Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [Completed] Checkboxes for block, and reverse DNS from firewall log. [$50]

    Scheduled Pinned Locked Moved Completed Bounties
    26 Posts 5 Posters 28.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Anathematician
      last edited by

      Looks good, I like the last screenshot. I am not particularly partial to the implementation that Smoothwall did. Would it be possible for the window to pop up with the info on that ip from a site like domaintools.com or something along those lines? Or if thats not possible, just the geographic location? I use it mainly to try and block the garbage coming from china..

      As far as adding it to the firewall as a drop, I would prefer permanent so that I could create it and forget it.

      I think both features are very useful, and I hope others will benefit from it if it makes it into the mainline pf. Thanks for your work so far!

      If you want to keep working at it let me know where to send the $ for escrow.

      -Anathematician

      1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        @Anathematician:

        Looks good, I like the last screenshot. I am not particularly partial to the implementation that Smoothwall did. Would it be possible for the window to pop up with the info on that ip from a site like domaintools.com or something along those lines? Or if thats not possible, just the geographic location? I use it mainly to try and block the garbage coming from china..

        Well ideally the firewall should be kept completely self-contained. I could make a version for you that linked to an IP lookup service like domaintools, but I don't think that would be good for the general distribution. I could, however, maybe make it open in a new window with links to other services to gather more information. Not ideal, perhaps, but it would still keep the basic functionality on the firewall.

        As far as adding it to the firewall as a drop, I would prefer permanent so that I could create it and forget it.

        My thought was something along the lines of just having one firewall rule for such blocks, and these IPs would be dropped into an alias. It would keep things much cleaner that way. Thoughts?

        I think both features are very useful, and I hope others will benefit from it if it makes it into the mainline pf. Thanks for your work so far!

        If you want to keep working at it let me know where to send the $ for escrow.

        Let me look and see what it might take to add the firewall rules, I'll get back to you with an answer sometime tomorrow.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          The firewall rule part looks doable, and if I'm feeling plucky I may also add a means to add a pass rule based on the traffic as well (passing along the source IP, destination IP/port, protocol, etc). To me, a way to pass traffic from that view would be a lot more useful than a means for blocking all traffic from that IP.

          The finer details can be worked out shortly.

          I'll PM you about payment details.

          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          1 Reply Last reply Reply Quote 0
          • A
            Anathematic
            last edited by

            Adding the blocks to an alias would be fine, I agree it would make more sense in the long run. With adding them as an alias, will there be the ability to delete on address should it be added in error?

            Opening in a new window, with the ability to link to a site like domain tools would be awesome, or perhaps selecting the reverse dns website as an option from an options menu? I am not certain how that would work, as different sites would want the info parsed differently, or some sort of api. I don't have the experience to make an informed decision so, I believe you will create the best implementation possible.

            Thanks again

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              @Anathematic:

              Adding the blocks to an alias would be fine, I agree it would make more sense in the long run. With adding them as an alias, will there be the ability to delete on address should it be added in error?

              The way I'm thinking is that when it adds to the alias, it will also attempt to add an accompanying rule, though I'm trying to work out the best way to do that. Right now I have it assuming "wan" but I could pull the interface from the rule being used to trigger it.

              Because it's in an alias, you can always go back and edit them. You could change the subnet mask from /32 to /24 to take out a whole class C or whatever you want, or delete them if they were added in error.

              Opening in a new window, with the ability to link to a site like domain tools would be awesome, or perhaps selecting the reverse dns website as an option from an options menu? I am not certain how that would work, as different would want the info parsed differently, or some sort of api. I don't have the experience to make an informed decision so, I believe you will create the best implementation possible.

              I have come up with what I believe to be a good compromise. I'm adding a page for general DNS resolution that will be at Diagnostics > DNS, where you could lookup addresses by hand, or be sent there automatically from the rule. On that page I could have a few links to sites like domaintools. I'd just need suggestions for sites that would be good to have on such a page.

              It's coming along pretty well so far. It's still a work in progress though :)

              diag_dns.png
              diag_dns.png_thumb

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                I have this working, and I'm surprised at how easy this is to use. The blocking and passing works great, and the new DNS page is really handy.

                I used links to DNS Tools on the DNS page when it sees an IP, and you can click for whois or IP info.

                I can post some more screenshots later, but I figured I'd post an update first.

                If it all works out, I may stick it in the dashboard package tomorrow. I'd like for it to live in its own package, but I think it depends too heavily on my filter log changes that go along with the dashboard package…

                I'll check back in later, or maybe tomorrow morning

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  Had a couple minutes I didn't forsee… Here's some screencaps of it in action.

                  Any more ideas/suggestions?

