Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IP-Blocklist

    Scheduled Pinned Locked Moved pfSense Packages
    496 Posts 86 Posters 505.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tommyboy180
      last edited by

      @Slab:

      @wm408:

      Did we ever resolve the IP Blocklist service having this:

      Current Status = NOT running

      You are blocking 0 Networks/IPs

      Even though the "Enable IP-Blocklist" is checked?  It seems to happen after some period of time… haven't figured out how long, usually I check each day and it seems consistent.

      I'm using embedded, don't know if its specific to this. (1.2.3-release)

      Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

      I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

      I'll look into this today hopefully.

      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • S
        seggerman
        last edited by

        Tommyboy, all

        it seems as if IPblocklist is working for everybody except for me  :-[ … I currently have two issues:

        1. email settings
          see: ipblocklist_1.png

        I've set all parameters, but when I hit "test" I get the error
        [code]Warning: fsockopen(): unable to connect to none://smtp.1und1.de:25 (Unable to find the socket transport "none" - did you forget to enable it when you configured PHP?) in /usr/local/www/packages/ipblocklist/class.smtp.php on line 122 Mailer Error: SMTP Error: Could not connect to SMTP host.

        I solved this problem by commenting

        //$mail->SMTPSecure = "none";
        

        in the email_send.php file

        1. Interface settings:
          I have in the interfaces.txt file "any", so all interfaces should be activated. Looking at the interfaces tab I get:
          see: ipblocklist_if.png

        strangely only the LAN interface is available. Going into the ipblocklist_if.php file I modified a few lines of code

                           $portinfo): ?>
        $comma_array=implode(",",$iface);
        echo "$portname - $comma_array 
        ";
        ?>
        
        

        so that I can see exactly the $iface definitions and I get:
        see: ipblocklist_if_new.png

        the checking of the interface goes against the physical interface address, instead of pppoe0
        The question is if the blocking of the IP-addresses still occur even if the interface tab is "messed up".

        I'm currently running on Current version: 2.0-RC1 - Built On: Sat Mar 12 01:18:33 EST 2011

        Hope someone can help me out.

        Cheers + Regards

        Alexander

        ipblocklist_if_new.png_thumb
        ipblocklist_if_new.png
        ipblocklist_if.png_thumb
        ipblocklist_if.png
        ipblocklist_1.png_thumb
        ipblocklist_1.png

        1 Reply Last reply Reply Quote 0
        • T
          tommyboy180
          last edited by

          seggerman,

          Hopefully I can get into it more. Right now I don't have a 2.0 RC1 install. I'm working on getting mine going. Soon I will be able to fully support your issue.

          EDIT:

          I just got 2.0RC1 running. 2.0-RC1 (i386) built on Tue Mar 15 08:53:58 EDT 2011.

          I installed the package and everything is good. I would try re-moving the package and re-installing. See if that helps.

          -Tom Schaefer
          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

          Please support pfBlocker | File Browser | Strikeback

          1 Reply Last reply Reply Quote 0
          • S
            Slab
            last edited by

            @Slab:

            Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

            I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

            After a bit of experimentation, I've been able to isolate what appears to cause IP-Blocklist to change to a disabled state. It happens every time the pfSense filter gets reloaded (at least it does with my install). If I select 'Filter Reload' in the Status menu (and then press the 'Reload Filter' button), IP-Blocklist will change to a disabled state. Presumably this will happen when the filter periodically/automatically reloads. Thx…

            1 Reply Last reply Reply Quote 0
            • T
              tommyboy180
              last edited by

              @Slab:

              @Slab:

              Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

              I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

              After a bit of experimentation, I've been able to isolate what appears to cause IP-Blocklist to change to a disabled state. It happens every time the pfSense filter gets reloaded (at least it does with my install). If I select 'Filter Reload' in the Status menu (and then press the 'Reload Filter' button), IP-Blocklist will change to a disabled state. Presumably this will happen when the filter periodically/automatically reloads. Thx…

              Correct. This is one of the down sides to the package as it 'injects' the pfctl tables into the firewall rules. This is the way the package has always been. I have been looking for a way to make the package more resilient however I have not found that method as of yet. Perhaps I need to start talking to some of the senior devs to find this solution.

