Country Block

tommyboy180 · Oct 4, 2010, 5:21 PM

I have a question on the selectable interfaces. I will be installing some additional NICs in the box so that my personal PC is separate from the server. Currently I don't select outbound because it blocks some pages I try to view and I'd really like to have this feature for my server. Thus, I assume I would want to uncheck the WAN and my personal interface and just have my server interface checked, correct? Just curious.

Not checking your WAN interface will leave you vulnerable to attack from your blocked counties. However, yes. If you do not select your WAN and your LAN, then you will be able to enforce outbound access, on the DMZ, to the countries while still being able to access them on your LAN.
For a customized configuration you can always edit /usr/local/www/packages/countryblock/execute.sh to give you more control over how you want to block access to the countries.

Bai Shen · Oct 4, 2010, 5:28 PM

Is there a way to get notified when Country Block stops? I keeps not running for me, and I can't tell if it's because of something I did or not.

tommyboy180 · Oct 4, 2010, 5:45 PM

@Bai:

Is there a way to get notified when Country Block stops? I keeps not running for me, and I can't tell if it's because of something I did or not.

I am working on email notifications for the next version. Right now I'm looking at gmail support only.

XIII · Oct 4, 2010, 5:58 PM

with gmail support, will it support google apps users?

tommyboy180 · Oct 4, 2010, 7:41 PM

@XIII:

with gmail support, will it support google apps users?

If you have an @gmail then yes.

XIII · Oct 4, 2010, 10:24 PM

google apps users use @yourdomain.com but other than that it is googles servers (smtp.gmail.com, smtp.googlemail.com etc)

tommyboy180 · Oct 4, 2010, 10:30 PM

@XIII:

google apps users use @yourdomain.com but other than that it is googles servers (smtp.gmail.com, smtp.googlemail.com etc)

Yes that's right. That's how I setup my email. I'm not sure, it should. I'm using smtp.gmail.com as the gateway, so as long as it authenticates it will work.
I hope to have this out soon, so you will be able to test here shortly.

XIII · Oct 4, 2010, 10:34 PM

well since google is making all gapps accounts full (almost) google accounts, one can log in at gmail.com with their full email address and get ones email.

I will be glad to be the first tester!

tommyboy180 · Oct 5, 2010, 6:12 AM

I've got email working right now. I was able to use any SMTP gateway, so email will not be restricted to gmail. So far I have successfully tested yahoo SMTP and gmail SMTP, but there isn't a reason why any SMTP gateway won't work.
Right now this is only on php4 and if I'm not mistaken php5 is on pfsense BETA 2. I don't have BETA 2 so I will need a tester here in a couple days if anyone wants to help out.

Bai Shen · Oct 5, 2010, 2:15 PM

I'm still having trouble with CB staying running. Is there anything I should look at?

robfantini · Oct 5, 2010, 2:41 PM

@Bai:

I'm still having trouble with CB staying running. Is there anything I should look at?

Which version of CB are you using?

And PfSense version?

mgc6288 · Oct 6, 2010, 2:41 AM

@tommyboy180:

Not checking your WAN interface will leave you vulnerable to attack from your blocked counties. However, yes. If you do not select your WAN and your LAN, then you will be able to enforce outbound access, on the DMZ, to the countries while still being able to access them on your LAN.
For a customized configuration you can always edit /usr/local/www/packages/countryblock/execute.sh to give you more control over how you want to block access to the countries.

I see. So to block all incoming I just keep the WAN checked and then if I check "Block outbound" and uncheck my personal LAN then my server and son's computer will be outbound blocked but mine will be unaffected even though all incoming is blocked? Just clarifying. Thanks.

tommyboy180 · Oct 6, 2010, 3:33 AM

@mgc6288:

@tommyboy180:

Not checking your WAN interface will leave you vulnerable to attack from your blocked counties. However, yes. If you do not select your WAN and your LAN, then you will be able to enforce outbound access, on the DMZ, to the countries while still being able to access them on your LAN.
For a customized configuration you can always edit /usr/local/www/packages/countryblock/execute.sh to give you more control over how you want to block access to the countries.

I see. So to block all incoming I just keep the WAN checked and then if I check "Block outbound" and uncheck my personal LAN then my server and son's computer will be outbound blocked but mine will be unaffected even though all incoming is blocked? Just clarifying. Thanks.

That is correct. You should be able to test this easily by accessing a site located in one of the countries and using a proxy located in the country. That's how I have been checking to make sure I understand how it works (I'm a visual learner).

tommyboy180 · Oct 6, 2010, 6:07 PM

Version 1.8 Released

Changes:

Email notifications
New cron script
System logging

Thank you all for your support. The new cron script (/usr/local/etc/rc.d/countryblock.sh) checks if it's running before doing anything. If it's running it exits, if not it will send you an email telling you it's restarting, make a system log entry, and the restart countryblock.
Email notifications use SMTP. Any SMTP sever works, not just gmail like I originally planned. Your email password is stored in plain text in a file called email_send.php for those who are paranoid.
Thanks again everyone.

kilthro · Oct 6, 2010, 9:49 AM

wow thats awesome!!!

Gonna give it a try. Thanks for the updates!!!!

DigitalJer · Oct 6, 2010, 1:40 PM

The hits just keep on comin!

Thanks much TB - strong work indeed!

Bai Shen · Oct 6, 2010, 2:33 PM

@robfantini:

Which version of CB are you using?

And PfSense version?

Newest of both. 1.7 and 1.2.3

It's still running today from yesterday. So I'm guessing my problem is that I can't always tell when something will make a firewall change and force me to restart CB.

Is there any way to have CB be part of the firewall restart? Surely there has to be some sort of hook for that.

tommyboy180 · Oct 6, 2010, 3:23 PM

@Bai:

@robfantini:

Which version of CB are you using?

And PfSense version?

Newest of both. 1.7 and 1.2.3

It's still running today from yesterday. So I'm guessing my problem is that I can't always tell when something will make a firewall change and force me to restart CB.

Is there any way to have CB be part of the firewall restart? Surely there has to be some sort of hook for that.

It's possible. I have been trying to make countryblock more integrated since the day I started development. I never figured it out. I'm hoping that I will soon or someone will.

DigitalJer · Oct 6, 2010, 3:45 PM

Trying out the email config: entered in the applicable settings, clicked Save, and this error appears:

Couldn't write values to file!

Navigating again to the email tab reveals this line:

Your settings have already been set. Would you like to overwrite your email settings?

Warning: file_get_contents(email_config.html): failed to open stream: No such file or directory in /usr/local/www/packages/countryblock/email.php on line 172

Uninstalling / re-installing doesn't seem to help :(

tommyboy180 · Oct 6, 2010, 4:03 PM

@DigitalJer:

Trying out the email config: entered in the applicable settings, clicked Save, and this error appears:

Couldn't write values to file!

Navigating again to the email tab reveals this line:

Your settings have already been set. Would you like to overwrite your email settings?

Warning: file_get_contents(email_config.html): failed to open stream: No such file or directory in /usr/local/www/packages/countryblock/email.php on line 172

Uninstalling / re-installing doesn't seem to help :(

Are you leaving a field blank? If so which field?
EDIT: Which browser are you using?