Ad Blocking using pfSense

Here is a simple way to block ad's for you entire network using pfSense, this is easy as editing the host file on a machine. (You must be using pfsense as your router or configure your router to use the IP of your pfsense server as the DNS server.)

Login to pfSense: Go to "Services", then "DNS Forwarder" and paste the Ad sites you would like to block in the following format under "Advanced":
address=/<url-here>/<ip-here>

So to block smartclip.net for example, enter the following

address=/smartclip.net/127.0.0.1

Note: This entry above will block *.smartclip.net by pointing it back to your local machine. For example that line will block www.smartclip.net, test.smartclip.net, etc. It's like a DNS Wildcard.

Normally the following URL would resolve as follows:

nslookup test.smartclip.net 

Name:    test.smartclip.net
Address: 78.46.98.112

nslookup www.smartclip.net

Name:    www.smartclip.net
Address: 213.203.209.152

By adding the line address=/smartclip.net/127.0.0.1, the nslookup now returns the following:
Name:    test.smartclip.net
Address: 127.0.0.1
Name:    www.smartclip.net
Address: 127.0.0.1

OpenVPN TUN Interface Force Traffic

To force all client traffic over the tunnel in OpenVPN when using TUN not TAP, please add the following to your server config file:

push "redirect-gateway def1"
push "remote-gateway VPN-Server-IP"
push "dhcp-option DNS 4.2.2.2" 


This will also force internet traffic over the vpn.

D-Link DCS-2230 IP Camera Auto Format SD

So I came across a problem with a D-Link IP camera, the MicroSD card would get full and I would have to manually reformat the card because the camera did not support overwriting when set to motion detection.

So I setup a script to run a cURL command to format my SD card on the camera automatically every month. Please see my other posts to find out how to use the curl command.


curl username:password@192.168.1.100/cgi-bin/format.cgi?SD


Keywords: IP Camera, D-Link, DCS, Format, SD Card, curl, remote format, curl format.

Hikvision IP Camera Streaming URL

Here is a list of tested URL's for Hikvision IP Camera streaming and snapshots.

Main RTSP Stream:   
 rtsp://username:password@192.168.1.100:554/cam/realmonitor?channel=1&subtype=0?tcp

 rtsp://username:password@192.168.1.100:554/h264/ch1/sub/?tcp
  
Sub RTSP Stream:
rtsp://username:password@192.168.1.100:554/Streaming/Channels/2?tcp

or

rtsp://username:password@192.168.1.100:554/h264/ch1/sub/?tcp

JPEG Snapshot Main Stream:  
http://192.168.1.100/Streaming/Channels/1/picture

The RTSP stream works in Zoneminder and VLC for Hikvision IP Cameras. I have not tested the snapshot URL in Zoneminder.

Remember to change the username and password as well as IP address to match your setup. ?tcp is not needed, I use it to reduce corrupted frames.

Download Video from Youtube

Here are a couple of ways to download Youtube videos quickly and easily, most importantly it is free.

1) http://keepvid.com/ : This is by far the quickest and easiest.

2) Video DownloadHelper Firefox Plugin : This way is also easy but involves downloading and installing a plug-in in your web browser. Once the plug-in is installed restart Firefox Web Browser then navigate to the Youtube video you want to download, click play, you will then see the 3 coloured ball sphere(Yellow, Blue and Red) icon rotating next to the URL, click on it and choose to download video. This can be used to download videos from many different streaming sites.

 

I made this post as some people still do not know how to download youtube videos, and thought I would show the 2 methods that I prefer to use.

OpenVPN Test On LAN

Here is how to test your OpenVPN on the same network (local network) as your VPN server.

Change the remote line to point to the local private IP of your OpenVPN server, now you can connect to the vpn server while sitting on the same subnet.

For example your remote connection is MYDNS.dyndns.org, change this to point to the actual IP of the device on the network ex 192.168.1.100(If your OpenVPN server is your router, it will be the address of the router 192.168.1.1 or 192.168.0.1, etc.

In the image above I added a second remote line and commented out the first one by using a # sign, when I want to revert back I can just comment out the local remote line and uncomment the dynamic dns one.

PC Engines WRAP.1E2 vs ALIX.6B2

Testing WRAP 1E2 and Alix 6B2, both were running pfSense 2.0.1

This firewall box is setup has a standalone OpenVPN server, running off of 1 NIC(LAN), Encryption is AES-256.

Here are my results for 1 user through the VPN on both box's and some spec's:

Label	WRAP.1E2	ALIX.6B2
CPU Usage:	51.00%	56.00%
Memory Usage:	48.00%	22.00%
Download Speed(Mbps):	3.1	10.65
Upload Speed(Mbps):	0.48	0.51
Ping Time(ms):	20	11
CPU   :	233 MHz AMD Geode SC1100 CPU	500 MHz AMD Geode LX800
DRAM:	128 MB SDRAM	256 MB DDR DRAM
NIC's  :	3	2
USB   :	0	2
Other :	1 Mini PCI	1 Mini PCI + 1 Mini PCI Express + On-board SIM Slot

The point of this post was to show the throughput of the VPN on the hardware and whether or not I needed a Soekris Crypto Card or if the hardware upgrade was enough. This is just a post I made a while back but never submitted for some reason. Since then I have tried running VPN on a Linux server, DD-WRT router, and Mikrotik router. While this is PC Engine is great firewall and VPN server in one, I am trying to minimize the amount of device's I have powered on. I'll be making a post about the Mikrotik wireless router soon, this has firewall, VPN, WiFi and many more features.