Country Block
-
I'm using pfsense 1.2.3.
I installed the package with the web interface. When configuring it, I click enable, commit, and save. However, usually after clicking commit, it disables the Enable checkbox. So it's more like enable, commit, enable, save.
I notice it's not running after waiting a few minutes then going back to the Country Block configuration page.
# pkg_info arc-5.21o_1 Create & extract files from DOS .ARC files arj-3.10.22_1 Open-source ARJ arj-3.10.22_3 Open-source ARJ bandwidthd-2.0.1_1 Tracks bandwidth usage by IP address clamav-0.96.1 Command line virus scanner written entirely in C cyrus-sasl-2.1.22_1 RFC 2222 SASL (Simple Authentication and Security Layer) cyrus-sasl-2.1.23 RFC 2222 SASL (Simple Authentication and Security Layer) denyhosts-2.5 Script to thwart ssh attacks gd-2.0.35,1 A graphics library for fast creation of images gdbm-1.8.3_3 The GNU database manager havp-0.91_1 HTTP Antivirus Proxy jpeg-6b_4 IJG's jpeg compression utilities lha-1.14i_6 Archive files using LZSS and Huffman compression (.lzh file libiconv-1.11_1 A character set conversion library lightsquid-1.7.1_1 A light and fast web based squid proxy traffic analyser mysql-client-5.1.44_1 Multithreaded SQL database (client) ntop-3.3.8 Network monitoring tool with command line and web interface openldap-client-2.4.10 Open source LDAP client implementation openldap-client-2.4.11 Open source LDAP client implementation openldap-client-2.4.22 Open source LDAP client implementation p5-GD-2.39 A perl5 interface to Gd Graphics Library version2 pcre-7.9 Perl Compatible Regular Expressions library pcre-8.00 Perl Compatible Regular Expressions library pcre-8.02 Perl Compatible Regular Expressions library perl-5.10.1 Practical Extraction and Report Language perl-5.10.1_1 Practical Extraction and Report Language perl-5.8.8_1 Practical Extraction and Report Language perl-5.8.9_3 Practical Extraction and Report Language python24-2.4.3_3 An interpreted object-oriented programming language snort-2.8.6_1 Lightweight network intrusion detection system squid-2.7.9 HTTP Caching Proxy squid_radius_auth-1.10 RADIUS authenticator for squid proxy 2.5 and later stunnel-4.25 SSL encryption wrapper for standard network daemons unzoo-4.4_2 A zoo archive extractorFrom the web interface: Country Block Dashboard Dashboard Widget: Antivirus Status Dashboard Widget: HAVP Dashboard Widget: Snort HAVP antivirus Lightsquid OpenVPN Status bandwidthd ntop snort squid stunnelAll the latest versions except squid, which looks like it was updated today.
-
Something is regenerating your firewall settings I think. Every time rules.debug is run your country block package stops running. I have been running country block for a month now without errors or interruption.
Start to eliminate variables. Disable packages and services and start to narrow it down. If you want to help me get to the bottom of this now email me your config and I can probably give you an answer within the hour.
-
Ok I'll start disabling packages and see what happens. If I can't figure it out I'll send you my config.
-
I disabled everything I could and no luck. What sections of the config should I send you?
Thanks for offering to look at it for me.
-
If you don't mind just send me the entire config.
-
That's fine. Just got to edit the config. I'll send it to you in a sec.
Edit: Sent. Thanks!
-
No probs here either. :)
-
I get file system errors trying to write.
I can look further into this, I usually don't support nanobsd because of special exceptions I make.
The script is getting hung up on creating two files, countries.txt and lists/countries.txt. Perhaps you can make these files and modify the permissions so they cannot be removed.Were you able to look further into this - or can you provide a little more detail on how to fix? I have the same issue (pfSense 1.2.3 on Alix). Thanks.
-
I must be doing something wrong, or am finding the wrong IP of spammed emails. First, I have nearly every country checked, including the Dominican Republic. I've still received a few emails and my mail server separates them and lists their IP in the subject line for me. Recently I found one with an IP of 200.42.239.139 which as stated here:
http://ip-address-lookup-v4.com/lookup.php?ip=200.42.239.139
Points to the Dominican Republic. Am I finding a fake IP from the sender? Thanks.
-
Depending on what the spammer uses as relay….
-
Look at the last ip address before your own email server in the received headers, that's the IP address checked by country block.
-
Version 1.4 released.
Added logging option.
Added missing country. (India is in the top 10 list)
Fixed misspellings.
Changed installation process. -
Version 1.4 released.
Added logging option.
Added missing country. (India is in the top 10 list)
Fixed misspellings.
Changed installation process.After some looking around…is the logging feature located under status --> system logs --> Firewall?
-
Yes, system logs -> Firewall.
I am still working on a way to filter what is logged only by the package. That requires a lvl 67 programmer and I am only lvl 66.Right now the only way to tell if something is blocked by the package is to click the red x on the logged event.
-
Came across some issues. I found you may need to uninstall the 1.3 package and then reboot you system after the uninstall. Then install the new 1.4 package and reboot again. I was not able to get the new version to start until after I did the following. This is just something to try if anyone else happens to get this same issue for what ever reason.
Other than that, the package is working great. Good job on implementing the logging. I have a feeling level 67 will soon come about.
Thanks again for all the hard work tommyboy180
-
Thank you for the new version Tommyboy180.
-
-
has anybody got this going on embedded yet? i'm getting hit with terrible spam and this would come in extremely handy.
i've changed my embedded to rw, did the install but it still complains. i've tried to create countries.txt etc and they get deleted the minute i try to commit countries in the gui.
i'd really appreciate some help with this as i've had to close down my mail server to stop spam coming in (even with spam assasin!) -
i got it going but could the author or anybody else let me know if i am doing anything wrong or opening a hole as i am not a coder.
i simply edited the config file like:$N = count($aCountry);
$myFile = "countries.txt";
conf_mount_rw();
$fh = fopen($myFile, 'w+');
$output = "**You selected $N Countries";for($i=0; $i < $N; $i++)
{
//echo($aCountry[$i] . " ");
fwrite($fh, $aCountry[$i] . "\n");
conf_mount_rw();
}
echo("");
}
}and away it went. it's running ok now. thank you.**
-
i got it going but could the author or anybody else let me know if i am doing anything wrong or opening a hole as i am not a coder.
i simply edited the config file like:$N = count($aCountry);
$myFile = "countries.txt";
conf_mount_rw();
$fh = fopen($myFile, 'w+');
$output = "**You selected $N Countries";for($i=0; $i < $N; $i++)
{
//echo($aCountry[$i] . " ");
fwrite($fh, $aCountry[$i] . "\n");
conf_mount_rw();
}
echo("");
}
}and away it went. it's running ok now. thank you.**
Awesome! You saved me a couple hours on my day off. I will make the changes and commit this in the CountryBlock package and the IPBlocklist package.
