IP-Blocklist
-
IPBlocklist works great on 2 of my pfSense boxes.
One other pfSense box is a problem. I can't seem to get IPBlocklist going.
All are pfSense 2.0-BETA4.
The problem box is currently 2.0-BETA4 (i386)
built on Sat Nov 6 00:43:13 EDT 2010On the problem box, I've install IP-Blocklist every couple of months or so (back to pfSense 2.0-BETA1). Problem box remains a problem.
I use FF. The package installs without error.
I then…
1. Paste my list link into the form and press '+'.
( ex: http://iblocklist.charlieprice.org/files/bt_spyware.gz - I've tried several good .gz links.)
2. Check 'Enable IP-Blocklist.
3. Click Save/Update.Then the 'Current List' disappears entirely.
(I can bring it back by pressing '+', but that doesn't effect anything.)My Status is always....
Current Status = Running
You are blocking 0 IPs
I have tried every possible combination of buttons; Save, Save/Update, etc.
I have uninstalled Country Block (the only other package) and tried IPBlocklist by itself.
I have tried rebooting between installs and configs.
I have tried a number of different versions of pfSense 2.0-BETA.My results have been 100% consistent. Status Running - Blocking 0 IPs.
I'm uncertain on what to try, or where to look next.
If you or anyone else, have any thoughts, I'd be grateful to hear them.Thanks.
NVPS - a note:
At one location, spam rates are down by over 50%.
At another; I haven't had a single drive-by malware episode (were regular occurrences).
I credit CountryBlock as an important part of that result.
Thanks again. -
IPBlocklist works great on 2 of my pfSense boxes.
One other pfSense box is a problem. I can't seem to get IPBlocklist going.
All are pfSense 2.0-BETA4.
The problem box is currently 2.0-BETA4 (i386)
built on Sat Nov 6 00:43:13 EDT 2010On the problem box, I've install IP-Blocklist every couple of months or so (back to pfSense 2.0-BETA1). Problem box remains a problem.
I use FF. The package installs without error.
I then…
1. Paste my list link into the form and press '+'.
( ex: http://iblocklist.charlieprice.org/files/bt_spyware.gz - I've tried several good .gz links.)
2. Check 'Enable IP-Blocklist.
3. Click Save/Update.Then the 'Current List' disappears entirely.
(I can bring it back by pressing '+', but that doesn't effect anything.)My Status is always....
Current Status = Running
You are blocking 0 IPs
I have tried every possible combination of buttons; Save, Save/Update, etc.
I have uninstalled Country Block (the only other package) and tried IPBlocklist by itself.
I have tried rebooting between installs and configs.
I have tried a number of different versions of pfSense 2.0-BETA.My results have been 100% consistent. Status Running - Blocking 0 IPs.
I'm uncertain on what to try, or where to look next.
If you or anyone else, have any thoughts, I'd be grateful to hear them.Thanks.
NVPS - a note:
At one location, spam rates are down by over 50%.
At another; I haven't had a single drive-by malware episode (were regular occurrences).
I credit CountryBlock as an important part of that result.
Thanks again.Are all boxes using the same build version? I tested the list and it works fine. The only thing that I can think of is that pfSense 2.0-BETA4 is just that, BETA so I can't vouch for how the package is being handled in that particular version.
I don't have a 2.0BETA4 box to test with so unfortunately you or someone else is going to have to test. I'm glad that SPAM is down and thank you for your support.
I wish I had a better answer for you but I don't have any resources to test 2.0BETA4 right now. -
IPBlocklist works great on 2 of my pfSense boxes.
One other pfSense box is a problem. I can't seem to get IPBlocklist going.
All are pfSense 2.0-BETA4.
The problem box is currently 2.0-BETA4 (i386)
built on Sat Nov 6 00:43:13 EDT 2010 …Are all boxes using the same build version? I tested the list and it works fine. The only thing that I can think of is that pfSense 2.0-BETA4 is just that, BETA so I can't vouch for how the package is being handled in that particular version.
I don't have a 2.0BETA4 box to test with so unfortunately you or someone else is going to have to test. I'm glad that SPAM is down and thank you for your support.
