Netgate SG-1000 microFirewall

Author Topic: pfBlockerNG v2.0 w/DNSBL  (Read 334216 times)

0 Members and 4 Guests are viewing this topic.

Offline yodaphone

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +2/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #975 on: February 20, 2017, 07:25:01 pm »
Here are more DNSBL Feeds that can be used in pfBlockerNG.
(Copy and paste URLS as plain text)

1) Create a new alias for these.
These are not necessarily ADvert domains. So I named mine "Malicious"

malc0de
https://malc0de.com/bl/BOOT


I get this error for malc0de. all other lists are fine

[ DNSBL_Malicious - malc0de ] Download FAIL [ 02/21/17 01:21:47 ]
  Firewall and/or IDS are not blocking download.

Set up exactly the way you have described.

I'm on 2.3.3 RC

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2608
  • Karma: +824/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #976 on: February 21, 2017, 09:14:12 am »
I get this error for malc0de. all other lists are fine

[ DNSBL_Malicious - malc0de ] Download FAIL [ 02/21/17 01:21:47 ]
  Firewall and/or IDS are not blocking download.

Not having any issues with that feed...   Try to
Code: [Select]
ping malc0de.com
and see if it responds... Check the Alerts Tab to see if any alerts get reported... Could be Snort/Suricata, or another Firewall rule....   
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline HeatmiserNYC

  • Jr. Member
  • **
  • Posts: 27
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #977 on: February 26, 2017, 05:39:11 pm »
Hey BBCAN,
Is there a way to get Reek's anti-adblocking list to work under Pfblocker? This would be extremely convenient.

My apologies if this has been asked a trillion times before....

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2608
  • Karma: +824/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #978 on: February 26, 2017, 06:45:10 pm »
Is there a way to get Reek's anti-adblocking list to work under Pfblocker? This would be extremely convenient

Unfortunately not. DNSBL can't manipulate the browser except for sinkholing the DNS request.
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline Brutos

  • Newbie
  • *
  • Posts: 20
  • Karma: +3/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #979 on: March 02, 2017, 04:41:41 am »
Does anyone have a good list for blocking porn sites please?b

I have google and searched and cant find any.

Offline pfBasic

  • Hero Member
  • *****
  • Posts: 1021
  • Karma: +139/-22
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #980 on: March 02, 2017, 09:06:48 am »
Does anyone have a good list for blocking porn sites please?b

I have google and searched and cant find any.

https://forum.pfsense.org/index.php?topic=125863.0

Offline D0X

  • Jr. Member
  • **
  • Posts: 25
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #981 on: March 26, 2017, 09:24:12 am »
Thanks for your support so far, but for now I've given up on pfblockerng. Not that the package is flawed, but Safari on OSX and IOS is driving me nuts.

NP.... Should you decide to pick it backup at some point, try to see why the Ping/Browse to the DNSBL VIP wasn't working. That will cause issues on its own.... also since it was one Domain that was predominantly causing issues,  you could also Whitelist it...

Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2608
  • Karma: +824/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #982 on: March 26, 2017, 10:59:39 am »
Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

Is this with Safari, or all other browsers?

Can you review this link:
    https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

BlueKobold

  • Guest
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #983 on: March 26, 2017, 11:41:53 am »
Quote
Does anyone have a good list for blocking porn sites please?b
There are more options to get better results and for porn sites an OpenDNS account might be a good solution as well!
Squid & SquidGuard or DansGuardian plus pfBlockerNG & DNSBL plus an OpenDNS account





Offline D0X

  • Jr. Member
  • **
  • Posts: 25
  • Karma: +0/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #984 on: March 26, 2017, 12:24:43 pm »
Quoting this old post, but the problem is still occurring. Tried PfblockerNG again this morning, but all Apple devices still bombards me with certificate errors.

Is this with Safari, or all other browsers?

Can you review this link:
    https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099

Safari indeed, on all devices, moving to another browser is not an option here. Doing the mod you suggested, no logging whatsoever will work?

Running Pi-Hole here for a few days now, as an alternative. But this means adding another box to my network. Plus the config is a little weird (pfSense DCHP server forwarding Pi-Hole dns address to clients, clients using Pi-Hole and Pi-Hole using the pfSense DNS Resolver again as its upstream DNS, don't know, feels weird).

