IP-Blocklist

tommyboy180

@nipstech:

Great! From where can it be downloaded and installed? It's not showing up in the available package list.

It's there. Do you have it installed already?

gsgleason

This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log.

tommyboy180

@gsgleason:

This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log.

Glad you like it. Outbound doesn't log. I just never got to it. You can modify the script to log outbound on your own if you want. Just edit the script in /usr/local/www/packages/ipblocklist/ and /usr/local/etc/rc.d/ to include logging.

Perhaps I will add it soon as a minor update.

gsgleason

@tommyboy180:

@gsgleason:

This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log.

Glad you like it. Outbound doesn't log. I just never got to it. You can modify the script to log outbound on your own if you want. Just edit the script in /usr/local/www/packages/ipblocklist/ and /usr/local/etc/rc.d/ to include logging.

Perhaps I will add it soon as a minor update.

I would love to, but I wasn't able to make any sense of these. I don't know what makes the packet filter log drop rules.

tommyboy180

@gsgleason:

@tommyboy180:

@gsgleason:

This is awesome. Thanks so much! The new whitelist is great - it's exactly what I was hoping for.
One thing, though: outbound blocks aren't logging. Should they? The setting is set to log.

Glad you like it. Outbound doesn't log. I just never got to it. You can modify the script to log outbound on your own if you want. Just edit the script in /usr/local/www/packages/ipblocklist/ and /usr/local/etc/rc.d/ to include logging.

Perhaps I will add it soon as a minor update.

I would love to, but I wasn't able to make any sense of these. I don't know what makes the packet filter log drop rules.

This is only a temporary fix until I update the package:
Sorry about that, I was on my way out the door when I replied. The two files you need to modify are /usr/local/www/packages/ipblocklist/convert-execute.sh and /usr/local/etc/rc.d/IP-Blocklist.sh

Starting at line 112 look for the line "if [ -f /usr/local/www/packages/ipblocklist/OUTBOUND ]; then"
The next line should have something like "echo "block quick from $i to <ipblocklist>label 'IP-Blocklist'" >> /tmp/rules.debug.tmp"

Replace "echo "block quick from $i to <ipblocklist>label 'IP-Blocklist'" >> /tmp/rules.debug.tmp"
with "echo "block log quick from $i to <ipblocklist>label 'IP-Blocklist'" >> /tmp/rules.debug.tmp"

So basically replace "block quick from" with "block log quick from"

Keep in mind that this forces logging on your outbound. Sometime in the near future I will push a minor update that will allow logging on IN and OUT traffic depending on your settings.

Note: for convert-execute.sh it's line 113 and for IP-Blocklist.sh it's line 118</ipblocklist></ipblocklist></ipblocklist>

gsgleason

Thank you so much, TommyBoy! I needed this to find what was being blocked and preventing me from playing modern warfare 2. =)

[EDIT]

Here is my whitelist to allow Ps3 online play. These were blocked by bt_level1.gz.

store.playstation.com:199.108.4.76-199.108.4.76
ena.net.playstation.net:198.107.158.197-198.107.158.198
ena.net.playstation.net:198.107.158.166-198.107.158.166
xmb.dl.playstation.net:208.111.185.235-208.111.185.235
xmb.dl.playstation.net:208.111.185.249-208.111.185.249

woodmouze

Can't uninstall ipblocklist…
I didn't find Countryblock right away, so installed ipblocklist instead...
After that, I found countryblock - and this was what I needed...

ipblocklist is uninstalled, but still accessible from within the gui... can I remove it somehow ?

forgot to mention : i'm running it on the 1.2.3 platform, on a dual xeon server.

tommyboy180

@woodmouze:

Can't uninstall ipblocklist…
I didn't find Countryblock right away, so installed ipblocklist instead...
After that, I found countryblock - and this was what I needed...

ipblocklist is uninstalled, but still accessible from within the gui... can I remove it somehow ?

I think I know the problem. It's due to me changing the naming convention for 1.2.3 so I could push a differnt IP-Blocklist for BETA2.0.
You can edit your config.xml file and edit our the IP-Blocklist portion. Try re-installing and uninstalling if you're uncomfortable with editing your config.

woodmouze

Don't mind fiddling within CONFIG.XML… I'll try this...
Uninstalling, re-installing and uninstalling didn't help yesterday... so i'll dig into the config.xml - thanks.

I'll have to look into CountryBlock too- but I'll post the why's and how's in the other thread later on ;)

thank you for your reply.

greengolftee87

Beginner problems here.

