• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

pfBlockerNG-devel v3.1 GeoIP Alias NA Permit Problem

pfBlockerNG
2
5
788
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    mmb
    last edited by Apr 1, 2022, 8:06 PM

    Hi all, I'm using pfBlocker with Maxmind GeoIP for a North America source IP permit lists to my Canadian website.

    I have a simple Firewall NAT and Rule setup to lockdown the source IP ranges to specifically US and Canada using the North America alias. It works perfectly.

    Unfortunately the one IP I expected to be permitted (71.223.X.X) wasn't because it isn't in the US IP range lists. The IP is my CenturyLink IP. I have created a separate rule to allow the IP through to my website for now.

    What I don't understand is why my CenturyLink IP is showing up in the pfBlocker Report under Permit with the associated pfB_NAmerica Rule as shown in the images.

    I'm new the pfBlocker so maybe I'm not understanding something.

    Thanks!

    pfB Permit Report
    login-to-view

    pfB NAmerica IP List
    login-to-view

    S 1 Reply Last reply Apr 1, 2022, 9:11 PM Reply Quote 0
    • S
      SteveITS Galactic Empire @mmb
      last edited by Apr 1, 2022, 9:11 PM

      @mmb Do you have deduplication enabled? A similar question came up a few weeks ago in this thread and we decided that deduplication would work across Deny lists. IOW it assumes if List1 is Deny and List2 is Deny an IP doesn't need to be in both lists since they both Deny access to everything. (which, wasn't the case in that thread).

      Try an Alias Native type which will create the alias and you can use it in your own rules, or turn off dedupe.

      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
      Upvote 👍 helpful posts!

      M 1 Reply Last reply Apr 1, 2022, 9:37 PM Reply Quote 0
      • M
        mmb @SteveITS
        last edited by Apr 1, 2022, 9:37 PM

        @steveits I understand but this is a subset of one NAmerica list so there shouldn't be any duplication right?

        S 1 Reply Last reply Apr 1, 2022, 9:49 PM Reply Quote 0
        • S
          SteveITS Galactic Empire @mmb
          last edited by Apr 1, 2022, 9:49 PM

          @mmb You don't have any other Alias Deny lists? Then that's not the same issue. Perhaps I misunderstood.

          Oh I understand, 71.192.0.0/10 does include your IP:
          71.192.0.1 - 71.255.255.254

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote 👍 helpful posts!

          M 1 Reply Last reply Apr 1, 2022, 9:53 PM Reply Quote 0
          • M
            mmb @SteveITS
            last edited by Apr 1, 2022, 9:53 PM

            @steveits God, totally misread the table, thanks! 👍

            1 Reply Last reply Reply Quote 0
            2 out of 5
            • First post
              2/5
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.