Country Block
-
Way to go TB on the CB. Your updates have been fast and great with awsome enhancements. I do have a request. Is there a way to maintain your saved settings after doing updates. I will always have to put the CIDR back in my whitelist. I whitelist all the BlackBerry RIM IP's and was wondering if there was a way to maintain youe whitelist in between updates?
Thanks again for this awsome package. I do agree it really adds a lot of value to pfsense. Not many firewalls out there that I know of can do this. And please if anyone can think of another firewall that has the ability to do this, please tell.
Thanks,
Matt
The file that holds your whitelist settings is /usr/local/www/packages/countryblock/whitelist.txt You can save that file and re-upload it after your updates to preserve your settings.
Thank you for your support! -
No updates for 48 hours? Hope your all right ;)
-
LOL. Yeah he has been pumping the updates out like crazy. This last update seems to be rock solid for me. Also Tommy, I appreciate the insight on the whitelist.
Thanks,
-
LOL. Yeah he has been pumping the updates out like crazy. This last update seems to be rock solid for me. Also Tommy, I appreciate the insight on the whitelist.
Thanks,
Thank you for the support! I don't think I will be pushing any countryblock updates in the near future. I need fix some other projects for the mean time and hopefully get some IPblocklist updates out there.
-
TB,
With the most recent package I am having a problem when I reboot the firewall. I am on the most current beta as well as of today.
When I reboot, country block will not be running even though the enable country block is checked at the top.
If I click save at the bottom and it refreshes no change. Still blocking 0 networks. Then I uncheck save then recheck and save same thing.
I do have a cron job set of it and when checking the sys logs I see this error.php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '2', the output was '0 table deleted. sed: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory 1 1 rm: /tmp/rules.debug.tmp: No such file or directory sed: /tmp/rules.debug: No such file or directory execute.sh: cannot open /tmp/rules.debug: No such file or directory'
If I reinstall the package, it will start working again. I have duplicated this multiple times this evening when rebooting the firewall.
Any reason why? -
TB,
With the most recent package I am having a problem when I reboot the firewall. I am on the most current beta as well as of today.
When I reboot, country block will not be running even though the enable country block is checked at the top.
If I click save at the bottom and it refreshes no change. Still blocking 0 networks. Then I uncheck save then recheck and save same thing.
I do have a cron job set of it and when checking the sys logs I see this error.php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '2', the output was '0 table deleted. sed: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory 1 1 rm: /tmp/rules.debug.tmp: No such file or directory sed: /tmp/rules.debug: No such file or directory execute.sh: cannot open /tmp/rules.debug: No such file or directory'
If I reinstall the package, it will start working again. I have duplicated this multiple times this evening when rebooting the firewall.
Any reason why?If /tmp/rules.debug isn't found then your problem isn't countryblock. Are you running pfsense in transparent mode or is it even a Firewall? /tmp/rules.debug is the file that contains the pf firewall rules.
-
On some systems , /tmp is cleared on reboot .
Try copying some other files to /tmp , reboot and see if they exist after a reboot.
If /tmp is cleared on reboot, then /tmp/rules.debug should be stored in another location. like /var/tmp . on our system /var/tmp is not cleared on reboot.
-
It seems as if this is what is happening. That folder is being cleared upon reboot. I dont have anything specially configured to do that so so something must do that in the beta version when its booting as a startup script.
Does that TMP location pull the rules from elsewhere. The only app that seems to be affected by this is country block. Snort and other packages seem to be working just fine.
TB i have it set as a firewall. Its the Internet facing firewall at my location.
So either this is a change in most recent beta or how the newer package of CB is handling this. It was working ok on an older beta version and the 1.5 cb when I rebooted just fine.
-
Perhaps the startup script is running before your firewall rules are re-created.
Have you tried to manually run Countryblock after the system has booted, from the GUI? -
Yes I have gone into CB and deselected enable CB then clicked the save button at the bottom. (in red it says blocking 0 countries)
Then I re check the enable CB and click save at the bottom and the check now appears in the enable option but there is red text at the bottom that says blocking 0 countries.
There are countries enabled as I use the most spamming ones at the top of the list and says what is it 10 out of x amount enabled.The only way I can get the red text at the bottom to go away and turn into black saying you are currently blocking x countries is to reinstall the package..
-
Yes I have gone into CB and deselected enable CB then clicked the save button at the bottom. (in red it says blocking 0 countries)
Then I re check the enable CB and click save at the bottom and the check now appears in the enable option but there is red text at the bottom that says blocking 0 countries.
There are countries enabled as I use the most spamming ones at the top of the list and says what is it 10 out of x amount enabled.The only way I can get the red text at the bottom to go away and turn into black saying you are currently blocking x countries is to reinstall the package..
