• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

IP-Blocklist

Scheduled Pinned Locked Moved pfSense Packages
496 Posts 86 Posters 507.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    mgc6288
    last edited by Jun 7, 2010, 5:19 PM

    @tommyboy180:

    The Allowed memory error is the webserver hitting a limit set in php.ini. You can increase this limit if you like, however the package will still work properly just let it finish before you refresh the page. In FF you can still see the loading animation in the tab even with that error, wait for that to finish.

    Take a look at Cino's post on page 2 http://forum.pfsense.org/index.php/topic,24769.msg130002.html#msg130002

    EDIT: You only get this error when you use large lists or a huge collection of lists.

    Gee good point - and the same list.  It does say "Fatal error…" and no other text but I'll let it sit for a while and see what happens.  How would I go about editing php.ini manually and is it line 380?  With 768M of RAM would it be wise to set it to 256M (268435456 bytes)?

    1 Reply Last reply Reply Quote 0
    • T
      tommyboy180
      last edited by Jun 7, 2010, 7:25 PM

      Edit the memory_limit cvar to 256
      ie. memory_limit = 256

      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • M
        mgc6288
        last edited by Jun 7, 2010, 7:42 PM

        @tommyboy180:

        Edit the memory_limit cvar to 256
        ie. memory_limit = 256

        Where would I go to change that though?

        1 Reply Last reply Reply Quote 0
        • T
          tommyboy180
          last edited by Jun 7, 2010, 10:09 PM

          @mgc6288:

          @tommyboy180:

          Edit the memory_limit cvar to 256
          ie. memory_limit = 256

          Where would I go to change that though?

          There are two php.ini files and I forget which one you need to edit.

          /usr/local/lib/php.ini
          /usr/local/etc/php.ini

          I would just add or edit to "memory_limit = 128M" I woudn't do more than 128M because that's all you should need.

          Just edit one and reboot. See if that works.

          -Tom Schaefer
          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

          Please support pfBlocker | File Browser | Strikeback

          1 Reply Last reply Reply Quote 0
          • M
            mgc6288
            last edited by Jun 8, 2010, 12:03 AM

            @tommyboy180:

            There are two php.ini files and I forget which one you need to edit.

            /usr/local/lib/php.ini
            /usr/local/etc/php.ini

            I would just add or edit to "memory_limit = 128M" I woudn't do more than 128M because that's all you should need.

            Just edit one and reboot. See if that works.

            Well I did find the /usr/local/lib/php.ini and did not find a /usr/local/lib/etc/php.ini (for those with the same problem).  I went to Diagnostics –> Edit File and loaded the former and found the memory_limit = 32M and changed it to 128M.  Then I rebooted and the php.ini file reset back to 32M.  I tried to enable IP Blocklist and received this error:

            Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 380

            with this under "Current Status = NOT running" : /tmp/rules.debug:112: syntax error

            Hmm... ideas?

            1 Reply Last reply Reply Quote 0
            • T
              tommyboy180
              last edited by Jun 8, 2010, 3:28 AM

              It is probablly set in a config file like /etc/inc/config.inc

              I can't seem to increase the memory size, it stays at 12M no matter what I change.

              /etc/inc/config.inc even says:

              /* Set memory limit to 32MB, this is required for large configurations
               * A XML config of about 500KB will trigger the default of 12MB
               * Setting the memory_limit parameter in the php.ini does not seem to
               * take any effect. Also, that would be too late in the boot process
               */
              ini_set("memory_limit","128M");
              
              

              So I'm not sure. Open a new topic and ask the question.

              -Tom Schaefer
              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

              Please support pfBlocker | File Browser | Strikeback

              1 Reply Last reply Reply Quote 0
              • M
                mgc6288
                last edited by Jun 8, 2010, 8:15 PM

                Well I believe I found my problem.  I opened /tmp/rules.debug and scrolled to the line:

                havp proxy ifaces redirect

                #rdr on proto tcp from any to () port 8080 -> lo0 port 8080

                and put a "#" in front of the offending line rdr…  I don't know what exactly this line is for but I did uninstall the HAVP.  It wasn't running yet but I was wanting to test it out for AV purposes down the road.  It left the above code behind so I commented it out.  I did get this error code the next time I attempted to save/update:

                Warning: file_get_contents(wlists.txt): failed to open stream: No such file or directory in /usr/local/www/packages/ipblocklist/ipblocklist.php on line 30 Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 12 bytes) in /etc/inc/util.inc on line 380

                Good news is though it says it is "running" which how could I confirm?  Or is this just one of those blind faith things...

                1 Reply Last reply Reply Quote 0
                • M
                  mastablastaz
                  last edited by Jun 8, 2010, 9:19 PM

                  Great job.

                  Im uninstalling squid + squidguard and switching to this.

                  I was previously using squidguard as an url blocker and squid as a 0mb cache proxy.

                  1 Reply Last reply Reply Quote 0
                  • T
                    tommyboy180
                    last edited by Jun 8, 2010, 10:06 PM Jun 8, 2010, 10:04 PM

                    For the paranoid you can double confirm that the package is running by executing this in a shell:

                    To confirm the table is being used to block

                    pfctl -s rules | grep ipblocklist
                    

                    This is what the GUI page does to ensure it is running.

                    -Tom Schaefer
                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                    Please support pfBlocker | File Browser | Strikeback

                    1 Reply Last reply Reply Quote 0
                    • D
                      darklogic
                      last edited by Jun 11, 2010, 6:43 PM

                      How would you add URL's or where can you access .gz extension packages from countryipblock.net?

