Ah yes thats a reverse address ofcourse duh why didn't i see that ;)

I did a grep ":127" /var/db/pfblockerng/original/*

result several ipv6 addresses:

/var/db/pfblockerng/original/pfB_Europe_v6.orig:2001:67c:127c::/48
/var/db/pfblockerng/original/pfB_Europe_v6.orig:2001:67c:1278::/48
/var/db/pfblockerng/original/pfB_Europe_v6.orig:2001:67c:1274::/48
/var/db/pfblockerng/original/pfB_Europe_v6.orig:2a00:1278::/32
/var/db/pfblockerng/original/pfB_Europe_v6.orig:2001:67c:1270::/48
/var/db/pfblockerng/original/pfB_NAmerica_v6.orig:2001:1270::/32
/var/db/pfblockerng/original/pfB_NAmerica_v6.orig:2001:1278::/32
/var/db/pfblockerng/original/pfB_SAmerica_v6.orig:2804:1270::/32
/var/db/pfblockerng/original/pfB_SAmerica_v6.orig:2804:1274::/32
/var/db/pfblockerng/original/pfB_SAmerica_v6.orig:2804:1278::/32
/var/db/pfblockerng/original/pfB_SAmerica_v6.orig:2804:127c::/32
/var/db/pfblockerng/original/pfB_Top_v6.orig:2001:67c:1270::/48
/var/db/pfblockerng/original/pfB_Top_v6.orig:2001:67c:1274::/48
/var/db/pfblockerng/original/pfB_Top_v6.orig:2a00:1278::/32
/var/db/pfblockerng/original/pfB_Top_v6.orig:2804:1270::/32
/var/db/pfblockerng/original/pfB_Top_v6.orig:2804:1274::/32
/var/db/pfblockerng/original/pfB_Top_v6.orig:2804:1278::/32
/var/db/pfblockerng/original/pfB_Top_v6.orig:2804:127c::/32
/var/db/pfblockerng/original/pfB_Top_v6.orig:2001:67c:1278::/48
/var/db/pfblockerng/original/pfB_Top_v6.orig:2001:1270::/32
/var/db/pfblockerng/original/pfB_Top_v6.orig:2001:1278::/32

Don't think they are the problem.

I have many more lists besides this "http://list.iblocklist.com/?list=bt_ads&fileformat=p2p&archiveformat=gz" I deleted them all the way you explained and run a force-update and a force-reload and disabled the suppression option but still filling up my system log with "kernel: pfr_update_stats: assertion failed".

In regards to what your explaining, there should be no difference in how the package is working in pfSense 2.2.6 or 2.3.

If you wanted to start fresh with the package… goto the pfBlockerNG: General Tab, and unclick "Enable pfBlockerNG" and "Keep Settings"… then hit "Save"…  This will remove the database and files but leave the configuration intact... Re-click both checkboxes and "Save"…. Follow that with a "Force Update". You can then review the pfblockerng.log in the Update Tab window.

Depending on how you defined the pfBlockerNG Cron task, its typically defined to run "Every hour". You can goto the "Update Tab" tab, and click the "View" button before the Cron task is scheduled to run, and you will see in Realtime what is occurring…

If there are specifics, copy/paste those into this thread, or send me a PM and I can help guide you further...

@BBcan177:

BTW… I'm the dev of the package and the last time I looked... I do this all for FREE and on my own time... What have you done...

And from those of us who do listen… whom you have helped...  Thank you SO MUCH!
I won't say its perfect (and I don't think you would either), but with a little tweaking here and there, random updates to block or allow lists, it works damn well.  I'm amazed at the numbers that build in the dash widget.

Similar thanks go out to Bill for Snort too!

Rick

@BBcan177:

Before you run "Force Update", delete the two files:

/var/db/pfblockerng/permit/pfB_google_ipv4    (Change permit and filename as required)
/var/db/pfblockerng/permit/pfB_google_ipv6

The error persisted. But I found where the bug is.

My list Header/Label was "Google IPv4" (with space). When I force update, it generates the "/var/db/pfblockerng/permit/Google IPv4.txt" file and I get the message:

... ===[  IPv4 Process  ]================================================= [ Google IPv4 ] Downloading update  .. completed ..   Empty file, Adding '1.1.1.1' to avoid download failure. ...

I changed the Header/Label to "Google_IPv4" (space -> underscore) and now it is working as expected.

Can you PM me the contents of those two files (If there still is an error)… I can't do much without seeing the file contents when there is an error message...

