Country Block

tommyboy180 · Sep 24, 2010, 4:56 PM

(if im posting in the wrong area just let me know)

Thanks Tommy for a great package, i am a huge fan and it and deployed this on every firewall i build…....ok now of for the question ;D

i have a Dell power edge 1850 dual xeons 3.0's and 2g ram and about 35gb of disk space running 1.2.3. Release. (Mind you this is first time i have seen this) We had the original config for this on a "Alix" board and just moved the config file over to the larger servers on a fresh install.

Issue: Committing the country's to the block list is fine however when i Enable Country Block i receive the following error:

Current Status = NOT running
/tmp/rules.debug:44: syntax error
You are blocking 0 Networks

if anyone in the community has any ideas please let me know....Thanks again.....

Image Below.

Just to make sure do you have the latest version of countryblock installed?
Also what other pages are you running? Traffic shaping?

jroberts31xray · Sep 24, 2010, 5:08 PM

Version 0.1.4 on the C.B. and i am not running shaping, packages listed below: btw we are running the FW transparent.

Package Name Category Package Version
Country Block Firewall 0.1.4
Dashboard System 0.8.8
IP-Blocklist Firewall 0.2.2

thanks for the FAST reply. ;)

Supermule · Sep 24, 2010, 5:30 PM

Then its not a firewall any more and doesnt do any blocking….;)

jroberts31xray · Sep 24, 2010, 7:16 PM

We got it…thanks again Tommy, great package.

it was a bad config file......Thanks

tommyboy180 · Sep 25, 2010, 11:28 PM

@jroberts31xray:

We got it…thanks again Tommy, great package.

it was a bad config file......Thanks

Thank you for your support!

jroberts31xray · Sep 26, 2010, 1:14 AM

Yup….NP the config was from an embedded alix board and did not work when imported to a full hardware install..........from what i am told its a "Known" issue. Your package is awesome and it does the Job 100%! thanks again. The folks here at Bluegrassnet appreciate it!

kilthro · Sep 26, 2010, 11:27 PM

i wanted to say thanks for this package!!! its fantastic. This package is what got me introduced to pfsense since i needed something to block all of china and korea from my web servers. I have it added to cron to make sure it runs all the time as well.

I did have a question, is there any way to have this package to show up on the services screen?

I have that widget added to my main log in (dashboard) page on 2.0 and it would be good to see right there if it is running or not.

Just thought I would ask.

tommyboy180 · Sep 27, 2010, 10:50 AM

@kilthro:

i wanted to say thanks for this package!!! its fantastic. This package is what got me introduced to pfsense since i needed something to block all of china and korea from my web servers. I have it added to cron to make sure it runs all the time as well.

I did have a question, is there any way to have this package to show up on the services screen?

I have that widget added to my main log in (dashboard) page on 2.0 and it would be good to see right there if it is running or not.

Just thought I would ask.

It's not really a service that is running to block the countries, so having this package show up in the services will not be possible. The way it works is by basically injecting a couple lines of deny rules to your fw config so being able to track the current status of the package will have to be done via other means. If you know php I would love the extra help!
There are still many changes to come and I haven't forgotten about that update deltaend!
I do appreciate the support, so thank you!

tci · Sep 27, 2010, 12:11 PM

I have a wierd problem. I selected 12 countries, all of spammers list + Barbados + Italy. Whenever I return to the list once saved, Barbados is never selected but it is being blocked.
Status says Currently 12 of 246 selected.

Using Chrome. Anything i'm doing wrong or is it a bug?

tommyboy180 · Sep 29, 2010, 9:08 AM

Version 1.5 Released

Changes:

Added embedded compatibility.
Verified working with traffic shaping settings
Added interface choices - just for you jward!
Fixed bug with country Barbados - Thank you tci!

Warning: You need to select the interfaces that this will apply to before you run it. I Highly Recommend selecting all interfaces.
If you run into a problems let me know.
deltaend: I fixed the 404 problem and tested pfsense w/ traffic shaping. I was able to have it working w/ traffic shaping enabled so let me know if you run into any problems.

