
pfBlockerNG deDuplcation is out of sync. Perform a Force Reload to correct.

Tried Force Reload, Update, Cron, selecting/de-selecting deduplication is settings - nothing helps.
This warning goes off only if deduplication is disabled.


Offline doktornotor

  • Hero Member
  • *****
  • Posts: 8553
  • Karma: +956/-278
  • Not a pfSense employee, they cannot fire me...
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #63 on: November 22, 2015, 03:08:46 am »
Host lookup most likely works because it's doing is via unbound. Just a thought let us know :)

Well, it's not. Also not blocked, otherwise it'd be resolved to the DNSBL VIP.

Tried Force Reload, Update, Cron, selecting/de-selecting deduplication is settings - nothing helps.
This warning goes off only if deduplication is disabled.

Probably easier to just wipe the lists:

Code: [Select]
rm -rf /var/db/pfblockerng/

Reinstall the package and run 'Force Update' after that.
« Last Edit: November 22, 2015, 03:13:35 am by doktornotor »
Do NOT PM for help!

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #64 on: November 22, 2015, 10:33:51 am »
I am receiving certificate invalid errors after enabling the DNSBL when navigating certain sites - so far the culprit seems to mainly be googleads.g.doubleclick.net when trying to serve content over an HTTPS enabled website.

@Atlan, As indicated in reggie14's post, if you can reply back with the following questions below and we can go from there.

Can you provide additional information to reproduce this?  What browser are you using?  What webpage were you accessing?  If I can see an example, and maybe inspect a packet capture and page source code may be I can see what's going on.


The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.

Got it working by completely removing the package and settings and reinstalling, removing settings was the key though no idea what was wrong. Now it starts as it should.

If there are errors starting/stopping the DNSBL service, those will be logged to the pfSense System log.  The RC file for the DNSBL service is here (/usr/local/etc/rc.d/dnsbl.sh [stop|start|restart])

The dnsbl_error.log seems normal, no errors or anything else like that. The dnsbl.log says "Log file is empty or does not exist." which I assume is because the service isn't started.

The dnsbl_error.log is actually an error log for DNSBL Lighttpd. I will be renaming this file to something else to avoid this confusion. This log is used to collect any HTTPS alerts from the Lighttpd conditional error process (debug.log-condition-handling option).

Upgraded to 2.0, now always see the yellow sign on the status page with the following tooltip:

This warning indicates that the masterfile is out of sync with the files in the /deny folder. This is a new feature that was added to v2.0 to warn users about this issue. Usually running a 'Force Reload' is sufficient to fix that warning; however, clearing out all the files and starting fresh might be needed in certain conditions. If this is still an issue, please review the pfblockerng.log file for other clues.

Probably easier to just wipe the lists:

Code: [Select]
rm -rf /var/db/pfblockerng/

Reinstall the package and run 'Force Update' after that.

Can also just uncheck 'Keep Settings' and Disable 'pfBNG' and 'Save' which will do the same :)

Getting this EasyList error for w/o elements.

 [ DNSBL_EasyList - w/o Elements ] Download FAIL
  Could not determine IP address of host.
  Firewall and/or IDS are not blocking download.
Well, it's not. Also not blocked, otherwise it'd be resolved to the DNSBL VIP.

I will be adding another validation on failed downloads to check if the 'Host Address' returns as the DNSBL VIP address (Meaning DNSBL is blocking the download), and adding that to the Error Response. But yes, if the error is "Could not determine IP address of host.", then there was another issue with the DNS lookup that failed. If DNSBL was blocking this download, that error message would not be displayed.

« Last Edit: November 22, 2015, 10:40:03 am by BBcan177 »
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline docjay

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
  • A mistress lies between a mister and a mattress.
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #65 on: November 22, 2015, 12:22:53 pm »
@BBcan177

'If there are errors starting/stopping the DNSBL service, those will be logged to the pfSense System log.  The RC file for the DNSBL service is here (/usr/local/etc/rc.d/dnsbl.sh [stop|start|restart])'

I didn't see anything logged in my system log to help me identify my problem.  Luckily I saw your post - :)

My DNSBL service won't start.  When I attempt to start it from command line it comes back with:
Code: [Select]
[2.2.5-RELEASE][root@cerberus.home]/root: /usr/local/etc/rc.d/dnsbl.sh start
2015-11-22 12:06:31: (network.c.542) SSL: BIO_read_filename('/var/unbound/dnsbl_cert.pem') failed

when I dive into 'var/unbound/' there is no 'dnsbl_cert.pem' file. 