I wish I had a better answer for you but I don't have any resources to test 2.0BETA4 right now.OK. That is an answer, if not precisely one I was fishing for.
FYI, all 3 are different build dates; all within 40 days of now.
Today, I moved the drive from a PIII ThinkPad to a P4 Inspiron and wiped/reloaded pfSense.
After the preliminary setup, I loaded IP-Blocklist as the first package and… same result.At least we know it can work in pfSense 2. I suspect one day we'll also know how.
Thanks for the reply.
NV
-
~~WARNING: Duplicate entries per list cancel out
I just found something that could be a problem if you make your own lists. If you make your own list like I do and you accidentally have a duplicate entry in the list it will cancel out and will not be blocked. This is a bug that is caused by the Perl script that interprets your lists.
Example duplication:
unkn:194.71.107.25-194.71.107.25
ad:194.71.107.25-194.71.107.25This will result in the IP not being blocked. The Fix: Just be careful when creating your own lists. If your paranoid run you "sort happybirthday.txt | uniq
" your lists!Again this will only apply to people that make their own lists. Publishers of official IP lists filter for duplicates for you.~~
This bug is fixed. Duplicate lists are not an issue any longer!
-
I've been having an issue after installing IP-Blocklist. I can download a list (level_1 in my case), but when I check "enable" and "save/update", the machine will throw an error, "Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /etc/inc/util.inc on line 380" 5-10 minutes afterwards. I suspect my machine is at fault since it's an old Dell PII maxed out at 512MB of RAM. The only other addons I'm running are cron, Country Block and Snort. Incidentally, IP-Blocklist was failing before I installed Snort and cron.
Thanks,
Jon -
@nipstech:
I've been having an issue after installing IP-Blocklist. I can download a list (level_1 in my case), but when I check "enable" and "save/update", the machine will throw an error, "Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 35 bytes) in /etc/inc/util.inc on line 380" 5-10 minutes afterwards. I suspect my machine is at fault since it's an old Dell PII maxed out at 512MB of RAM. The only other addons I'm running are cron, Country Block and Snort. Incidentally, IP-Blocklist was failing before I installed Snort and cron.
Thanks,
JonThis has been addressed in the previous posts. Basically just let it run until the "working animation" in your browser stops. For more specifics look back on some previous posts.
-
I waited almost an hour with the fatal error screen and it never changed, however when I closed the browser session and reopened it, it showed that IP-Blocklist was running and was blocking x number of networks. Can I assume that the error can be ignored?
-
@nipstech:
I waited almost an hour with the fatal error screen and it never changed, however when I closed the browser session and reopened it, it showed that IP-Blocklist was running and was blocking x number of networks. Can I assume that the error can be ignored?
This behavior is normal. Did you look at the previous posts like I referred you to?
The previous posts explain that you don't have to wait for an hour, you just wait for the loading animation to finish.
The error can be ignored or fixed.
I love answering your questions and feel free to post any question but I did refer you to read on some past posts within this topic. Had you done that, you would have found your answer a lot sooner and wouldn't have wasted an hour.I'm glad you figured it out and got it working. I'm always looking for suggestion on how I can improve the package. Right now I have a list of things that I need to update soon, so hopefully that will be happen soon for those of you whom have been waiting patiently.
-
Thank You! :)
-
IP-Blocklist 3.0 is out!
Changes:
-
Email Notifications
-
Full BETA2.0 Support (tested on latest build)
-
Interface Filtering
-
Optional Outbound
-
And many bugs fixed!
Thank you all for your support!
-
-
Great! From where can it be downloaded and installed? It's not showing up in the available package list.
-
@nipstech:
Great! From where can it be downloaded and installed? It's not showing up in the available package list.
It's there. Do you have it installed already?
-
This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log. -
This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log.Glad you like it. Outbound doesn't log. I just never got to it. You can modify the script to log outbound on your own if you want. Just edit the script in /usr/local/www/packages/ipblocklist/ and /usr/local/etc/rc.d/ to include logging.
