Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IP-Blocklist

    Scheduled Pinned Locked Moved pfSense Packages
    496 Posts 86 Posters 510.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tommyboy180
      last edited by

      For the paranoid you can double confirm that the package is running by executing this in a shell:

      To confirm the table is being used to block

      pfctl -s rules | grep ipblocklist
      

      This is what the GUI page does to ensure it is running.

      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • D
        darklogic
        last edited by

        How would you add URL's or where can you access .gz extension packages from countryipblock.net?

        I see they have URL's that go directly and open up IP list, but they all appear to be in either .txt or .html format.

        Thanks for any info on this.

        Matt

        1 Reply Last reply Reply Quote 0
        • T
          tommyboy180
          last edited by

          If you want to block countries then use the Country Block package.

          -Tom Schaefer
          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

          Please support pfBlocker | File Browser | Strikeback

          1 Reply Last reply Reply Quote 0
          • ?
            Guest
            last edited by

            @Hugovsky:

            Anothe thing: I use my pfsense box to establish adsl connection with isp. Whenever it reconnects, ip-blocklist is disabled because pfsense reloads stuff. Can this be corrected?

            Same thing over here… I use Squid as transparent proxy and establish my adsl connection via PPPoE.

            -Frozen

            1 Reply Last reply Reply Quote 0
            • P
              Phobia
              last edited by

              Hi there,

              I've just installed your package today, and have received the out of memory error as well.

              In searching the forum, it seems the SquidGuard folks have encountered this as well, but they seem to be adding the "memory_limit" variable to their own .inc file.

              See this post :

              http://forum.pfsense.org/index.php/topic,12586.msg68170.html#msg68170

              Maybe this overrides the system's 12mb limit?

              – Phob

              1 Reply Last reply Reply Quote 0
              • R
                rr
                last edited by

                Hi,

                I have seen a few posts on the ip-block package not installing.  When trying to install on 1.2.3 with snort and ntop, the package install screen stayed on running php script for hours.  Finally did a clean install of 1.2.3 and the install of ip-block package completed. No issues with starting.  However, as a few other posts indicate, ip-block seems to work in silent mode (no logs or messages that url to list was down loaded and installed.).

                Thanks,

                UPDATE:  Performed a re-install package on same machine detailed above and got package installed message.  However upon entering URL(s) and click save received the following:

                Warning: file_get_contents(wlists.txt): failed to open stream: No such file or directory in /usr/local/www/packages/ipblocklist/ipblocklist.php on line 30

                checking:
                $ pfctl -s rules | grep ipblocklist
                pass quick from <ipblocklistw>to any flags S/SA keep state label "IP-Blocklist"
                pass quick from any to <ipblocklistw>flags S/SA keep state label "IP-Blocklist"
                block drop quick from <ipblocklist>to any label "IP-Blocklist"
                block drop quick from any to <ipblocklist>label "IP-Blocklist"</ipblocklist></ipblocklist></ipblocklistw></ipblocklistw>

                1 Reply Last reply Reply Quote 0
                • T
                  tommyboy180
                  last edited by

                  The wlist.txt is only a warning. I will be adding a fix for this here shortly.

                  It looks like your package install is working. To make that error go away just browse to the whitelist page, until I patch to the next version.

                  I have seen all the problems that people are having when they have other packages installed, but I have not been able to replicate these issues, besides the php mem error. The php mem error does not actually hinder the function of the package, its more of an annoyance than an issue.

                  If anyone cannot get the package working due to a number of weird configurations then please PM me. I plan on supporting this package for a long time.

                  -Tom Schaefer
                  SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                  Please support pfBlocker | File Browser | Strikeback

                  1 Reply Last reply Reply Quote 0
                  • M
                    m4rcu5
                    last edited by

                    Hi,

                    I am running 2.0-BETA3 built on Sun Jul 18 02:17:40 EDT 2010, and im trying to use the package.
                    It installs fine, but when i add the level 1 list and hit save, it gives the memory error.
                    This should be normal according to previous posts, but unfortunately the page says "Not RUNIING" and i don't see any rules.

                    Could you help me diagnose the problem?

                    grtz, Marcus

                    1 Reply Last reply Reply Quote 0
                    • M
                      mgc6288
                      last edited by

                      I got level 1 going…try doing it in FF and see what happens.

                      1 Reply Last reply Reply Quote 0
                      • M
                        m4rcu5
                        last edited by

                        I am already using Firefox. Still no joy.

                        1 Reply Last reply Reply Quote 0
                        • M
                          mgc6288
                          last edited by

                          Well I did get an error for bt_level1.gz however when I reloaded pfsense it did state it was running.