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2608
  • Karma: +824/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #985 on: March 26, 2017, 12:32:48 pm »
Both solutions use Lighttpd and both push a 1x1 pix. Strange that it doesn't show any cert errors... Will have to do some digging...

In the link, there is another option to drop just the HTTPS alerts with a firewall rule.
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline ecfx

  • Full Member
  • ***
  • Posts: 227
  • Karma: +31/-14
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #986 on: March 26, 2017, 01:32:16 pm »
pihole it use only http, not https ( because of that on https you have error with site incorrect configured...).

Offline TyphooN

  • Newbie
  • *
  • Posts: 13
  • Karma: +3/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #987 on: April 04, 2017, 09:05:31 pm »
I have been banging my head against the desk for almost a month now and have not been able to find a way to get either of my 2 pfSense VMs (vmware esxi host) to remain stable for ~12 hours with DNSBL enabled while using feeds that were on the first few pages of this forum post.  Issues that I tend to have, sometimes as little as a few hours of uptime.. sometimes around 12-20 hours.  I have been using pfblockerng for quite some time using the traditional ipv4 blocklists with no problems.  Only after I have enabled DNSBL, and added several feeds have I had these symptoms:
* The Web GUI becomes unresponsive
* Unbound becomes unresponsive, leading to DNS being unable to resolve for clients
* The console is unresponsive
* DHCPD stops functioning
* Less frequently than the above symptoms, routing stops all together.  Most of the time as long as Unbound is responsive, then everything is fine besides being able to make changes or view anything in the WebGUI or console.


All of these issues are only fixed by hard rebooting the instances.  Because of this, I have had to reinstall and restore via the xml config quite a few times, as I have had issues upgrading due to the instability.

Things I have tried (but none seem to help):
* Increasing the memory of my VMs from 4gb -> 8gb
* Increasing Max Threads of the WebGUI to 12
* Using Service Watchdog on impacted services

The only thing that has improved my stability is disabling DNSBL, and I do not want to do this.  I would love to retain this functionality, but at this point it seems like no matter what I do I end up with the above symptoms.

Any advice would be much appreciated.  I am on the latest 2.4 daily snapshots, and update as frequently as I can.
« Last Edit: April 04, 2017, 09:18:21 pm by TyphooN »

Offline BBcan177

  • Moderator
  • Hero Member
  • *****
  • Posts: 2608
  • Karma: +824/-5
    • View Profile
    • Click for Support
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #988 on: April 04, 2017, 09:31:26 pm »
Do you see any errors in the Resolver.log?

Its best not to use the Service watchdog with DNSBL, since it can try to restart Unbound at in appropriate times... 

Are you using the literal IP address to access to webgui?
"Experience is something you don't get until just after you need it."

 | http://pfblockerng.com | Twitter @BBcan177  | #pfBlockerNG |

Offline TyphooN

  • Newbie
  • *
  • Posts: 13
  • Karma: +3/-0
    • View Profile
Re: pfBlockerNG v2.0 w/DNSBL
« Reply #989 on: April 05, 2017, 09:17:53 am »
Do you see any errors in the Resolver.log?

Its best not to use the Service watchdog with DNSBL, since it can try to restart Unbound at in appropriate times... 

Are you using the literal IP address to access to webgui?

I have been connecting to the WebGUI only via ip address, not hostname.  I have turned off the service watchdog for DNSBL and Unbound.

Here is the entire log for 1 of my VMs,  I am in the process of restoring the other one from XML at the moment, but will give you that one when I have a chance.

https://pastebin.com/059BCEeV


Edit:
Here are some screenshots of everything that occured during syncing the DNSBL feeds of my other VM whilst restoring the XML.  I had to hard reboot the instance a few times for it to complete:

https://imgur.com/a/788UU

Here is the resolver.log:
https://pastebin.com/R9jGU7Xs

I have disabled DNSBL on 1 of my VMs, as I need at least 1 of them to be stable today (working from home).  Will monitor the other one for instability and provide an updated log when I can.  Are there any other logs that you may be interested in?
« Last Edit: April 05, 2017, 12:13:19 pm by TyphooN »