Country Block
-
TB,
With the most recent package I am having a problem when I reboot the firewall. I am on the most current beta as well as of today.
When I reboot, country block will not be running even though the enable country block is checked at the top.
If I click save at the bottom and it refreshes no change. Still blocking 0 networks. Then I uncheck save then recheck and save same thing.
I do have a cron job set of it and when checking the sys logs I see this error.php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '2', the output was '0 table deleted. sed: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory 1 1 rm: /tmp/rules.debug.tmp: No such file or directory sed: /tmp/rules.debug: No such file or directory execute.sh: cannot open /tmp/rules.debug: No such file or directory'
If I reinstall the package, it will start working again. I have duplicated this multiple times this evening when rebooting the firewall.
Any reason why? -
TB,
With the most recent package I am having a problem when I reboot the firewall. I am on the most current beta as well as of today.
When I reboot, country block will not be running even though the enable country block is checked at the top.
If I click save at the bottom and it refreshes no change. Still blocking 0 networks. Then I uncheck save then recheck and save same thing.
I do have a cron job set of it and when checking the sys logs I see this error.php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '2', the output was '0 table deleted. sed: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory grep: /tmp/rules.debug: No such file or directory 1 1 rm: /tmp/rules.debug.tmp: No such file or directory sed: /tmp/rules.debug: No such file or directory execute.sh: cannot open /tmp/rules.debug: No such file or directory'
If I reinstall the package, it will start working again. I have duplicated this multiple times this evening when rebooting the firewall.
Any reason why?If /tmp/rules.debug isn't found then your problem isn't countryblock. Are you running pfsense in transparent mode or is it even a Firewall? /tmp/rules.debug is the file that contains the pf firewall rules.
-
On some systems , /tmp is cleared on reboot .
Try copying some other files to /tmp , reboot and see if they exist after a reboot.
If /tmp is cleared on reboot, then /tmp/rules.debug should be stored in another location. like /var/tmp . on our system /var/tmp is not cleared on reboot.
-
It seems as if this is what is happening. That folder is being cleared upon reboot. I dont have anything specially configured to do that so so something must do that in the beta version when its booting as a startup script.
Does that TMP location pull the rules from elsewhere. The only app that seems to be affected by this is country block. Snort and other packages seem to be working just fine.
TB i have it set as a firewall. Its the Internet facing firewall at my location.
So either this is a change in most recent beta or how the newer package of CB is handling this. It was working ok on an older beta version and the 1.5 cb when I rebooted just fine.
-
Perhaps the startup script is running before your firewall rules are re-created.
Have you tried to manually run Countryblock after the system has booted, from the GUI? -
Yes I have gone into CB and deselected enable CB then clicked the save button at the bottom. (in red it says blocking 0 countries)
Then I re check the enable CB and click save at the bottom and the check now appears in the enable option but there is red text at the bottom that says blocking 0 countries.
There are countries enabled as I use the most spamming ones at the top of the list and says what is it 10 out of x amount enabled.The only way I can get the red text at the bottom to go away and turn into black saying you are currently blocking x countries is to reinstall the package..
-
Yes I have gone into CB and deselected enable CB then clicked the save button at the bottom. (in red it says blocking 0 countries)
Then I re check the enable CB and click save at the bottom and the check now appears in the enable option but there is red text at the bottom that says blocking 0 countries.
There are countries enabled as I use the most spamming ones at the top of the list and says what is it 10 out of x amount enabled.The only way I can get the red text at the bottom to go away and turn into black saying you are currently blocking x countries is to reinstall the package..
I don't really know what could cause that. Just keep in mind that you are using a BETA version of pfsense. There are no reports of this happening on stable versions.
I will get VM copy of the BETA going and take a look. Can you send me your config? PM it to me. -
Right I understand that I am on beta so it may not be a bug in your package persay. I think most of it is the location of the files it is referring to gets wiped. Is it possible to have it store files else where as suggested in a previous post?
On some systems , /tmp is cleared on reboot .
Try copying some other files to /tmp , reboot and see if they exist after a reboot.
If /tmp is cleared on reboot, then /tmp/rules.debug should be stored in another location. like /var/tmp . on our system /var/tmp is not cleared on reboot.
-
Right I understand that I am on beta so it may not be a bug in your package persay. I think most of it is the location of the files it is referring to gets wiped. Is it possible to have it store files else where as suggested in a previous post?
On some systems , /tmp is cleared on reboot .
Try copying some other files to /tmp , reboot and see if they exist after a reboot.
If /tmp is cleared on reboot, then /tmp/rules.debug should be stored in another location. like /var/tmp . on our system /var/tmp is not cleared on reboot.
No, not possible. The firewall config will always be stored in /tmp. This is a pfsense thing and cannot be changed by the user.
-
I am on the last stable version of pfsense 1.2.3 RELEASE with CB version 0.1.9, all is running smooth and very well. The package will restart ok if anything happens, it will e-mail me the alert of an issue. all-and-all it is working good.
I have noticed something and was wondering if there is a way to make CB completely restart on its own in order to obtain updated block IP's. I noticed that my blocked IP list number will not increase or decrease unless I manually click the save/update button on the main page of CB.
