IP-Blocklist
-
Version 0.1.5 is complete. This update uses pf tables as the blocking method. This brings a huge performance boost but uses more ram. New screen shot added.
Package will be committed soon. Just trying to get a hold of a DEV to commit. I also have some new updates to the package, one update will let you process a level1 list in 2 seconds and apply it immediately!
Thank you jim-p for the idea.
You can download the packages right now while you wait for a DEV to commit them. http://www.tomschaefer.org/temp/pfsense/packages/
-
i installed 0.1.5 and when i try to start it i get this error: ipblocklist.conf:8: cannot define table ipblocklist: Cannot allocate memory
Running 1.2.3.. Lots of add ons, squid, squidguard,snort. i have 1.7g free of memory
-
I am working on an update. I think the big lists are hitting a ceiling. I should have 0.1.6 out here soon, at-least within the week.
-
-
Update 0.1.6 released.
-
Release notes??
-
0.1.6 Release Notes:
Introduction
IP-Blocklist is a global IP blocking package. The package is designed to import IP lists in the format of “Descption:xx.xx.xx.xx-xx.xx.xx.xx” This is the format that PeerGuardian2 uses. Therefore, this package is a PeerGuardian2 solution at the gateway/router level.What’s New
0.1.6 doesn’t overwrite or interfere with your existing firewall rules. 4 lines are inserted into the pf config file that allows pf to block the IPs in your list. pf is resync’d with the pf config file. Building a pf table allows you to block thousands and thousands of IP addresses in a matter of seconds. The manual IP blocking feature still uses IPFWSecurity considerations
This package gives you the power to completely block a range of networks and IPs, be careful not to block DNS servers, internal IPs, and other IPs/Networks that you rely on.Contributed Software
Perl IP to CIDR converter edited for this package. Original code at: http://www.bluetack.co.uk/forums/index.php?showtopic=18081&pid=84901&st=0&#entry84901
IP2CIDR Perl script from Guy Patterson. Website: www.nullamatix.comRequirements
This package installs Perl and the NET CIDR Perl module. Lists can be found at iblocklist.comUpgrading from any version to latest
Please uninstall your previous version before installing the new version. Upgrading without uninstalling will lead to unknown/unwanted effects.To-Do list
Script does not apply blocklist on startup.
Large lists hit a hard limit set by the pf config file. -
Have you been able to get one of the dev to add it to the package manager? My dumba$$ did something to the globals.inc file and now i can't access my box…lol... have to wait till i get home and do a quick rebuild.....
-
I am still trying to get a hold of a dev. I have emailed them and contacted them on the freenode chat room.
I can email you a globals.inc file if you need. PM me.
-
Version 0.1.9 is complete.
Changes:
-
If enabled the block list will apply on start-up.
-
Fixed "out of memory" errors. You can now have a lvl1,2,&3 list applied at the same time. New limit is 900,000 entries
-
Removes duplicate entries to speed up process
This version is considered very stable. I have tested on 1.2.2 and 1.2.3.
-
-
Nice work Tommy!!
Have you had any luck getting hold of the dev's??
Version 0.1.9 is complete.
Changes:
-
If enabled the block list will apply on start-up.
-
Fixed "out of memory" errors. You can now have a lvl1,2,&3 list applied at the same time. New limit is 900,000 entries
-
Removes duplicate entries to speed up process
This version is considered very stable. I have tested on 1.2.2 and 1.2.3.
-
-
When I try just the level1 list, i get this error after a min or 2 of clicking save/update
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 381
The status states it is running but the Enable IP-Blocklist is not checked, even tho i checked it before clicking on save/update
I've tried the level 2 and level 3 list and did not get the same error… Worked like it should I think...
-
Yes. The web server runs out of memory. You can increase the memory limit in the php.ini file
The script still operates as it should and the lists still get applied as they should. The only downside that I can see from this error is that the "Enabled" checkbox seems to not be checked when in fact it is.
I chose not to have the package edit the php.ini memory limit because I didn't want to crash a pfsense install that had limited memory.
You are correct that it does work as it should even with the error.
-
Thanks again!!! Would you happen to know which php.ini file to change and how would I get it to stay after a reboot?
-
Will this automatically update the lists like PeerBlock/PeerGuardian does?
-
Just to be sure where exactly do the tarballs content go? And will the howto instructions break the current pkg system?
-
This package gets updated on start-up and every time you click save.
The tar archive is if you wanted to experiment without the package system. Just change your package system settings back to default after you install. This is only temporay until a DEV is kind enough to commit my package.
-
IP-Blocklist is now available as a package!
-
This package gets updated on start-up and every time you click save.
Are you referring to the package itself or the blocklists? Is there a way to automatically update your blocklists daily or whatever without restarting the firewall?
-
On start-up the blocklists will get updated.
To have the lists updated on a specific schedule you have to create a cron job. The file to run is /usr/local/etc/rc.d/IP-Blocklist.sh