Under attack, anything I should do?

[johnpoz]

@dennypage said in Under attack, anything I should do?:

Information available here.

And where in pfblocker would I put this token? I am not seeing it in any of the pfblocker settings, I have my maxmind token setup..

But if reading that right, that really has little to do with pulling the info from an ASN for your table of IPs.. But more of to do with pulling this info in real time for asn reporting?

Am I not understanding this correctly? When using ASN in an alias, why should you need to pull this info more than say every 24 hours, they sure are not updating this info on the hour every hour, etc.. Says right in that thread that they only update every 24 hours anyway. And to be honest there normally is not a lot of changes to IPs listed in an ASN...

Per that thread there is also info to 10 downloads a day.. I don't see how that would be an issue.. That is a lot of downloads of the db per day for how they should it should be used.

[Bob.Dig]

@johnpoz The real info is here.

[JKnott]

@AndyRH said in Under attack, anything I should do?:

Hotels likely do not block 1194 which is OpenVPN and frequently used by business travelers.

While I haven't had a problem using OpenVPN from a hotel, once I moved my local subnet away from what hotel's often use, I know some places such as my local community centre & library block it. If I come across a place that blocks my VPN, I just connect by tetherning to my cell phone.

[johnpoz]

@Bob-Dig thanks... So yeah something is not right.. I just added a test alias with cisco asn AS109, and get nothing, just the placehold added to the file..

But from a look of the prefixes listed https://bgpview.io/asn/109#prefixes-v4

There should be plenty of prefixes in the table.

Where would you put in this token you can get, I got my token.. And just from the gui I can download a db.. And in that db I find prefixes for that AS109 I used for my test..

So why can this not be done in pfblocker?

[Bob.Dig]

@johnpoz @BBcan177 said in pfblockerNG ASN bgpview trouble:

The current code in pfB contains a User Agent Header which is being blocked en masse by them.

But I don't know anything about a token. Just using the patch again, which alters the User Agent Header worked for me.

[BBcan177]

I have a PR pending approval to switch to IPInfo for ASN data.

But in the short term, you could change the agent string to something else to avoid BGPview blocking you. They don't want to support open source and I can't even get them to update their API usage policy.

pfBlockerNG code
FILE: /usr/local/pkg/pfblockerng.sh

LINE 761

[jrey]

@Bob-Dig

Patience - the fix is coming as mentioned in the thread you referenced. (and now here) It is looking really good at this point and good riddance to bpgview.

watch the -devel branch for the update. No ETA, but soon-ish as @BBcan177 mentions above the PR is pending.

PS: you won't need the patch, and it won't apply so after the update releases at which time you can delete it.

[johnpoz]

@Bob-Dig said in Under attack, anything I should do?:

Just using the patch again

what patch is this? I don't see anything related in the patches? From what @BBcan177 mentioned, sounds like would just manually edit that file. Is there some patch to auto do that?

edit
Oh your talking about the patch shown in this thread

https://www.reddit.com/r/pfBlockerNG/comments/1ey2sza/update_on_asn_issues_with_bgpviewio/

edit2:
well I tried editing the ua string, and still not loading that as109 I setup as test.

[jrey]

@johnpoz

I had provided the fix as a "patch" file well over a year ago - the last time bgpview did this actually.
Original version of the patch I created should be on this forum somewhere - I never provided it to reddit

• it changed a couple of other things as well.
  Like not providing your device's NDI to bgp (they don't need it, and I viewed it as an issue) especially in light of the fact that Netgate gives you the option to not even send it to them in the URL and they have made such a "fuss" about NDI and registration being a problem why send it where it is not required.

I'm no longer providing the patch directly with various reasons mentioned in the other thread. and now with new version that doesn't need it

if your downloads are not working.
a) Just wait for the release,
b) find the patch,
c) or change the line as referenced.

I recommend a) for good reason at this point

[jrey]

@johnpoz said in Under attack, anything I should do?:

well I tried editing the ua string, and still not loading that as109 I setup as test.

let me try this for you - standby

[johnpoz]

@jrey said in Under attack, anything I should do?:

c) or change the line as referenced.

I did change the line.. does it need a specific format or something?

ua="pfSense/pfBlockerNG cURL download agent-"

to

ua="different-"

And that doesn't seem to be working.. My current aliases that have table entries, they might be a bit out of date it seems.. I can for sure just wait til the new version comes out, etc. and already have my ipinfo token ;)

But now just curious to get it working if all you would have to do is change the ua..

[Bob.Dig]

@jrey said in Under attack, anything I should do?:

let me try this for you - standby

Also interested in a how-to.

[jrey]

@johnpoz said in Under attack, anything I should do?:

pfSense/pfBlockerNG

this is what they are currently blocking on.. change that

the curl that actually pulls it looks like this: (I log it in the pfblockerng.log (cause I like logging)

/usr/local/bin/curl -A "pfSense/pfBNG cURL download agent-60835222024" -sS1 https://api.bgpview.io/asn/109/prefixes

it send the output to a tmp file as part of what gets called.
Works fine here

{"status":"ok","status_message":"Query was successful","data":{"ipv4_prefixes":[{"prefix":"12.5.186.0\/23","ip":"12.5.186.0","cidr":23,"roa_status":"None","name":"CISCO-SY729-186","description":"CISCO SYSTEMS","country_code":"US","parent":{"prefix":"12.