                          I just went to countryipblocks.net and made a huge list of all the countries I don't need in "IP Range" and saved them to a .txt file and posted on my server.  I added that to IP-Blocklist and it works like a charm.  Now all I am concerned with are a few countries which I will eventually work on the spam levels…

                          Most of the spam, as listed, is coming from:

                          Korea
                          China
                          India
                          Russia
                          Turkey
                          Vietnam
                          Ukraine
                          Brazil
                          Venezuela
                          Pakistan

                          1 Reply Last reply Reply Quote 0
                          • M
                            m4rcu5
                            last edited by

                            Even after a reboot of the firewall it did not seem to be running. I also tried smaller lists live level 3. Nut still i cant seem to get it running.
                            Is there any way to get some debugging output to see where it goes wrong?

                            1 Reply Last reply Reply Quote 0
                            • M
                              mgc6288
                              last edited by

                              Here is a question.  I can copy the direct links for the .gz files from iblocklist.com and they work because they are in the format:

                              domain:x.x.x.x-x.x.x.x

                              I went to countryipblocks.net and made a custom list of all the countries that I didn't need accessing my server and made an "IP Range" and then copied into a .txt file and posted on my own server.  The format for them is:

                              x.x.x.x - x.x.x.x

                              After adding the link to IP-Blocklist it does say it is running, but the list isn't in the exact format (minus the domain) as the .gz ones.  Is this an issue?  How could one verify this?

                              1 Reply Last reply Reply Quote 0
                              • T
                                tommyboy180
                                last edited by

                                When the script checks to see if it is running it only verifies that the firewall entry has been made. The package does not verify the format of your lists, if there are errors in the lists then it silently ignores them.

                                countryipblocks.net format does not work. Use the country block package.

                                To verify your lists are applied cat /usr/local/www/packages/ipblocklist/lists/ipfw.ipfw and see if your IPs are in there.

                                Always use the domain:x.x.x.x-x.x.x.x format.

                                -Tom Schaefer
                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                Please support pfBlocker | File Browser | Strikeback

                                1 Reply Last reply Reply Quote 0
                                • M
                                  mgc6288
                                  last edited by

                                  @tommyboy180:

                                  countryipblocks.net format does not work. Use the country block package.

                                  Classic goof…I had a hunch to check the pfsense packages and this must have recently come out as I didn't see there a month or two ago...  Thanks!

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    m4rcu5
                                    last edited by

                                    Tommy,
                                    Doe you have any tips on debugging the package?
                                    I would really like to have it running, but i cant seem to find any clues on why it does not work.
                                    Or did i miss something, did i have to make a special rule in the firewall with the list of something?

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      tommyboy180
                                      last edited by

                                      Version 2.1 released

                                      Fixed pfsense BETA 2 package for x86 and x64. Now runs on all versions of pfsense.

                                      Fixed (wlists.txt) not found error.

                                      Fixed rare cases of the package not working with large firewall configurations. Thank you netritious!

                                      -Tom Schaefer
                                      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                      Please support pfBlocker | File Browser | Strikeback

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mgc6288
                                        last edited by

                                        @tommyboy180:

                                        When the script checks to see if it is running it only verifies that the firewall entry has been made. The package does not verify the format of your lists, if there are errors in the lists then it silently ignores them.

                                        countryipblocks.net format does not work. Use the country block package.

                                        To verify your lists are applied cat /usr/local/www/packages/ipblocklist/lists/ipfw.ipfw and see if your IPs are in there.

                                        Always use the domain:x.x.x.x-x.x.x.x format.

                                        If I were to save a .gz file on a www server in the format name:x.x.x.x-x.x.x.x and then occasionally updated the .gz in Notepad with IPs I'd like to block, would I need to re-commit / re-add the .gz to IP-Blocklist or is the list auto updated via the www link?

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          tommyboy180
                                          last edited by

                                          @mgc6288:

                                          If I were to save a .gz file on a www server in the format name:x.x.x.x-x.x.x.x and then occasionally updated the .gz in Notepad with IPs I'd like to block, would I need to re-commit / re-add the .gz to IP-Blocklist or is the list auto updated via the www link?

                                          To get the updated .gz on the pfsense box all you would have to do is click "Save/Update". That will re-download the .gz file and re-process it.

                                          -Tom Schaefer
                                          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                          Please support pfBlocker | File Browser | Strikeback

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            mgc6288
                                            last edited by

                                            @tommyboy180:

                                            To get the updated .gz on the pfsense box all you would have to do is click "Save/Update". That will re-download the .gz file and re-process it.

                                            Would it make sense, in possibly a future version, to make it where maybe a .gz link can be set to auto update during a certain time frame, i.e. once a day.  My thoughts is to have the .gz file reside on my server and when a spam email comes in I can get the IP address out of the header and simply add it to the .gz file without having to log into pfsense.  Just a thought.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.