In this case I wasn't concerned about the sigma list because I thought you meant by being unreliable it generated false positives, not corruption. We proved it wasn't the IPs in the list that were the problem, so I dismissed sigmalist as the problem. I didn't expect corruption to join the party. I guess it's good you discovered it because this could potentially happen with any other list, not just sigma.

That was very good sleuthing! When I extracted the file on windows the smallest network in the list was a /10.

Can I add a bug/feature report somewhere to add corruption checking on compressed lists?

The country file is in the alias native so I can customize the order. see image i sent you. I''m assuming this is okay.

EDIT: What about the sigma block showing up as a goodCountries alias in the log? Is this resolved because of the corruption or is this caused because of the way I'm using aliases? (or is there a 3rd option?)

EDIT2: I couldn't stand that /3 got by me so I re-added them to pfSense and you're right. (should I be surprised I got a different result on windows?) . Wish I sorted by network size to begin with!

EDIT3: Dug in some more to see whats up with the Alerts tab. I'm not sure how this works but based on how slow the page loads, I'm guessing that the block list information isn't stored in a logfile but instead the blocked IP is matched to a list dynamically so depending on how that works, I'm guessing a corrupt list could cause the log to malfunction. It seems to be working fine as of now. I looked through a few pages and looks like I would expect.
https://s3.amazonaws.com/uploads.hipchat.com/9809/24877/2tOJuorc3rqUbcv/upload.png

I'm sorry to make you not happy. I'm here just want a fix, not a workaround:

Is 192.168.1.100 a part of LAN net?  YES Is my firewall rule defined wrong:  Allowing OPT access all interfaces except LAN?  NO Should 192.168.1.100 be blocked by the rule:  YES, BUT its not blocking anymore.

Again, I'm sorry made you feel so angry.  but thats the issue I'm having.  The rule was working perfectly until I installed your package, so of course, I need to ask you about this first,  if you think its not your package issue, then I will ask pfSense teams.

Nothing strange there. Would you mind posting a screenshot of the pfBlockerNG dashboard widget.

Edit: I forgot that you posted the widget before. I don't see any issues with what your posting. Have you tried a reboot or a filter reload?  You are also on pfSense  v2.04, maybe update to 2.2.6?

Go to pfBlockerNG \ DNSBL then scroll down to the very bottom and add www.googleadservices.com then save, switch to the Update tab and force a reload.

When you install the package, it downloads the latest MaxMind GeoIP files. Those are updated the first Tuesday of each month. You will need to download those files as required. In the General tab, click the checkbox to disable the cron download of the MaxMind files.

MaxMind files are saved in:  /usr/pbi/pfblockerng-amd64/share/GeoIP    (amd64 or i386) (You will need to extract these files into that folder)

http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
http://geolite.maxmind.com/download/geoip/database/GeoIPv6.dat.gz

http://geolite.maxmind.com/download/geoip/database/GeoIPv6.csv.gz
http://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip

Followed by executing these two commands to convert the MaxMind files for pfBNG:
php /usr/local/www/pfblockerng/pfblockerng.php gc
php /usr/local/www/pfblockerng/pfblockerng.php uc

In the IPv4/v6/DNSBL Feeds tabs, you can enter a local address in the "Source Fields".

Hope that gets you started!

Hi pf3000,
Thanks for the reply. So this is what i tried nothing makes sense anymore  :-\

Tried OpenDNS and it was working blocking the typical facebook then i went to navigate whatsapp.com also gets blocked but I connect my iphone immediately it connects to whatsapp. So failed miserably

Then tried DNSBL when I did the Enable Domain/AS check it and added the list from the site you sent me and nothing :( but whats odd it shows that it gets blocked on the logs of the firewall I have no clue what is whatsapp servers doing.

EDIT: BAM just blocked it it was using some IPs from amazon finally…. the whatsapp.txt has been updated I will keep it updated. I wonder how long until they update it :(

http://www.mediafire.com/view/xnnzh0d00kbffpu/whatsapp.txt

ok. thanks for the confirmation, although I think that default behaviour (e.g. auto-creating of "wide-open"-NAT-roules) should be changed.

@repa:

I think, we can't get this working with pfBlockerNG, right ?

Yes

What browser are you using? Are you on a multi-subnet network? Ensure that you can ping and browse to the DNSBL VIP address.

pfBNG 2.0.4 on 2.2.6. See extra.log

Hmmm, when on .ro. (read-only) access to the filesystem seems a failure and when on .rw. it looks OK, but then dnsbl.log is reporting writing problems ? Besides in both cases I see double entries about download reports.