I don't really know what could cause that. Just keep in mind that you are using a BETA version of pfsense. There are no reports of this happening on stable versions.
I will get VM copy of the BETA going and take a look. Can you send me your config? PM it to me. -
Right I understand that I am on beta so it may not be a bug in your package persay. I think most of it is the location of the files it is referring to gets wiped. Is it possible to have it store files else where as suggested in a previous post?
On some systems , /tmp is cleared on reboot .
Try copying some other files to /tmp , reboot and see if they exist after a reboot.
If /tmp is cleared on reboot, then /tmp/rules.debug should be stored in another location. like /var/tmp . on our system /var/tmp is not cleared on reboot.
-
Right I understand that I am on beta so it may not be a bug in your package persay. I think most of it is the location of the files it is referring to gets wiped. Is it possible to have it store files else where as suggested in a previous post?
On some systems , /tmp is cleared on reboot .
Try copying some other files to /tmp , reboot and see if they exist after a reboot.
If /tmp is cleared on reboot, then /tmp/rules.debug should be stored in another location. like /var/tmp . on our system /var/tmp is not cleared on reboot.
No, not possible. The firewall config will always be stored in /tmp. This is a pfsense thing and cannot be changed by the user.
-
I am on the last stable version of pfsense 1.2.3 RELEASE with CB version 0.1.9, all is running smooth and very well. The package will restart ok if anything happens, it will e-mail me the alert of an issue. all-and-all it is working good.
I have noticed something and was wondering if there is a way to make CB completely restart on its own in order to obtain updated block IP's. I noticed that my blocked IP list number will not increase or decrease unless I manually click the save/update button on the main page of CB.
This is something I can live with, but I am wondering if anyone else noticed this or maybe has a quick fix?
Thanks,
Matt
-
I am on the last stable version of pfsense 1.2.3 RELEASE with CB version 0.1.9, all is running smooth and very well. The package will restart ok if anything happens, it will e-mail me the alert of an issue. all-and-all it is working good.
I have noticed something and was wondering if there is a way to make CB completely restart on its own in order to obtain updated block IP's. I noticed that my blocked IP list number will not increase or decrease unless I manually click the save/update button on the main page of CB.
This is something I can live with, but I am wondering if anyone else noticed this or maybe has a quick fix?
Thanks,
Matt
Hey Matt,
I can't imagine that country lists update frequently enough to see a visual change. My understanding is those lists barley change over months of time. I never considered this to be a problem. What country changes that frequently? -
I am not really sure what countries are changing and I always whitelist the same IP CIDR's and block everything but the US. I am currently blocking 245 out of 246 Countries in the list. I seen an increase from 67576 to You are blocking 69853 Networks. This number yesterday was 69834 and over the past couple of months it had increased from the 67576 amount.
I was under the same impression that things would rarely if any change because of the lack of availible IPv4 addresses.
Thanks,
Matt
-
Same here. That's impressive that country blocks are changing that frequently. I always thought they were fixed by IANA. Well I don't know what to think. Changing how the package updates shouldn't be a problem. I'm not sure when I can dedicate time to countryblock in the near future. I have many projects that need attention right now.
I added this to my list of things to-do. Thank you for your support! -
Hey I understand how other obligations go. It is something that I can live with, I was just wondering if anyone was seeing this same thing. Thanks again for this great package.
Also, do you know of any other firewall distros that has this kind of ability to block country CIDR's ranges?
Thanks,
Matt
-
IANA says which country gets which IP range, or more accurately which regional authority is in charge of handing them out. IANA does not change them that frequently. Any changes to IPs either bogon, apipa, etc are usually scheduled to be made before they are actually going to be used.
What could of happened is that when you selected the countries, you clicked save before all of them could get applied and lately you waited for it to load before doing a select/unselect and then deselecting US, I had this happen to me, I selected all countries, deselected US and clicked save, not all countries were added because I did not give CB a chance to load them all. Make sure you wait for the page to stop loading before making any changes (Someone was having this issue with IP Blocklist, I saw that Tommy, stated for them to let the page to fully load as well.)
-
What could of happened is that when you selected the countries, you clicked save before all of them could get applied and lately you waited for it to load before doing a select/unselect and then deselecting US, I had this happen to me, I selected all countries, deselected US and clicked save, not all countries were added because I did not give CB a chance to load them all. Make sure you wait for the page to stop loading before making any changes (Someone was having this issue with IP Blocklist, I saw that Tommy, stated for them to let the page to fully load as well.)
For all packages and parts of PfSense that have a delay like this , it would be good to have something more obvious to let us know that an action is occurring.
It would I think be great to have common code that could be used by package maintainers to display something. Or maybe there is a firefox addon to do that. I'll check.ps: -Tom Schaefer - thank you for your work on this package.