Perhaps I will add it soon as a minor update.
-
This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log.Glad you like it. Outbound doesn't log. I just never got to it. You can modify the script to log outbound on your own if you want. Just edit the script in /usr/local/www/packages/ipblocklist/ and /usr/local/etc/rc.d/ to include logging.
Perhaps I will add it soon as a minor update.
I would love to, but I wasn't able to make any sense of these. I don't know what makes the packet filter log drop rules.
-
This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log.Glad you like it. Outbound doesn't log. I just never got to it. You can modify the script to log outbound on your own if you want. Just edit the script in /usr/local/www/packages/ipblocklist/ and /usr/local/etc/rc.d/ to include logging.
Perhaps I will add it soon as a minor update.
I would love to, but I wasn't able to make any sense of these. I don't know what makes the packet filter log drop rules.
This is only a temporary fix until I update the package:
Sorry about that, I was on my way out the door when I replied. The two files you need to modify are /usr/local/www/packages/ipblocklist/convert-execute.sh and /usr/local/etc/rc.d/IP-Blocklist.shStarting at line 112 look for the line "if [ -f /usr/local/www/packages/ipblocklist/OUTBOUND ]; then"
The next line should have something like "echo "block quick from $i to <ipblocklist>label 'IP-Blocklist'" >> /tmp/rules.debug.tmp"Replace "echo "block quick from $i to <ipblocklist>label 'IP-Blocklist'" >> /tmp/rules.debug.tmp"
with "echo "block log quick from $i to <ipblocklist>label 'IP-Blocklist'" >> /tmp/rules.debug.tmp"So basically replace "block quick from" with "block log quick from"
Keep in mind that this forces logging on your outbound. Sometime in the near future I will push a minor update that will allow logging on IN and OUT traffic depending on your settings.
Note: for convert-execute.sh it's line 113 and for IP-Blocklist.sh it's line 118</ipblocklist></ipblocklist></ipblocklist>
-
Thank you so much, TommyBoy! I needed this to find what was being blocked and preventing me from playing modern warfare 2. =)
[EDIT]
Here is my whitelist to allow Ps3 online play. These were blocked by bt_level1.gz.
store.playstation.com:199.108.4.76-199.108.4.76
ena.net.playstation.net:198.107.158.197-198.107.158.198
ena.net.playstation.net:198.107.158.166-198.107.158.166
xmb.dl.playstation.net:208.111.185.235-208.111.185.235
xmb.dl.playstation.net:208.111.185.249-208.111.185.249 -
Can't uninstall ipblocklist…
I didn't find Countryblock right away, so installed ipblocklist instead...
After that, I found countryblock - and this was what I needed...ipblocklist is uninstalled, but still accessible from within the gui... can I remove it somehow ?
forgot to mention : i'm running it on the 1.2.3 platform, on a dual xeon server.
-
Can't uninstall ipblocklist…
I didn't find Countryblock right away, so installed ipblocklist instead...
After that, I found countryblock - and this was what I needed...ipblocklist is uninstalled, but still accessible from within the gui... can I remove it somehow ?
I think I know the problem. It's due to me changing the naming convention for 1.2.3 so I could push a differnt IP-Blocklist for BETA2.0.
You can edit your config.xml file and edit our the IP-Blocklist portion. Try re-installing and uninstalling if you're uncomfortable with editing your config. -
Don't mind fiddling within CONFIG.XML… I'll try this...
Uninstalling, re-installing and uninstalling didn't help yesterday... so i'll dig into the config.xml - thanks.I'll have to look into CountryBlock too- but I'll post the why's and how's in the other thread later on ;)
thank you for your reply.
-
Beginner problems here.
Usage
Add direct link to list and press (Example: Level1, Level2, Level3)
Compressed lists should have .gz extention and follows PeerBlock syntaxWarning! - Apply after firewall change or state reset. Use at your own risk.
Current Status = Running
You are blocking 0 Networks/IPs
Q: How do I know if the list got applied?
A: The package web interface will display the current status.
