Country Block

tommyboy180

@tommyboy180:

Not checking your WAN interface will leave you vulnerable to attack from your blocked counties. However, yes. If you do not select your WAN and your LAN, then you will be able to enforce outbound access, on the DMZ, to the countries while still being able to access them on your LAN.
For a customized configuration you can always edit /usr/local/www/packages/countryblock/execute.sh to give you more control over how you want to block access to the countries.

I see. So to block all incoming I just keep the WAN checked and then if I check "Block outbound" and uncheck my personal LAN then my server and son's computer will be outbound blocked but mine will be unaffected even though all incoming is blocked? Just clarifying. Thanks.

That is correct. You should be able to test this easily by accessing a site located in one of the countries and using a proxy located in the country. That's how I have been checking to make sure I understand how it works (I'm a visual learner).

tommyboy180

Version 1.8 Released

Changes:

Email notifications
New cron script
System logging

Thank you all for your support. The new cron script (/usr/local/etc/rc.d/countryblock.sh) checks if it's running before doing anything. If it's running it exits, if not it will send you an email telling you it's restarting, make a system log entry, and the restart countryblock.
Email notifications use SMTP. Any SMTP sever works, not just gmail like I originally planned. Your email password is stored in plain text in a file called email_send.php for those who are paranoid.
Thanks again everyone.

138.jpg_thumb

kilthro

wow thats awesome!!!

Gonna give it a try. Thanks for the updates!!!!

DigitalJer

The hits just keep on comin!

Thanks much TB - strong work indeed!

Bai Shen

@robfantini:

Which version of CB are you using?

And PfSense version?

Newest of both. 1.7 and 1.2.3

It's still running today from yesterday. So I'm guessing my problem is that I can't always tell when something will make a firewall change and force me to restart CB.

Is there any way to have CB be part of the firewall restart? Surely there has to be some sort of hook for that.

tommyboy180

@Bai:

@robfantini:

Which version of CB are you using?

And PfSense version?

Newest of both. 1.7 and 1.2.3

It's still running today from yesterday. So I'm guessing my problem is that I can't always tell when something will make a firewall change and force me to restart CB.

Is there any way to have CB be part of the firewall restart? Surely there has to be some sort of hook for that.

It's possible. I have been trying to make countryblock more integrated since the day I started development. I never figured it out. I'm hoping that I will soon or someone will.

DigitalJer

Trying out the email config: entered in the applicable settings, clicked Save, and this error appears:

Couldn't write values to file!

Navigating again to the email tab reveals this line:

Your settings have already been set. Would you like to overwrite your email settings?

Warning: file_get_contents(email_config.html): failed to open stream: No such file or directory in /usr/local/www/packages/countryblock/email.php on line 172

Uninstalling / re-installing doesn't seem to help :(

tommyboy180

@DigitalJer:

Trying out the email config: entered in the applicable settings, clicked Save, and this error appears:

Couldn't write values to file!

Navigating again to the email tab reveals this line:

Your settings have already been set. Would you like to overwrite your email settings?

Warning: file_get_contents(email_config.html): failed to open stream: No such file or directory in /usr/local/www/packages/countryblock/email.php on line 172

Uninstalling / re-installing doesn't seem to help :(

Are you leaving a field blank? If so which field?
EDIT: Which browser are you using?

DigitalJer

@tommyboy180:

Are you leaving a field blank? If so which field?
EDIT: Which browser are you using?

Yep, leaving Username and Password blank, as my ISP doesn't require that info. I can just use Gmail, if that will satisfy CB ?

Using Chrome.

EDIT: works great with Gmail (all fields filled in).

Thanks tho :)

XIII

All fields must be filled in for the email function to work.
Dont forget that for it to be able to restart CB you must have started it at least once.

robfantini

@DigitalJer:

Could you post your gmail settings?

XIII

@DigitalJer set SMTP Auth = No and see if that works

@robfantini
You did the quote wrong.

But heres the info you requested:
SMTP Auth = Yes
SMTP Security = Yes
Host = smtp.gmail.com (this is for gmail and GApps users)
Port = 465
User name = your full username (test@gmail.com)
Password = your password
Use HTML Formatting = Yes
From Email address = your full username (test@gmail.com)
To Email address = email you are sending notifications to
Subject = whatever you want

robfantini

@XIII:

@DigitalJer set SMTP Auth = No and see if that works

@robfantini
You did the quote wrong.

But heres the info you requested:
SMTP Auth = Yes
SMTP Security = Yes
Host = smtp.gmail.com (this is for gmail and GApps users)
Port = 465
User name = your full username (test@gmail.com)
Password = your password
Use HTML Formatting = Yes
From Email address = your full username (test@gmail.com)
To Email address = email you are sending notifications to
Subject = whatever you want

thank you, that worked. I had been using the wrong port.

