IP-Blocklist
-
I would be interested in being able to tie this into Fail2Ban. Do to do we'd need a simple API to add items to the list. For example a RESTful api:
/api/blocklist/add?ip=1.2.3.4&expire=3600&key=kjdsft34jk8
-
This wouldn't play nice with the NanoBSD install until I added lines to mount the CF card for R/W access and then back to R/O access at the point of where it writes to the lists.txt file in ipblocklist_list.php.
-
I have this problem in pfsense 2.0 beta 1
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 785
-
I have this problem in pfsense 2.0 beta 1
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 785
Take a look at Cino's post above.
-
Hello,
Sorry, but i can't get it to work.
I'm using pfSense 1.2.3 release and IP-Blocklist 0.1.9.
The box is used in a multi-wan context, plus some IPsecs, plus PPTP, plus Squid/Squidguard (use only on WAN1).
I tried to use the following list : http://list.iblocklist.com/?list=cn, and it seems to be well added in the GUI, but the status is always shown as "NOT running" in red.
I enabled/disabled the module, saved/updated, there's no error such as the memory error, and no message in the logs.
Any idea ?
Thank you.
-
How much do these additional tables slow down the router?
It seems like "normal" firewalls only block a very small number of hosts (50?) but these lists seem to contain thousands of entries and it seems like it would take a lot of time to process every packet against so many hosts…
-
This wouldn't play nice with the NanoBSD install until I added lines to mount the CF card for R/W access and then back to R/O access at the point of where it writes to the lists.txt file in ipblocklist_list.php.
I still don't think that this is playing well with my NanoBSD install. I'm getting no errors and the current status is "Running" but it doesn't appear to be blocking any connections.
-
Hello,
Sorry, but i can't get it to work.
I'm using pfSense 1.2.3 release and IP-Blocklist 0.1.9.
The box is used in a multi-wan context, plus some IPsecs, plus PPTP, plus Squid/Squidguard (use only on WAN1).
I tried to use the following list : http://list.iblocklist.com/?list=cn, and it seems to be well added in the GUI, but the status is always shown as "NOT running" in red.
I enabled/disabled the module, saved/updated, there's no error such as the memory error, and no message in the logs.
Any idea ?
Thank you.Jideel, Uninstall the package and reinstall. When the package was committed a mistake was made. This should fix your problem.
How much do these additional tables slow down the router?
It seems like "normal" firewalls only block a very small number of hosts (50?) but these lists seem to contain thousands of entries and it seems like it would take a lot of time to process every packet against so many hosts…
Since the IPs (up to 900,000!) are added to a table it doesn't really impact performance in the way you think it would. PF is really awesome in that even a 900,000 ip table will not be noticeable when applied. Very little ram is used and CPU utilization doesn't even budge when my lists are applied.
-
I cant get it to start….............No matter what I do.
Can add the lists, but status says not running....I have deleted, rebooted like 10 times....
Doesnt say anything in the logs. Doesnt work..........:(
Rel 1.2.3 with 0.1.9
-
@tommyboy180 :
just did what you said : install/reinstall, but still doesn't works.
Now it says "/tmp/rules.debug:45: Rules must be in order: options, normalization, queueing, translation, filtering".
I choosed to turn on the option "Disable all auto-added VPN rules." in the advanced settings, don't know if it matters to your plugin or not.
Thanks for your help. -
TommyBoy180: How much trouble would it be to make an IP-Allow list? Doesn't pfSense automatically block all but default anyways? Seems like using an allow list would be less intensive if it was possible.
-
It blocks by rule, not by IP address.
-
Some of you are having issues because of a mistake that was committed. The error has been corrected but you still have the old package running.
Uninstall your package
Reboot your box
Re-install your package.PM me with any errors that you encounter and any specific settings that you have.
I have tested the current package release on a fresh install of 1.2.3 and 1.2.2 and it is working correctly. I also tested unique settings such as Jideels's 'Disable all auto-added VPN rules' setting and the package works fine.Thank you all for your support with this package.
Hopefully version 2 will include scheduled updates and a white-list feature. Keep the suggestions coming!
-
ip blocker don't work with traffic shaper
turn off traffic shaper and enable ip blocker
sorry for my english
-
I tested with traffic shaper enable and the package worked fine. You may have other firewall settings that could be disabling the package. Its really hard to say what is happening without looking at your unique setup. If you want you could send me your pfsense config to my email for further investigation.
-
Mule All I mean is why can't we have the package work the other way around. Would it not be more beneficial than blocking hundreds of thousands of ips? I am just asking a question of logic. I am not asking anyone to make a new package or anything.
-
Version 2 will include a white list feature.
Just remember outbound is usually open/unfiltered on almost all home setups. This is what this package addresses. Its the PeerGuardian2 or PeerBlock alternative for pfsense.
-
Yay….but I dont understand why Tom. To make it more secure, it is better to have the opportunity to block inbound IP's...
Normally it is not an issue with outbound traffic, but more what comes from the outside... I would really muck like to eliminate everything from selected countries.
-
The package stops inbound and outbound traffic in all protocols for the added IP lists.
You can block entire countries with this package. That is one of the main benefits of this package. So if you want to run p2p applications safely or block spam for your email servers, or even block entire countries this is the package for you.
Take a look at some of the public available lists you can use: http://iblocklist.com/lists.php
Remember this package blocks all inbound and outbound traffic on all protocols for the IPs in each list.
-
Thanks Mate!! :) That was exactly what I was looking for….
Looking forward to see if you find the reason for me having trouble getting it to work :)
The package stops inbound and outbound traffic in all protocols for the added IP lists.
You can block entire countries with this package. That is one of the main benefits of this package. So if you want to run p2p applications safely or block spam for your email servers, or even block entire countries this is the package for you.
Take a look at some of the public available lists you can use: http://iblocklist.com/lists.php
Remember this package blocks all inbound and outbound traffic on all protocols for the IPs in each list.