I would rather not lose all of my settings to reinstall the package.  I've already tried this with the box checked 'keep settings' but it still didn't let the service start.  Is there a way to get the file 'dnsbl_cert.pem' or a way to backup my settings and reapply them after I completely wipe the package?

thank you!

 ;D

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #66 on: November 22, 2015, 12:29:16 pm »
Is there a way to get the file 'dnsbl_cert.pem' or a way to backup my settings and reapply them after I completely wipe the package?

If you run 'Force Update' that pem file should be automatically created.
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline docjay

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
  • A mistress lies between a mister and a mattress.
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #67 on: November 22, 2015, 01:15:33 pm »
Just did a 'force update' and it still didn't create the 'dnsbl_cert.pem' file.  ..and I do have 'Enable DNSBL' checked.

from the log viewer:

http://pastebin.com/HbA3ZRiK

Thanks

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #68 on: November 22, 2015, 01:25:41 pm »
It looks like Cron was running in the background when you pressed "Save"... This was in the log:

** DNSBL Disabled **

Try another 'Force update'. You also have to change the 'State' to 'Flex' for some of those lists that are failing.

Also Toasted Spam has this URL
http://toastedspam.com/deny

Also put 'StopForumSpam' into its own Alias and set the frequency to 'Once per day', as that List is rate-limiting connections.

« Last Edit: November 22, 2015, 01:32:50 pm by BBcan177 »
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline docjay

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
  • A mistress lies between a mister and a mattress.
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #69 on: November 22, 2015, 01:48:57 pm »
Okay - I uncheck the 'enable DNSBL' box, saved it & then rechecked it.  Saved it again, all while I made sure CRON was not running.

I also made the changes you suggested, thanks!   :D

log:  http://pastebin.com/jHQnF1qH

it still tells me

**DNSBL Disabled**

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #70 on: November 22, 2015, 02:05:35 pm »
One of the required DNSBL settings is missing. Do you have the DNS Resolver (Unbound) enabled?

I also fixed an issue with the Download Failure function.
https://github.com/pfsense/pfsense-packages/pull/1192
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline docjay

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
  • A mistress lies between a mister and a mattress.
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #71 on: November 22, 2015, 02:07:49 pm »
I was just replying to you about my mistake!   ::)

@BBcan177

Sorry to waste your time.  I didn't have the DNS Resolver enabled.  I disabled the DNS forwarder, enabled DNS Resolver & did another 'force update' & it built the file and updated the config.

Thanks & again, sorry!

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2554
  • Karma: +797/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #72 on: November 22, 2015, 02:11:20 pm »
NP. This will probably help someone else who hits the same scenario. Either way, seeing your 'pfblockerng.log' tweaked me to check the code and find a small error with the download failure function. ;)
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline docjay

  • Newbie
  • *
  • Posts: 24
  • Karma: +1/-0
  • A mistress lies between a mister and a mattress.
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #73 on: November 22, 2015, 02:18:01 pm »
You da man - DNSBL is so worth while, thanks for all of your hard work & for the re-write!   ;D  It makes websites load much faster & I get the screw over the man by not looking at ads.

I will be donating to you if you accept donations. 

--** Good Job**--

Offline michaelmullanyza

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #74 on: November 23, 2015, 02:42:21 am »
Hey BB.

I'd just like some clarification as I'm not sure what the differences are.

I'm currently making use of IPv4 lists in PfBlockerNG. For example, I have the "spyware" iblocklist as an alias, and deny outbound.

As you know, this converts the lists into a Firewall IP Alias and denies Outbound on LAN for this Alias.

What's the point in using the DNSBL then? I understand if I want to block the domain "facebook.com" I can do that with DNSBL, but if I'm only really making use of iblocklist.com and your bambenekconsulting lists, there's no need for me to make use of DNSBL correct?

If I haven't understood it correct, please let me know :)