Links i've attempted to use
http://list11.iblocklist.com/files/bt_spyware.gz
http://iblocklist.whitacrecomputers.com/files/bt_level3.gz
and several other i've verified are in the correct format including small handmade lists hosted on the LANRunning Pfsense 1.2.3
Other packages installed: Dashboard
built on Sun Dec 6 23:21:36 EST 2009
FreeBSD 7.2-RELEASE-p5 i386Q: I have the "Enable" check box checked but I don't think its blocking any IPs
A: Any Errors will be at the bottom of the page when you press Save/Update
I get no error messages after Save/Update -
Same problem here on 1.2.3 Release
Doesn't block anything
Doesn't uninstall correctly, IP BlockList still available in menugot this in the log: Dec 5 14:05:45 root: IP-Blocklist was found not running
Usage Add direct link to list and press (Example: Level1, Level2, Level3) Compressed lists should have .gz extention and follows PeerBlock syntax Warning! - Apply after firewall change or state reset. Use at your own risk. Current Status = NOT running /tmp/rules.debug:87: cannot load "/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw": No such file or directory You are blocking 0 Networks/IPs
I uninstall, resintalled, uninstalled to no avail.
-
Same problem here on 1.2.3 Release
Doesn't block anything
Doesn't uninstall correctly, IP BlockList still available in menugot this in the log: Dec 5 14:05:45 root: IP-Blocklist was found not running
Usage Add direct link to list and press (Example: Level1, Level2, Level3) Compressed lists should have .gz extention and follows PeerBlock syntax Warning! - Apply after firewall change or state reset. Use at your own risk. Current Status = NOT running /tmp/rules.debug:87: cannot load "/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw": No such file or directory You are blocking 0 Networks/IPs
I uninstall, resintalled, uninstalled to no avail.
Yeah I just checked mine too. Uninstall does nothing
-
I will look into the uninstall problem tonight. As far as getting it running make sure your using direct links to lists. Try using one of the example lists.
-
I tried all three lists on the configuration page to no avail.
-
IP-Blocklist 3.0.1 released!
fixed uninstall problem.
updated perl to 5.12
updated netCIDR to 0.14pfsense 1.2.3 has been tested.
pfsense 2.0BETA not tested.
Completely uninstall IP-Blocklist. If you still have a link for IP-Blocklist then run "rm -R /usr/local/www/packages/ipblocklist" and "rm /usr/local/etc/rc.d/IP-Blocklist.sh" before re-installing 3.0.1
-
You are all kinds of awesome. Started working right away.
Thanks -
-
So I rm the package rm -R /usr/local/www/packages/ipblocklist" and "rm /usr/local/etc/rc.d/IP-Blocklist.sh"
I reinstalled, doesn't block any .gz listRemoved, uninstallation went fine, the menu are not present in Firewall menu :)
Install again, still You are blocking 0 Networks/IPs
I modified /etc/inc/config.inc from 128MB to 256M and /usr/local/lib/php.ini from 32M to 128M
no change (not sure if I have to reboot or not)Uninstall is my next move
-
So I rm the package rm -R /usr/local/www/packages/ipblocklist" and "rm /usr/local/etc/rc.d/IP-Blocklist.sh"
I reinstalled, doesn't block any .gz listRemoved, uninstallation went fine, the menu are not present in Firewall menu :)
Install again, still You are blocking 0 Networks/IPs
I modified /etc/inc/config.inc from 128MB to 256M and /usr/local/lib/php.ini from 32M to 128M
no change (not sure if I have to reboot or not)Uninstall is my next move
Uninstall the package from your package manager page and then re-install. That should do it. The rm -R command was only for those that still had a link after uninstalling and still had the package installed.
-
It seem to working perfectly, without any issues. However, how do I know it's actively blocking in real time, is there's a way to monitor this similar to logfile? I enabled Logging, and I don't see it under Status > System Logs
-
hm, I seem to be failing at everything, lol.
Uninstall IP-Blocklist OK, but link remains.
Executed the CL as suggested above to remove the link, and the link remains (when clicked, 404 - Not Found). Reboot / reinstall / uninstall in any/every order doesn't seem to help, IP-Blocklist 3.0 keeps installing (instead of 3.0.1), and Running, but Blocking = 0 Networks.
