Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IP-Blocklist

    Scheduled Pinned Locked Moved pfSense Packages
    496 Posts 86 Posters 505.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tommyboy180
      last edited by

      Update 0.1.6 released.

      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • S
        Supermule Banned
        last edited by

        Release notes??

        1 Reply Last reply Reply Quote 0
        • T
          tommyboy180
          last edited by

          0.1.6 Release Notes:
          Introduction
          IP-Blocklist is a global IP blocking package. The package is designed to import IP lists in the format of “Descption:xx.xx.xx.xx-xx.xx.xx.xx” This is the format that PeerGuardian2 uses. Therefore, this package is a PeerGuardian2 solution at the gateway/router level.

          What’s New
          0.1.6 doesn’t overwrite or interfere with your existing firewall rules. 4 lines are inserted into the pf config file that allows pf to block the IPs in your list. pf is resync’d  with the pf config file. Building a pf table allows you to block thousands and thousands of IP addresses in a matter of seconds. The manual IP blocking feature still uses IPFW

          Security considerations
          This package gives you the power to completely block a range of networks and IPs, be careful not to block DNS servers, internal IPs, and other IPs/Networks that you rely on.

          Contributed Software
          Perl IP to CIDR converter edited for this package. Original code at: http://www.bluetack.co.uk/forums/index.php?showtopic=18081&pid=84901&st=0&#entry84901
          IP2CIDR Perl script from Guy Patterson. Website: www.nullamatix.com

          Requirements
          This package installs Perl and the NET CIDR Perl module. Lists can be found at iblocklist.com

          Upgrading from any version to latest
          Please uninstall your previous version before installing the new version. Upgrading without uninstalling will lead to unknown/unwanted effects.

          To-Do list
          Script does not apply blocklist on startup.
          Large lists hit a hard limit set by the pf config file.

          -Tom Schaefer
          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

          Please support pfBlocker | File Browser | Strikeback

          1 Reply Last reply Reply Quote 0
          • C
            Cino
            last edited by

            Have you been able to get one of the dev to add it to the package manager? My dumba$$ did something to the globals.inc file and now i can't access my box…lol... have to wait till i get home and do a quick rebuild.....

            1 Reply Last reply Reply Quote 0
            • T
              tommyboy180
              last edited by

              I am still trying to get a hold of a dev. I have emailed them and contacted them on the freenode chat room.

              I can email you a globals.inc file if you need. PM me.

              -Tom Schaefer
              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

              Please support pfBlocker | File Browser | Strikeback

              1 Reply Last reply Reply Quote 0
              • T
                tommyboy180
                last edited by

                Version 0.1.9 is complete.

                Changes:

                • If enabled the block list will apply on start-up.

                • Fixed "out of memory" errors. You can now have a lvl1,2,&3 list applied at the same time. New limit is 900,000 entries

                • Removes duplicate entries to speed up process

                This version is considered very stable. I have tested on 1.2.2 and 1.2.3.

                -Tom Schaefer
                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                Please support pfBlocker | File Browser | Strikeback

                1 Reply Last reply Reply Quote 0
                • S
                  Supermule Banned
                  last edited by

                  Nice work Tommy!!

                  Have you had any luck getting hold of the dev's??

                  @tommyboy180:

                  Version 0.1.9 is complete.

                  Changes:

                  • If enabled the block list will apply on start-up.

                  • Fixed "out of memory" errors. You can now have a lvl1,2,&3 list applied at the same time. New limit is 900,000 entries

                  • Removes duplicate entries to speed up process

                  This version is considered very stable. I have tested on 1.2.2 and 1.2.3.

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cino
                    last edited by

                    When I try just the level1 list, i get this error after a min or 2 of clicking save/update

                    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 381

                    The status states it is running but the Enable IP-Blocklist is not checked, even tho i checked it before clicking on save/update

                    I've tried the level 2 and level 3 list and did not get the same error… Worked like it should I think...

                    1 Reply Last reply Reply Quote 0
                    • T
                      tommyboy180
                      last edited by

                      Yes. The web server runs out of memory. You can increase the memory limit in the php.ini file

                      The script still operates as it should and the lists still get applied as they should. The only downside that I can see from this error is that the "Enabled" checkbox seems to not be checked when in fact it is.

                      I chose not to have the package edit the php.ini memory limit because I didn't want to crash a pfsense install that had limited memory.

                      You are correct that it does work as it should even with the error.

                      -Tom Schaefer
                      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                      Please support pfBlocker | File Browser | Strikeback

                      1 Reply Last reply Reply Quote 0
                      • C
                        Cino
                        last edited by

                        Thanks again!!! Would you happen to know which php.ini file to change and how would I get it to stay after a reboot?

                        1 Reply Last reply Reply Quote 0
                        • P
                          peterclark4
                          last edited by

                          Will this automatically update the lists like PeerBlock/PeerGuardian does?

                          1 Reply Last reply Reply Quote 0
                          • G
                            g4m3c4ck
                            last edited by

                            Just to be sure where exactly do the tarballs content go? And will the howto instructions break the current pkg system?

                            1 Reply Last reply Reply Quote 0
                            • T
                              tommyboy180
                              last edited by

                              This package gets updated on start-up and every time you click save.

                              The tar archive is if you wanted to experiment without the package system. Just change your package system settings back to default after you install. This is only temporay until a DEV is kind enough to commit my package.

                              -Tom Schaefer
                              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                              Please support pfBlocker | File Browser | Strikeback

                              1 Reply Last reply Reply Quote 0
                              • T
                                tommyboy180
                                last edited by

                                IP-Blocklist is now available as a package!

                                -Tom Schaefer
                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                Please support pfBlocker | File Browser | Strikeback

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Sambo
                                  last edited by

                                  @tommyboy180:

                                  This package gets updated on start-up and every time you click save.

                                  Are you referring to the package itself or the blocklists?  Is there a way to automatically update your blocklists daily or whatever without restarting the firewall?

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tommyboy180
                                    last edited by

                                    On start-up the blocklists will get updated.

                                    To have the lists updated on a specific schedule you have to create a cron job. The file to run is /usr/local/etc/rc.d/IP-Blocklist.sh

                                    -Tom Schaefer
                                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                    Please support pfBlocker | File Browser | Strikeback

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Sambo
                                      last edited by

                                      @tommyboy180:

                                      On start-up the blocklists will get updated.

                                      To have the lists updated on a specific schedule you have to create a cron job. The file to run is /usr/local/etc/rc.d/IP-Blocklist.sh

                                      Sweet, thanks.  That would be a feature request from me then; GUI based scheduled blocklist updates :)

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        ari
                                        last edited by

                                        I would be interested in being able to tie this into Fail2Ban. Do to do we'd need a simple API to add items to the list. For example a RESTful api:

                                        /api/blocklist/add?ip=1.2.3.4&expire=3600&key=kjdsft34jk8

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          peterclark4
                                          last edited by

                                          This wouldn't play nice with the NanoBSD install until I added lines to mount the CF card for R/W access and then back to R/O access at the point of where it writes to the lists.txt file in ipblocklist_list.php.

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            simby
                                            last edited by

                                            I have this problem in pfsense 2.0 beta 1

                                            Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 785

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.