[BBcan177]

@johnpoz delete the ASN file. So if the asn is a block it's in the "deny" folder. You can do that in the Log tab to delete the file. Once that file is deleted run a Force update to get the new update

[johnpoz]

@jrey said in Under attack, anything I should do?:

this is what they are currently blocking on.. change that

I did, I changed the whole ua variable to be "different-"

@BBcan177 should a force reload do that.. not using any asn in any pfblocker rules - just an native alias and doesn't seem to want to pull any info for the AS109 test alias I created.

But I do see a AS109 file, let me try deleting that file. And then running a forced update.

edit: ok I deleted the AS109_v4.tx file in /var/db/pfblockerng/native

But still show this error
[ AS109_v4 ] Reload . completed ..
Empty file, Adding '127.1.7.7' to avoid download failure.

[BBcan177]

@johnpoz no a Force Reload uses the existing downloaded files and makes any changes that you might have made with the settings. New downloads only occur if the downloaded file is missing (which is why I said to delete it) or at the Cron Frequency setting that you set.

[johnpoz]

@BBcan177 yeah I deleted it, says empty file in the output, but no info added other than the place holder.

[jrey]

@johnpoz

you could also just take the exact call I provided and ssh in the device, paste it and watch the terminal window fill with json return, (or perhaps you might see some other error ?)

prompt: /usr/local/bin/curl -A "pfSense/pfBNG cURL download agent-60835222024" -sS1 https://api.bgpview.io/asn/109/prefixes

{"status":"ok","status_message":"Query was successful","data":{"ipv4_prefixes":[{"prefix":"12.5.186.0\/23","ip":"12.5.186.0","cidr":23,"roa_status":"None","name":"CISCO-SY729-186","description":"CISCO SYSTEMS","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"12.19.88.0\/21","ip":"12.19.88.0","cidr":21,"roa_status":"None","name":"CISCO-SY558-88","description":"CISCO SYSTEMS INC","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_stat

[dennypage]

@johnpoz said in Under attack, anything I should do?:

And where in pfblocker would I put this token? I am not seeing it in any of the pfblocker settings, I have my maxmind token setup.

The link was to see info from @BBcan177 discussing the issue with BGPview.io, and the potential solutions being explored.

Using IPinfo, which requires registration and a token like Maxmind does, is one of the solutions he is exploring. He is working on an experimental implementation of IPinfo, which would potentially be used in a future version of pfBlocker. As the work is experimental and unreleased, you won't find a place to enter the token yet.

[Edit: This is what I get for reading/responding to posts in order. Sorry @BBcan177, I hadn't noticed that you had stepped in and posted.]

[johnpoz]

Yeah that seems to work fine

[24.03-RELEASE][admin@sg4860.home.arpa]/: /usr/local/bin/curl -A "pfSense/pfBNG cURL download agent-60835222024" -sS1 https://api.bgpview.io/asn/109/prefixes
{"status":"ok","status_message":"Query was successful","data":{"ipv4_prefixes":[{"prefix":"12.5.186.0\/23","ip":"12.5.186.0","cidr":23,"roa_status":"None","name":"CISCO-SY729-186","description":"CISCO SYSTEMS","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"12.19.88.0\/21","ip":"12.19.88.0","cidr":21,"roa_status":"None","name":"CISCO-SY558-88","description":"CISCO SYSTEMS INC","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"12.159.148.0\/22","ip":"12.159.148.0","cidr":22,"roa_status":"Valid","name":"NET12","description":"American Registry for Internet Numbers","country_code":"US","parent":{"prefix":"12.0.0.0\/8","ip":"12.0.0.0","cidr":8,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.100.0.0\/16","ip":"64.100.0.0","cidr":16,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.0.0\/18","ip":"64.101.0.0","cidr":18,"roa_status":"Valid","name":"CISCO-GEN-6","description":"CISCO SYSTEMS, INC.","country_code":"US","parent":{"prefix":"62.50.64.0\/19","ip":"62.50.64.0","cidr":19,"rir_name":"RIPE","allocation_status":"unknown"}},{"prefix":"64.101.64.0\/18","ip":"64.101.64.0","cidr":18,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.96.0\/19","ip":"64.101.96.0","cidr":19,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.128.0\/18","ip":"64.101.128.0","cidr":18,"roa_status":"Valid","name":"CISCO-GEN-6","description":"CISCO SYSTEMS, INC.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.192.0\/19","ip":"64.101.192.0","cidr":19,"roa_status":"Valid","name":"CISCO-GEN-6","description":"CISCO SYSTEMS, INC.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"unknown"}},{"prefix":"64.101.224.0\/19","ip":"64.101.224.0","cidr":19,"roa_status":"Valid","name":"CISCO-GEN-6","description":"Cisco Systems, Inc.","country_code":"US","parent":{"prefix":"64.100.0.0\/14","ip":"64.100.0.0","cidr":14,"rir_name":"ARIN","allocation_status":"un

but doesn't seem to be updating the table in pfblocker and says the download fails, and I did change the line 761 to be a different ua