                  1-rules_before.png
                  1-rules_before.png_thumb
                  2-aliases_before.png
                  2-aliases_before.png_thumb
                  3-firewall_log.png
                  3-firewall_log.png_thumb
                  4-dns_view.png
                  4-dns_view.png_thumb
                  5-add_block.png
                  5-add_block.png_thumb
                  6-aliases_after.png
                  6-aliases_after.png_thumb
                  7-rules_after.png
                  7-rules_after.png_thumb
                  8-rule_after_addpass.png
                  8-rule_after_addpass.png_thumb

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • A
                    Anathematician
                    last edited by

                    Looks awesome so far, I like the way you implented the firewall block it looks much better than the checkbox idea.

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      Thanks for the feedback!

                      I hit a couple bugs with adding rules to OPT1 and IPsec lists, once I get past those I'll see about pushing a new Dashboard package with this included sometime this evening. I added a disclaimer to the easy rule confirmation dialog about it being in testing, so hopefully anyone brave enough to be a beta tester will make backups and report issues :)

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • K
                        kapara
                        last edited by

                        What will this do to firewall logs which show IP's which are blocked based on the default rule 79 i think?  If the default rule is blocking something will allowing the blocked rule by clicking on the button allow that rule?

                        Skype ID:  Marinhd

                        1 Reply Last reply Reply Quote 0
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          @kapara:

                          What will this do to firewall logs which show IP's which are blocked based on the default rule 79 i think?  If the default rule is blocking something will allowing the blocked rule by clicking on the button allow that rule?

                          The rule detection doesn't change at all in this. Your problem was something else entirely.. but I seem to have lost that thread. Post an update there and I'll have another look.

                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • jimpJ
                            jimp Rebel Alliance Developer Netgate
                            last edited by

                            @Anathematician:

                            Looks awesome so far, I like the way you implented the firewall block it looks much better than the checkbox idea.

                            Ok, this seems to be ready for testing. I put it up in the Dashboard package, version 0.8.0.

                            Install that, or update to it, and you should have the Easy Rule code!

                            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                            Need help fast? Netgate Global Support!

                            Do not Chat/PM for help!

                            1 Reply Last reply Reply Quote 0
                            • K
                              kapara
                              last edited by

                              Do you really want to add this rule -> Do you really want to add this DENY rule? or if allowing Do you really want to add this ALLOW rule?  I don't know if that would be very complicated but I can just see someone clicking and not paying attention…just a suggestion.

                              I will definitely test this as I see it as possibly being very useful.

                              Skype ID:  Marinhd

                              1 Reply Last reply Reply Quote 0
                              • jimpJ
                                jimp Rebel Alliance Developer Netgate
                                last edited by

                                @kapara:

                                Do you really want to add this rule -> Do you really want to add this DENY rule? or if allowing Do you really want to add this ALLOW rule?  I don't know if that would be very complicated but I can just see someone clicking and not paying attention…just a suggestion.

                                I will definitely test this as I see it as possibly being very useful.

                                I had something a little more wordy in there but replaced it with that disclaimer during testing :)

                                I'll put the Block/Allow text back in.

                                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                Need help fast? Netgate Global Support!

                                Do not Chat/PM for help!

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  Also if you have this update, be sure to check out Diagnostics > DNS.

                                  :)

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    Anathematician
                                    last edited by

                                    Looks awesome, works great if I run across any bugs I'll let you know. Thanks for getting it completed so quick. The community here is awesome and I hope everyone benefits from it.

                                    Thanks again,

                                    Anathematician

                                    1 Reply Last reply Reply Quote 0
                                    • jimpJ
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by

                                      @Anathematician:

                                      Looks awesome, works great if I run across any bugs I'll let you know. Thanks for getting it completed so quick. The community here is awesome and I hope everyone benefits from it.

                                      You're quite welcome, I'm glad I was able to be of service!

                                      Everyone who has seen it has thought it was neat, I've only heard constructive criticism so far, too. Hopefully there won't be any major bugs to fix once people really start using it. :)

                                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kapara
                                        last edited by

                                        Just tried it on something which showed as allowed.

                                        pass  Jun 4 04:38:19 WAN :4.142.100.44 :9.12.246.209 ICMP

                                        Status : EasyRule

                                        Message: Tried to block invalid IP:

                                        I assume this is by design….

                                        Skype ID:  Marinhd

                                        1 Reply Last reply Reply Quote 0
                                        • jimpJ
                                          jimp Rebel Alliance Developer Netgate
                                          last edited by

                                          @kapara:

                                          Just tried it on something which showed as allowed.

                                          pass  Jun 4 04:38:19 WAN :4.142.100.44 :9.12.246.209 ICMP

                                          Status : EasyRule

                                          Message: Tried to block invalid IP:

                                          I assume this is by design….

                                          Actually that's probably a bug… seems it thought that IP was a port and not an IP... Looks like I've still got work to do.

                                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                          Need help fast? Netgate Global Support!

                                          Do not Chat/PM for help!

                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            kapara
                                            last edited by

                                            Have to admit…pretty cool so far....  ;D

                                            Skype ID:  Marinhd

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.