IP-Blocklist

tommyboy180

@tommyboy180:

ipblocklist version 2.2 released.

Added logging to FW log
changed install process
Added visual for how many networks/IPs are being blocked

Just installed,

but not showing ip addresses blocked, going to look for file locations to see if this is a bug or something else missing. Offhand where are they located?

That is because your list links are wrong. Please read the FAQ on the first post (Q: My list site only give dynamic links to lists…...)
Example:
cr_bogon links to http://list.iblocklist.com/files/cr_bogon.gz
bt_spyware links to http://list11.iblocklist.com/files/bt_spyware.gz

You need to have the true url to the list. Dynamic links which are used for load balancing is not supported. BTW, I wouldn't use the bogon list if I were you. You will lock yourself out of your pfsense box.

dlawley

thank you sir, did the trick. and all that time I thought….... oh well

dlawley

ok cool, blocking ips. But would like to incorporate I-Blocklist subscription list. Not sure what the proper format might be since a username and id are part of the url.

possible?

tommyboy180

@dlawley:

ok cool, blocking ips. But would like to incorporate I-Blocklist subscription list. Not sure what the proper format might be since a username and id are part of the url.

possible?

I'm not really sure. My best guess would be to remove all the links you have and just add the subscription list. See if you get the counter to go up. If so then it works, if not then we can try to think of something else. Let me know, I'm curious.

Pistolero

Hi there,

I think there might be an incompatibility between IP Blicklist/Country Block and the HAVP antivirus proxy. Every time I start the blocklist(s) HAVP stops proxying and gives an error for every URL. Also, the control buttons to save settings only work on Firefox, Neither IE or Opera can activate them.

Hope this helps to quash a bug!

tommyboy180

The IE incompatibility is an issue that I haven't been able to fix yet. Supermule challenged me with fixing it and I was unable to find a fix. If you would like to help, I would appreciate it. The best thing I can say right now is use FF or Chrome, who uses IE or Opera anymore anyway.

I will test with HAVP. Thank you for helping out with the project.
EDIT: Does HAVP break when you have logging enabled in the package?

mgc6288

@tommyboy180:

The IE incompatibility is an issue that I haven't been able to fix yet. Supermule challenged me with fixing it and I was unable to find a fix. If you would like to help, I would appreciate it. The best thing I can say right now is use FF or Chrome, who uses IE or Opera anymore anyway.

I use Opera…

Pistolero

@tommyboy180:

The IE incompatibility is an issue that I haven't been able to fix yet. Supermule challenged me with fixing it and I was unable to find a fix. If you would like to help, I would appreciate it. The best thing I can say right now is use FF or Chrome, who uses IE or Opera anymore anyway.

I will test with HAVP. Thank you for helping out with the project.
EDIT: Does HAVP break when you have logging enabled in the package?

Thanks for the reply! You know what, I have not tested whether it is the logging part that kills HAVP. I will try today with logging disabled on both your packages to see if HAVP likes that better.

tommyboy180

@mgc6288:

@tommyboy180:

The IE incompatibility is an issue that I haven't been able to fix yet. Supermule challenged me with fixing it and I was unable to find a fix. If you would like to help, I would appreciate it. The best thing I can say right now is use FF or Chrome, who uses IE or Opera anymore anyway.

I use Opera…

That made me laugh :)

Pistolero

I tried IP Blocklist without logging enabled and it still broke HAVP. I was sad to have to uninstall IP Block… :-(

In other news, however, looks like your Country Block is working fine without interfering with other packages. Only small issue I have seen with it is that it does not start upon boot...

Thanks for your software!

tommyboy180

What version of pfsense are you running? Embedded?

Countryblock will start on startup as will IP-Blocklist. Make sure /usr/local/etc/rc.d/countryblock.sh or ipblocklist.sh is there. Check the permissions of the file. I am still testing HAVP compatibility. .

tommyboy180

atma.es and iblocklist.com now host a list that blocks attackers who try to spy or remotely control others' computers by means such Microsoft remote terminal, SSH, Telnet or shared desktops.
Sites spreading virus, trojans, spyware, exploits, fake identities/agents, DDoS attackers and Port scans are also in the list.

atma url: http://www.atma.es/atma.p2p
iblocklist url: http://list.iblocklist.com/files/tzmtqbbsgbtfxainogvm.gz

The list is updated daily. I recommend that you include this list with your other lists.