This is something I can live with, but I am wondering if anyone else noticed this or maybe has a quick fix?
Thanks,
Matt
-
I am on the last stable version of pfsense 1.2.3 RELEASE with CB version 0.1.9, all is running smooth and very well. The package will restart ok if anything happens, it will e-mail me the alert of an issue. all-and-all it is working good.
I have noticed something and was wondering if there is a way to make CB completely restart on its own in order to obtain updated block IP's. I noticed that my blocked IP list number will not increase or decrease unless I manually click the save/update button on the main page of CB.
This is something I can live with, but I am wondering if anyone else noticed this or maybe has a quick fix?
Thanks,
Matt
Hey Matt,
I can't imagine that country lists update frequently enough to see a visual change. My understanding is those lists barley change over months of time. I never considered this to be a problem. What country changes that frequently? -
I am not really sure what countries are changing and I always whitelist the same IP CIDR's and block everything but the US. I am currently blocking 245 out of 246 Countries in the list. I seen an increase from 67576 to You are blocking 69853 Networks. This number yesterday was 69834 and over the past couple of months it had increased from the 67576 amount.
I was under the same impression that things would rarely if any change because of the lack of availible IPv4 addresses.
Thanks,
Matt
-
Same here. That's impressive that country blocks are changing that frequently. I always thought they were fixed by IANA. Well I don't know what to think. Changing how the package updates shouldn't be a problem. I'm not sure when I can dedicate time to countryblock in the near future. I have many projects that need attention right now.
I added this to my list of things to-do. Thank you for your support! -
Hey I understand how other obligations go. It is something that I can live with, I was just wondering if anyone was seeing this same thing. Thanks again for this great package.
Also, do you know of any other firewall distros that has this kind of ability to block country CIDR's ranges?
Thanks,
Matt
-
IANA says which country gets which IP range, or more accurately which regional authority is in charge of handing them out. IANA does not change them that frequently. Any changes to IPs either bogon, apipa, etc are usually scheduled to be made before they are actually going to be used.
What could of happened is that when you selected the countries, you clicked save before all of them could get applied and lately you waited for it to load before doing a select/unselect and then deselecting US, I had this happen to me, I selected all countries, deselected US and clicked save, not all countries were added because I did not give CB a chance to load them all. Make sure you wait for the page to stop loading before making any changes (Someone was having this issue with IP Blocklist, I saw that Tommy, stated for them to let the page to fully load as well.)
-
What could of happened is that when you selected the countries, you clicked save before all of them could get applied and lately you waited for it to load before doing a select/unselect and then deselecting US, I had this happen to me, I selected all countries, deselected US and clicked save, not all countries were added because I did not give CB a chance to load them all. Make sure you wait for the page to stop loading before making any changes (Someone was having this issue with IP Blocklist, I saw that Tommy, stated for them to let the page to fully load as well.)
For all packages and parts of PfSense that have a delay like this , it would be good to have something more obvious to let us know that an action is occurring.
It would I think be great to have common code that could be used by package maintainers to display something. Or maybe there is a firefox addon to do that. I'll check.ps: -Tom Schaefer - thank you for your work on this package.
-
Yeah I thought of the page taking a bit to load and I did let it load completely. Tommy was able to see the same thing according to his last post. As far as the package goes, it is running really good compared to how it was when I first started using it. Leaps and bounds have been done to get the package at this stable point and I feel Tommy has done an excellent job is such a short period of time. I am sure he will improve this package more, but ROAM was not built in a day.
In general a loading screen or notification when changes are taking effect would be nice, but I can't think of any other packages I am using does this either. I believe http://www.countryipblocks.net/ is where this list are being housed and more and likely I would say they are making changes and corrections?
Tommy, thanks again
-
Yes I have gone into CB and deselected enable CB then clicked the save button at the bottom. (in red it says blocking 0 countries)
Then I re check the enable CB and click save at the bottom and the check now appears in the enable option but there is red text at the bottom that says blocking 0 countries.
There are countries enabled as I use the most spamming ones at the top of the list and says what is it 10 out of x amount enabled.The only way I can get the red text at the bottom to go away and turn into black saying you are currently blocking x countries is to reinstall the package..
I don't really know what could cause that. Just keep in mind that you are using a BETA version of pfsense. There are no reports of this happening on stable versions.
I will get VM copy of the BETA going and take a look. Can you send me your config? PM it to me.TB sorry for such a delay on this. Been really busy. Anyways I had some other issues crop up since i did the beta update when this issue did show up. Long story short I had to start from scratch with todays most recent version of the beta and reconfigure all settings and packages. Since I have done this, everything seems to be working fine. I guess that beta update I did a few days ago screwed some things up. So no need to look into this any farther as it was something that went bad with my setup.
Multipel reboots have been done and all is good. -
That's good news Kilthro. Glad you got it working!
-
Thank you for all the time and hard work that you have put into created this great package Tommyboy.
When i have the Block outbound? check I see a lot source inbound activity being block from the outside in system log, but if i uncheck the Block outbound their is no more activity in the system logs, all interface check, Enable Logging check, Current Status = Running, You are blocking 108212 Networks. its running but was wondering if its blocking inbound connections