Supermule

I get this when trying…

Parse error: syntax error, unexpected $end in /usr/local/www/packages/countryblock/email_send.php on line 6

robfantini

@Supermule:

I get this when trying…

Parse error: syntax error, unexpected $end in /usr/local/www/packages/countryblock/email_send.php on line 6

I had that happen until I filled in all fields , pressed save.

SMTP auth could not be set to no. Originally I wanted to use our local LAN mail server . I could only use my gmail smtp account.

XIII

any smtp account should work.

For the smtp auth did you still fill in the username and password when it was set to no?

Supermule

nope….used mail instead of smtp...

robfantini

@XIII:

any smtp account should work.

For the smtp auth did you still fill in the username and password when it was set to no?

I did set the account username and password .. I ended up with an ssl error.

Just checked the log on our postfix server.

Oct  6 08:42:15 mail postfix/smtpd[10912]: connect from fbc2.fantinibakery.com[10.100.100.2]
Oct  6 08:42:15 mail postfix/smtpd[10912]: NOQUEUE: reject: RCPT from fbc2.fantinibakery.com[10.100.100.2]: 504 5.5.2 <root>: Sender address rejected: need fully-qualified address; from= <root>to= <rob>proto=ESMTP helo= <localhost.localdomain>Oct  6 08:42:15 mail postfix/smtpd[10912]: lost connection after RSET from fbc2.fantinibakery.com[10.100.100.2]
Oct  6 08:42:15 mail postfix/smtpd[10912]: disconnect from fbc2.fantinibakery.com[10.100.100.2]
Oct  6 08:42:34 mail postfix/smtpd[10870]: connect from fbc2.fantinibakery.com[10.100.100.2]
Oct  6 08:42:34 mail postfix/smtpd[10870]: lost connection after UNKNOWN from fbc2.fantinibakery.com[10.100.100.2]
Oct  6 08:42:34 mail postfix/smtpd[10870]: disconnect from fbc2.fantinibakery.com[10.100.100.2]</localhost.localdomain></rob></root></root>

Looks like the cb pgm works… must be due to not having the full mail address..

XIII

looks like the username was rejected as the mail server requires usernames to be like test@gmail.com instead of test.

robfantini

@XIII:

looks like the username was rejected as the mail server requires usernames to be like test@gmail.com instead of test.

I tried to switch to non ssl and our local server.

at the top of the email settings is:

"Your settings have already been set. Would you like to overwrite your email settings?"

I click save below and
1- the ssl setting does not change
2- the messages stays at the top of the screen.

I'm using firefox

i just checked /usr/local/www/packages/countryblock/email_send.php

include("class.phpmailer.php");
$mail             = new PHPMailer();

$mail->IsSMTP();
$mail->SMTPAuth   = false;
$mail->SMTPSecure = "ssl";
$mail->Host       = "10.100.100.14";
$mail->Port       = 25;
$mail->Username   = "rob";
$mail->Password   = "****";
$mail->AddReplyTo("root@fbc2.fantinibakery.com","pfsense countryblock");
$mail->From       = "root@fbc2.fantinibakery.com";
$mail->Subject    = "Countryblock - pfsense";
$mail->AltBody    = "To view the message, please use an HTML compatible email viewer!";
$mail->WordWrap   = 50;
$body               = "Countryblock encountered an event. A system log entry was made with details of event";
$body              .= "

" . date('l jS \of F Y h:i:s A') . "

Current Status = ";
ob_start();
$results = exec("pfctl -s rules | grep -c countryblock");
ob_end_clean();
if ($results > '0')
$body              .= "Running";
else
$body              .= "Restarting";

and ssl is set to false.

However and I just checked again - SMTP Auth is 'yes' .

so i from cli:

# php /usr/local/www/packages/countryblock/email_send.php
Content-type: text/html

Warning: fsockopen(): SSL operation failed with code 1\. OpenSSL Error messages:
error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol in /usr/local/www/packages/countryblock/class.smtp.php on line 122

Warning: fsockopen(): php_stream_sock_ssl_activate_with_method: SSL handshake/connection failed in /usr/local/www/packages/countryblock/class.smtp.php on line 122

Warning: fsockopen(): failed to activate SSL mode 1 in /usr/local/www/packages/countryblock/class.smtp.php on line 122
Mailer Error: SMTP Error: Could not connect to SMTP host.#

and the mail server log:

Oct  6 19:01:25 mail postfix/smtpd[18233]: connect from fbc2.fantinibakery.com[10.100.100.2]
Oct  6 19:01:25 mail postfix/smtpd[18233]: lost connection after UNKNOWN from fbc2.fantinibakery.com[10.100.100.2]
Oct  6 19:01:25 mail postfix/smtpd[18233]: disconnect from fbc2.fantinibakery.com[10.100.100.2]