Usage
Add direct link to list and press (Example: Level1, Level2, Level3)
Compressed lists should have .gz extention and follows PeerBlock syntax

Warning! - Apply after firewall change or state reset. Use at your own risk.

Current Status = Running

You are blocking 0 Networks/IPs

Q: How do I know if the list got applied?
A: The package web interface will display the current status.
Links i've attempted to use
http://list11.iblocklist.com/files/bt_spyware.gz
http://iblocklist.whitacrecomputers.com/files/bt_level3.gz
and several other i've verified are in the correct format including small handmade lists hosted on the LAN

Running Pfsense 1.2.3
Other packages installed: Dashboard
built on Sun Dec 6 23:21:36 EST 2009
FreeBSD 7.2-RELEASE-p5 i386

Q: I have the "Enable" check box checked but I don't think its blocking any IPs
A: Any Errors will be at the bottom of the page when you press Save/Update
I get no error messages after Save/Update

RonpfS

Same problem here on 1.2.3 Release
Doesn't block anything
Doesn't uninstall correctly, IP BlockList still available in menu

got this in the log: Dec 5 14:05:45 root: IP-Blocklist was found not running

Usage
Add direct link to list and press (Example: Level1, Level2, Level3)
Compressed lists should have .gz extention and follows PeerBlock syntax

Warning! - Apply after firewall change or state reset. Use at your own risk.

Current Status = NOT running
/tmp/rules.debug:87: cannot load "/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw": No such file or directory
You are blocking 0 Networks/IPs

I uninstall, resintalled, uninstalled to no avail.

greengolftee87

@RonpfS:

Same problem here on 1.2.3 Release
Doesn't block anything
Doesn't uninstall correctly, IP BlockList still available in menu

got this in the log: Dec 5 14:05:45 root: IP-Blocklist was found not running
Usage
Add direct link to list and press (Example: Level1, Level2, Level3)
Compressed lists should have .gz extention and follows PeerBlock syntax

Warning! - Apply after firewall change or state reset. Use at your own risk.

Current Status = NOT running
/tmp/rules.debug:87: cannot load "/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw": No such file or directory
You are blocking 0 Networks/IPs
I uninstall, resintalled, uninstalled to no avail.

Yeah I just checked mine too. Uninstall does nothing

tommyboy180

I will look into the uninstall problem tonight. As far as getting it running make sure your using direct links to lists. Try using one of the example lists.

greengolftee87

I tried all three lists on the configuration page to no avail.

tommyboy180

IP-Blocklist 3.0.1 released!

fixed uninstall problem.
updated perl to 5.12
updated netCIDR to 0.14

pfsense 1.2.3 has been tested.

pfsense 2.0BETA not tested.

Completely uninstall IP-Blocklist. If you still have a link for IP-Blocklist then run "rm -R /usr/local/www/packages/ipblocklist" and "rm /usr/local/etc/rc.d/IP-Blocklist.sh" before re-installing 3.0.1

greengolftee87

You are all kinds of awesome. Started working right away.
Thanks

tommyboy180

@greengolftee87:

You are all kinds of awesome. Started working right away.
Thanks

Glad to hear it!

RonpfS

So I rm the package rm -R /usr/local/www/packages/ipblocklist" and "rm /usr/local/etc/rc.d/IP-Blocklist.sh"
I reinstalled, doesn't block any .gz list

Removed, uninstallation went fine, the menu are not present in Firewall menu :)

Install again, still You are blocking 0 Networks/IPs

I modified /etc/inc/config.inc from 128MB to 256M and /usr/local/lib/php.ini from 32M to 128M
no change (not sure if I have to reboot or not)

Uninstall is my next move

tommyboy180

@RonpfS:

So I rm the package rm -R /usr/local/www/packages/ipblocklist" and "rm /usr/local/etc/rc.d/IP-Blocklist.sh"
I reinstalled, doesn't block any .gz list

Removed, uninstallation went fine, the menu are not present in Firewall menu :)

Install again, still You are blocking 0 Networks/IPs

I modified /etc/inc/config.inc from 128MB to 256M and /usr/local/lib/php.ini from 32M to 128M
no change (not sure if I have to reboot or not)

Uninstall is my next move

Uninstall the package from your package manager page and then re-install. That should do it. The rm -R command was only for those that still had a link after uninstalling and still had the package installed.

firestrife23

It seem to working perfectly, without any issues. However, how do I know it's actively blocking in real time, is there's a way to monitor this similar to logfile? I enabled Logging, and I don't see it under Status > System Logs