-
An old config is preventing you from getting the new version. I forget where the directory is but I think it somewhere near /usr/etc/pkgs or something like that. Just delete everything IP-Blocklist/ipblocklist.
I can't tell for sure since I'm away from home right now (working on my CCENT/CCNA). If you can't get it working let me know, I can probably get a VM of pfsense up if I need to.
-
just a small feature request, can you add this to bottom of whitelist page like "You're currently unblocking #### IPs"
-
Found a cpl ipblockist.* in /usr/local/pkg -deleted them, same prob(s) still exist - no worries though, thanks for the tip :)
-
An old config is preventing you from getting the new version. I forget where the directory is but I think it somewhere near /usr/etc/pkgs or something like that. Just delete everything IP-Blocklist/ipblocklist.
I can't tell for sure since I'm away from home right now (working on my CCENT/CCNA). If you can't get it working let me know, I can probably get a VM of pfsense up if I need to.
Hey good buddy. I was on a wicked old version, like 2.2.1, something like that. I am having no luck getting the latest to work for me. I tried looking all over the fs, using your other awesome package btw, and couldn't find anything in terms of remnants from a past config.
The newest package installs fine, but when I add .gz lists I still have 0 showing for number of blocks with service Running. Any ideas? Thanks again!
-
An old config is preventing you from getting the new version. I forget where the directory is but I think it somewhere near /usr/etc/pkgs or something like that. Just delete everything IP-Blocklist/ipblocklist.
I can't tell for sure since I'm away from home right now (working on my CCENT/CCNA). If you can't get it working let me know, I can probably get a VM of pfsense up if I need to.
Hey good buddy. I was on a wicked old version, like 2.2.1, something like that. I am having no luck getting the latest to work for me. I tried looking all over the fs, using your other awesome package btw, and couldn't find anything in terms of remnants from a past config.
The newest package installs fine, but when I add .gz lists I still have 0 showing for number of blocks with service Running. Any ideas? Thanks again!
I have some ideas. First are you using 1.2.3 or the BETA 2.0? I have been having problems keeping this package working smoothly for those with BETA2.0. Someone was kind enough to agree to send me a laptop for development but unfortunately it hasn't arrived yet.
If you're on 1.2.3 then we should be able to figure it out quickly. Just to confirm you have IP-Blocklist ver 0.3.0 or 0.3.1 correct?
Can you try this .gz file: http://iblocklist.dbnservers.net/files/bt_ads.gz Just to be sure.Edit: By the way thank you for your suggestion for a whitelist feature a long time ago. I hope you can enjoy the package here soon.
-
I was very excited to see the whitelist! I can't wait to start using it. I have been plenty happy with the package so far, as you can tell, I haven't upgraded since I first installed it :)
I am on pfSense 1.2.3 with IP Blocklist 0.3.1 and I did as you suggested, adding this list: http://iblocklist.dbnservers.net/files/bt_ads.gz
Still shows running with 0 blocked.
-
I was very excited to see the whitelist! I can't wait to start using it. I have been plenty happy with the package so far, as you can tell, I haven't upgraded since I first installed it :)
I am on pfSense 1.2.3 with IP Blocklist 0.3.1 and I did as you suggested, adding this list: http://iblocklist.dbnservers.net/files/bt_ads.gz
Still shows running with 0 blocked.
This might be a really stupid question but do you have the enable check box checked before clicking save?
SSH in to your system and check the contents of /usr/local/www/packages/ipblocklist/lists The .gz file should be in that directory if it got downloaded correctly. Also check the contents of /usr/local/www/packages/ipblocklist/lists/ipfw.ipfw and see if there is anything in there.
-
No worries man.
Yes the box is checked to enable.
# ls -l /usr/local/www/packages/ipblocklist/lists total 132 -rw-r--r-- 1 root wheel 133982 Dec 30 18:00 bt_ads -rw-r--r-- 1 root wheel 0 Dec 30 22:25 ipfw.ipfw #