Pistolero

@tommyboy180:

What version of pfsense are you running? Embedded?

Countryblock will start on startup as will IP-Blocklist. Make sure /usr/local/etc/rc.d/countryblock.sh or ipblocklist.sh is there. Check the permissions of the file. I am still testing HAVP compatibility. .

I am running 1.2.3 x86. Lemme check the scripts to see their attributes…

Thanks!

dlawley

Currently its not possible, but I did request it or at least let them know reason for asking. Another challenge to tackle at some point.

@tommyboy180:

@dlawley:

ok cool, blocking ips. But would like to incorporate I-Blocklist subscription list. Not sure what the proper format might be since a username and id are part of the url.

possible?

I'm not really sure. My best guess would be to remove all the links you have and just add the subscription list. See if you get the counter to go up. If so then it works, if not then we can try to think of something else. Let me know, I'm curious.

tommyboy180

@dlawley:

Currently its not possible, but I did request it or at least let them know reason for asking. Another challenge to tackle at some point.

@tommyboy180:

@dlawley:

ok cool, blocking ips. But would like to incorporate I-Blocklist subscription list. Not sure what the proper format might be since a username and id are part of the url.

possible?

I'm not really sure. My best guess would be to remove all the links you have and just add the subscription list. See if you get the counter to go up. If so then it works, if not then we can try to think of something else. Let me know, I'm curious.

There is a trick I use that you may be able to use for a subscription list. Using Firefox, download the list like normal and save it somewhere temporary. Now in firefox, in the download manager, right click on the downloaded file and click copy download location or url. This is the true URL, try to paste that into the package and see if that works.

Xthink

If I add several list, can I temporarily disable any of the list if I need to just like peerguardian?

tommyboy180

@Xthink:

If I add several list, can I temporarily disable any of the list if I need to just like peerguardian?

It's all or none. You can uncheck the "Enable IP-Blocklist" check box and click save to disable.

plehmann

??? well I've just installed latest build of 1.2.3 on a Gigabyte ATOM 510 board ga-510U if I remember .. 2 gig of ram and an old maxstor 320 gig single partition Sata 150 harddrive. So far its been great but I'm also in the process of trimming down the WHS and saw ip blocklist. right over with the intros..I've just installed via package manager etc copied the link for peer 1 traffic given on the blocklist manager page and received after a few mins….

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /etc/inc/util.inc on line 380
no idea as to what this is referring to ?

any help

regards
Piers

tommyboy180

@plehmann:

??? well I've just installed latest build of 1.2.3 on a Gigabyte ATOM 510 board ga-510U if I remember .. 2 gig of ram and an old maxstor 320 gig single partition Sata 150 harddrive. So far its been great but I'm also in the process of trimming down the WHS and saw ip blocklist. right over with the intros..I've just installed via package manager etc copied the link for peer 1 traffic given on the blocklist manager page and received after a few mins….

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /etc/inc/util.inc on line 380
no idea as to what this is referring to ?

any help

regards
Piers

That's been talked about several times on this topic. The webserver processes the ipblocklist script via php. It will run out of memory because of the way the webserver is configured. You can edit how much memory is dedicated for the webserver, however the script still runs without changing anything.
Just wait for the browser busy or loading animation (even during the out of mem error it's still running when the loading animation is present) to complete. Then reload the page (But do not 'resend')

plehmann

tb yes thanks for the quick reply, my bad i do normally check through these posts b4, bloody typical that one of the first times I dont there it is staring at me.. though reloading under ff after waiting about 5 mins still only seems to load a small proportion of the ips that are loaded under peerblock…I shall test some more...and I'll now go and beat myself with a neatly trimmed willow branch....scuttles away :-[