Thank you all for your patience with updates.

jward · Sep 29, 2010, 11:59 AM

Thanks Tommy, will take a look.

Supermule · Sep 29, 2010, 2:50 PM

Aint this a wrong path for the new 0.1.5 edition of Country block??

/usr/local/etc/rc.d/countryblock.sh

I use this…

/usr/local/www/packages/countryblock/countryblock.sh

@darklogic:

Thanks for all your help. :)

I did your suggestion with the uncheck Bogon and added the cron package and applied the command you specified. All seems to be working well with the Country Block package now. I rebooted my firewall and all came up ok. I did notice I could access some Chinese websites with extensions of .cn

Does the Country Block work for both IP's and DNS naming or just IP?

A On the cron job I made the new job entry with this criteria and maybe you have some suggestions or minor tweaks to it.

Cron Job:

Minute: 0
Hour: *
Mday: *
Month: *
Wday: *
Who: root
Command: /usr/local/etc/rc.d/countryblock.sh

Bai Shen · Sep 29, 2010, 3:09 PM

How does one update a package in pfSense? Is it automatic or do I need to do something?

mgc6288 · Sep 29, 2010, 10:15 PM

@tommyboy180:

Version 1.5 Released

Changes:

Added embedded compatibility.

Verified working with traffic shaping settings

Added interface choices - just for you jward!

Fixed bug with country Barbados - Thank you tci!

Warning: You need to select the interfaces that this will apply to before you run it. I Highly Recommend selecting all interfaces.
If you run into a problems let me know.
deltaend: I fixed the 404 problem and tested pfsense w/ traffic shaping. I was able to have it working w/ traffic shaping enabled so let me know if you run into any problems.

Thank you all for your patience with updates.

Hmm. I updated and now it won't start. I do have a red error message stating "Warning! No Interfaces Selected Click" and yet when I click the box I get a 404 requesting a link to hxxp://xxx.xxx.xxx.xxx/packages/countryblock/countryblock_if.php which doesn't exist.. Is there a different page I go to select which interface? Like you recommended, I'm fine with all of them for now. I just checked the directory packages\countryblock and I do not see a countryblock_if.php file listed there.

Having an individual log just for this would be awesome though some day - no rush - volunteer work is always outstanding. Thanks dude - this package really has been well worth the pfsense experience.

XIII · Sep 29, 2010, 10:31 PM

+1 on the interface issue, does it still work without selecting one?

Thanks for the work tommyboy180

tommyboy180 · Sep 29, 2010, 11:20 PM

Supermule

It's "/usr/local/etc/rc.d/countryblock.sh" "countryblock/countryblock.sh" does not exist. If you are making a cron job then use "/usr/local/etc/rc.d/countryblock.sh"

To update the package

Go to installed packages and uninstall countryblock
Now go to the main packages page and install countryblock

mgc6288

uninstall countryblock completely and re-install

XIII

Thank you!
It does not work without selecting your interfaces, I will be pushing 1.6 tonight to tomorrow morning to address this

tommyboy180 · Sep 30, 2010, 8:29 AM

Version 1.6 is now available!

Changes:

All interfaces are selected/applied by default (no action required by users)
Modified Usage description to be more verbose

To upgrade uninstall countryblock and re-install.

Supermule · Sep 30, 2010, 9:45 AM

Just an idea…..

Why not sort the countries in their respective part of the world instead?

Like Europe, North America, South America, Asia asf....The 7 continents. Thereby making it a lot easier to search and block.

tommyboy180 · Sep 30, 2010, 10:07 AM

@Supermule:

Just an idea…..

Why not sort the countries in their respective part of the world instead?

Like Europe, North America, South America, Asia asf....The 7 continents. Thereby making it a lot easier to search and block.

Thank you for the suggestion! Alphabetically is the most efficient way to sort a huge list, it's sort of a defacto standardization that I think everyone has become accustomed to. It's also easier to maintain a large list like this in this order. I will note this for a future release.
Keep the suggestions coming!

jward · Sep 30, 2010, 11:37 AM

Hi Tommy,

I've got some ideas for the UI and process flow that might help - let me know if you're interested and I'll put some mock-up screens together.

Jon.