                      I see they have URL's that go directly and open up IP list, but they all appear to be in either .txt or .html format.

                      Thanks for any info on this.

                      Matt

                      1 Reply Last reply Reply Quote 0
                      • T
                        tommyboy180
                        last edited by Jun 11, 2010, 7:48 PM

                        If you want to block countries then use the Country Block package.

                        -Tom Schaefer
                        SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                        Please support pfBlocker | File Browser | Strikeback

                        1 Reply Last reply Reply Quote 0
                        • ?
                          Guest
                          last edited by Jun 12, 2010, 10:24 AM

                          @Hugovsky:

                          Anothe thing: I use my pfsense box to establish adsl connection with isp. Whenever it reconnects, ip-blocklist is disabled because pfsense reloads stuff. Can this be corrected?

                          Same thing over here… I use Squid as transparent proxy and establish my adsl connection via PPPoE.

                          -Frozen

                          1 Reply Last reply Reply Quote 0
                          • P
                            Phobia
                            last edited by Jun 15, 2010, 2:22 PM Jun 15, 2010, 2:18 PM

                            Hi there,

                            I've just installed your package today, and have received the out of memory error as well.

                            In searching the forum, it seems the SquidGuard folks have encountered this as well, but they seem to be adding the "memory_limit" variable to their own .inc file.

                            See this post :

                            http://forum.pfsense.org/index.php/topic,12586.msg68170.html#msg68170

                            Maybe this overrides the system's 12mb limit?

                            – Phob

                            1 Reply Last reply Reply Quote 0
                            • R
                              rr
                              last edited by Jun 20, 2010, 1:34 AM Jun 19, 2010, 9:20 PM

                              Hi,

                              I have seen a few posts on the ip-block package not installing.  When trying to install on 1.2.3 with snort and ntop, the package install screen stayed on running php script for hours.  Finally did a clean install of 1.2.3 and the install of ip-block package completed. No issues with starting.  However, as a few other posts indicate, ip-block seems to work in silent mode (no logs or messages that url to list was down loaded and installed.).

                              Thanks,

                              UPDATE:  Performed a re-install package on same machine detailed above and got package installed message.  However upon entering URL(s) and click save received the following:

                              Warning: file_get_contents(wlists.txt): failed to open stream: No such file or directory in /usr/local/www/packages/ipblocklist/ipblocklist.php on line 30

                              checking:
                              $ pfctl -s rules | grep ipblocklist
                              pass quick from <ipblocklistw>to any flags S/SA keep state label "IP-Blocklist"
                              pass quick from any to <ipblocklistw>flags S/SA keep state label "IP-Blocklist"
                              block drop quick from <ipblocklist>to any label "IP-Blocklist"
                              block drop quick from any to <ipblocklist>label "IP-Blocklist"</ipblocklist></ipblocklist></ipblocklistw></ipblocklistw>

                              1 Reply Last reply Reply Quote 0
                              • T
                                tommyboy180
                                last edited by Jun 20, 2010, 1:27 PM

                                The wlist.txt is only a warning. I will be adding a fix for this here shortly.

                                It looks like your package install is working. To make that error go away just browse to the whitelist page, until I patch to the next version.

                                I have seen all the problems that people are having when they have other packages installed, but I have not been able to replicate these issues, besides the php mem error. The php mem error does not actually hinder the function of the package, its more of an annoyance than an issue.

                                If anyone cannot get the package working due to a number of weird configurations then please PM me. I plan on supporting this package for a long time.

                                -Tom Schaefer
                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                Please support pfBlocker | File Browser | Strikeback

                                1 Reply Last reply Reply Quote 0
                                • M
                                  m4rcu5
                                  last edited by Jul 19, 2010, 5:08 PM

                                  Hi,

                                  I am running 2.0-BETA3 built on Sun Jul 18 02:17:40 EDT 2010, and im trying to use the package.
                                  It installs fine, but when i add the level 1 list and hit save, it gives the memory error.
                                  This should be normal according to previous posts, but unfortunately the page says "Not RUNIING" and i don't see any rules.

                                  Could you help me diagnose the problem?

                                  grtz, Marcus

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mgc6288
                                    last edited by Jul 19, 2010, 5:33 PM

                                    I got level 1 going…try doing it in FF and see what happens.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      m4rcu5
                                      last edited by Jul 19, 2010, 5:45 PM

                                      I am already using Firefox. Still no joy.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mgc6288
                                        last edited by Jul 19, 2010, 6:16 PM

                                        Well I did get an error for bt_level1.gz however when I reloaded pfsense it did state it was running.

                                        I just went to countryipblocks.net and made a huge list of all the countries I don't need in "IP Range" and saved them to a .txt file and posted on my server.  I added that to IP-Blocklist and it works like a charm.  Now all I am concerned with are a few countries which I will eventually work on the spam levels…

                                        Most of the spam, as listed, is coming from:

                                        Korea
                                        China
                                        India
                                        Russia
                                        Turkey
                                        Vietnam
                                        Ukraine
                                        Brazil
                                        Venezuela
                                        Pakistan

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          m4rcu5
                                          last edited by Jul 19, 2010, 7:04 PM

                                          Even after a reboot of the firewall it did not seem to be running. I also tried smaller lists live level 3. Nut still i cant seem to get it running.
                                          Is there any way to get some debugging output to see where it goes wrong?

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received