So what is in general the supposed state (ro or rw) for using pfBNG ?

extras.txt

Including some pfBlockerNG config screenshots


Yes, you can ignore those warning during a re-installation.

During a re-install, all of the pfBlockerNG Aliases are removed and re-added at the end of the pkg installation. Since you manually added pfBlockerNG (alias) Firewall rules, there is a small window of time, where the pfBlockerNG alias does not exist, and you will get those warnings.  I don't have a workaround for that unfortunately.

I was using premium for some time and in my experience it does not worth because free list from same provider blocks more than enough. Premium lists had maybe 4% blocked packages compering free ones.

If you thing 4% is worth, well :)

Cheers.

Those are other issues are not related to your issue… How large is your pfSense Firewall log? Looks like that entry value is too large?

Status: System Logs: Settings: GUI Log Entries to Display?

@doktornotor:

There's a setting to limit the number of lines in the log file on the General tab…

Ah thanks, I overlooked the variable. That 20000 will be about 5MB and 10% /var increase and then no problem for me. I'll check if/how it pans out.

lol Confirmed, and thanks for the Heads up on the path change :)

@BBcan177:

@The:

What to do ?
Create some floating rules (as i read in the Wiki)
create some alias as you replied ?

In v1.10 I added some additional text to the TOP20 tab to help with this issue. (See Note:)

Instead of blocking the world, you can change all of the "Deny" rule(s) to be a single "Permit Inbound" Rule…

For example: It seems like you want to allow South America only to hit your Zimbra mail server, follow the instructions below:    (  BTW: Big fan of Zimbra!!  )

Remove all of your existing Country Blocking Rules.

Remove all of your existing "Pass" Firewall rules for Zimbra.
You could also just disable these pass rules and keep them there as a backup, if pfBNG is disabled for any reason.

Goto "South America" Country Tab.

Select the IPv4/6 Countries that you want to allow access.

List Action: "Permit Inbound"

In "Advanced Inbound Firewall Rule Settings":

Enable the Custom Port checkbox

Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_Ports" (Change the alias name to what ever you wish), and enter all of the Mail ports in the alias.

Enable Custom Destination checkbox

Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_IPs"
(Change the alias name to what ever you wish), and enter all of the Mail Destination IPs (ie: the 192.x.x.x address from your screenshot above)

Custom Protocol: Select "TCP/UDP" (Or as required)

Hope that helps!

This seems to be the pertinent post concerning setting up protection on my two open ports, but I am still not clear.  I was able to get the script to work, and it created 7 alias entries (IBlock, PRI1, PRI2, PRI3, SEC1, TOR, and MAIL).  In contrast to the above scenario where the firewall is already blocking unsolicited traffic to all ports, since my single port is open (via NAT under port forwarding) by default, would I set up the Advanced Inbound Firewall Rule to block everything except the US to that one port?  It seems that if I do the Permit Inbound as above, then I am already allowing traffic to the port in question, so I would need to deny all traffic except the US instead.

Also, however I set it up, do I need to go in and do the same thing for each of the 7 alias/list entries created by the script?

I'm going to assume that the port used by OpenVPN is inherently secure, since it is not treated as a regular open port.

I apologize for my ignorance.  This is all very new to me, but I moved to pfsense after a fairly devastating hack into my server, and I want everything to be as secure as possible.

pfBNG should only have load when it's cron process is executed, the Alerts Tab is viewed, or from the MaxMind GeoIP monthly update.

Try running the "top" command and the "ps -aux or -wax" command to see some further details.

Nah, nothing that I'd know of…. pfctl -d disabled, pfctl -e re-enables. This would be done automagically anyway after a while.

https://doc.pfsense.org/index.php/Locked_out_of_the_WebGUI#Remotely_Circumvent_Firewall_Lockout_by_Temporarily_Changing_the_Firewall_Rules

Well, I'm not sure what happened, I added a 3rd host to see if I could get that one to work and immediately after doing that, all 3 hosts sync'd successfully.

hey vito for ELK server logs disable first all log capture by default and let pfblockerNG do all the log reporting. Then on Kibana (ELK) you will see the rule it will be filtering for ex: rule 85 is blocking all top IPv4 list while rule 92 is blocking youtube. see pictures
hope this helps im working now on filtering the syslog (system logs for pfsense) but seems hopeless  :-[