Changes between Version 1 and Version 2 of noc2018/agenda/PfsensepfBlockerNG

Timestamp:

Dec 5, 2018, 7:05:13 PM (6 years ago)

Author:

admin

Comment:

--

noc2018/agenda/PfsensepfBlockerNG

@@ -4 +4 @@
 Blocking countries and IP ranges, DNS lists is easy with pfBlocker.
 
+
 To Install go to Package Manager and search and install pfBlocker-NG. This will take some time to install
 
-Once Installed goto Firewall > pfBlockerNG for settings.
+'''Before going further go to ntopng settings and disable it otherwise your pfSense will get stuck due to low memory'''
+
+Once pfBlocker-NG is installed, goto Firewall > pfBlockerNG for settings.
 
 On pfBlockerNG settings, General Page, tick '''Enable''' and Save.
@@ -26 +29 @@
 
 - All devices in the network should resolve DNS from pfsense. You have to block accessing public DNS resolvers by your clients. eg: write a block rule on DNS ports for outgoing traffic from your LAN.
-- Need to maintain updated DNS list of unwanted domains.
+- Need to maintain an updated DNS list of unwanted domains.
 
 To accomplish the second point above we will associate some publicly available community maintained dns block lists based on content category.
@@ -34 +37 @@
 - https://github.com/StevenBlack/hosts
 
+on pfBlockerNG, go to DNSBL tab and tick '''enable DNSBL'''
+
+When blocking is enabled all matched domains will be redirected to a IP address known as '''DNSBL Virtual IP''' and it will reply with a plain pixel. Therefore, you have to configure an IP address that is not used in your LAN segment. For the lab purposes change '''DNSBL Virtual IP''' to 192.168.254.254 as we do not use that IP in our network.
+
+Then Define a List action from '''DNSBL IP Firewall Rule Settings''', ideally, Deny Outbound and click save.
+
+Next, Go to '''DNSBL Feeds'''
+
+Click Add.
+
+- DNS GROUP Name:  PRON_Sites
+- Description: BLock Porn sites
+- DNSBL:
+   - Format: Auto
+   - State: ON
+   - Source: https://raw.githubusercontent.com/chadmayfield/my-pihole-blocklists/master/lists/pi_blocklist_porn_all.list
+   - Header: list1 and click Add
+- on the second line use url: https://raw.githubusercontent.com/chadmayfield/pihole-blocklists/master/lists/pi_blocklist_porn_top1m.list  with Header: List2 and Add
+- List Action: Unbound
+- Update Frequency: Once a day
+- Save
+
+Now go to Update and run it. Wait till you see `UPDATE PROCESS ENDED`
+
+Then go to your GUI vm and do `nslookup 121sexcam.com` which is a blocked domain. You may also try this on web browser as well.
+
+You can also try defining custom feed lists as well.
 
 
+