pfBlockerNG-devel v3.1 GeoIP Alias NA Permit Problem
-
Hi all, I'm using pfBlocker with Maxmind GeoIP for a North America source IP permit lists to my Canadian website.
I have a simple Firewall NAT and Rule setup to lockdown the source IP ranges to specifically US and Canada using the North America alias. It works perfectly.
Unfortunately the one IP I expected to be permitted (71.223.X.X) wasn't because it isn't in the US IP range lists. The IP is my CenturyLink IP. I have created a separate rule to allow the IP through to my website for now.
What I don't understand is why my CenturyLink IP is showing up in the pfBlocker Report under Permit with the associated pfB_NAmerica Rule as shown in the images.
I'm new the pfBlocker so maybe I'm not understanding something.
Thanks!
pfB Permit Report
pfB NAmerica IP List
-
@mmb Do you have deduplication enabled? A similar question came up a few weeks ago in this thread and we decided that deduplication would work across Deny lists. IOW it assumes if List1 is Deny and List2 is Deny an IP doesn't need to be in both lists since they both Deny access to everything. (which, wasn't the case in that thread).
Try an Alias Native type which will create the alias and you can use it in your own rules, or turn off dedupe.
-
@steveits I understand but this is a subset of one NAmerica list so there shouldn't be any duplication right?
-
@mmb You don't have any other Alias Deny lists? Then that's not the same issue. Perhaps I misunderstood.
Oh I understand, 71.192.0.0/10 does include your IP:
71.192.0.1 - 71.255.255.254 -
@steveits God, totally misread the table, thanks!