              -Tom Schaefer
              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

              Please support pfBlocker | File Browser | Strikeback

              1 Reply Last reply Reply Quote 0
              • B
                bubba
                last edited by

                Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

                I have not installed any other packages besides ipblocklist
                I can add list url using the http://iblocklist….gz links
                But when I check enable ip-blocklist and save/update nothing happens
                If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
                I know this is an issue as I see it discussed here, I have tried:
                reinstalling the package
                uninstall, reboot, install the package
                edit a firewall rule, save, enable ip-blocklist
                edit a firewall rule, save, reboot, enable ip-blocklist
                Ran pfsense updates to the current update
                uninstall, reinstall ip-blocklist package after running the updates.
                Reboot, resave, etc.

                Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
                Thanks!

                1 Reply Last reply Reply Quote 0
                • S
                  Supermule Banned
                  last edited by

                  Using FF or IE??

                  @bubba:

                  Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

                  I have not installed any other packages besides ipblocklist
                  I can add list url using the http://iblocklist….gz links
                  But when I check enable ip-blocklist and save/update nothing happens
                  If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
                  I know this is an issue as I see it discussed here, I have tried:
                  reinstalling the package
                  uninstall, reboot, install the package
                  edit a firewall rule, save, enable ip-blocklist
                  edit a firewall rule, save, reboot, enable ip-blocklist
                  Ran pfsense updates to the current update
                  uninstall, reinstall ip-blocklist package after running the updates.
                  Reboot, resave, etc.

                  Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
                  Thanks!

                  1 Reply Last reply Reply Quote 0
                  • B
                    bubba
                    last edited by

                    ahhhh no kidding! IE. I just went into FF and it's working beautifully! wow thanks!  ;D

                    @Supermule:

                    Using FF or IE??

                    @bubba:

                    Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

                    I have not installed any other packages besides ipblocklist
                    I can add list url using the http://iblocklist….gz links
                    But when I check enable ip-blocklist and save/update nothing happens
                    If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
                    I know this is an issue as I see it discussed here, I have tried:
                    reinstalling the package
                    uninstall, reboot, install the package
                    edit a firewall rule, save, enable ip-blocklist
                    edit a firewall rule, save, reboot, enable ip-blocklist
                    Ran pfsense updates to the current update
                    uninstall, reinstall ip-blocklist package after running the updates.
                    Reboot, resave, etc.

                    Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
                    Thanks!

                    1 Reply Last reply Reply Quote 0
                    • B
                      bubba
                      last edited by

                      ok maybe another dumb question but…
                      I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

                      My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
                      I have the following lists:
                      http://iblocklist.dbnservers.net/files/bt_spyware.gz
                      http://iblocklist.rlcassidy.net/files/bt_ads.gz
                      http://ibl.gamechaser.net/files/bt_level2.gz
                      http://iblocklist.rlcassidy.net/files/bt_level3.gz
                      http://iblocklist.dbnservers.net/files/bt_level1.gz

                      So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

                      Thanks in advance!

                      1 Reply Last reply Reply Quote 0
                      • S
                        Slab
                        last edited by

                        @bubba:

                        ok maybe another dumb question but…
                        I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

                        My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
                        I have the following lists:
                        http://iblocklist.dbnservers.net/files/bt_spyware.gz
                        http://iblocklist.rlcassidy.net/files/bt_ads.gz
                        http://ibl.gamechaser.net/files/bt_level2.gz
                        http://iblocklist.rlcassidy.net/files/bt_level3.gz
                        http://iblocklist.dbnservers.net/files/bt_level1.gz

                        So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

                        Thanks in advance!

                        Just a guess …but perhaps peerblock is giving you the total IP addresses in each subnet that is blocked in addition to any individual IP addresses that may be blocked, while IP-Blocklist is only counting each subnet (not the address totals within each subnet) plus any individual IP addresses that may be blocked...

                        1 Reply Last reply Reply Quote 0
                        • T
                          tommyboy180
                          last edited by

                          @Slab:

                          @bubba:

                          ok maybe another dumb question but…
                          I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

                          My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
                          I have the following lists:
                          http://iblocklist.dbnservers.net/files/bt_spyware.gz
                          http://iblocklist.rlcassidy.net/files/bt_ads.gz
                          http://ibl.gamechaser.net/files/bt_level2.gz
                          http://iblocklist.rlcassidy.net/files/bt_level3.gz
                          http://iblocklist.dbnservers.net/files/bt_level1.gz

                          So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

                          Thanks in advance!

                          Just a guess …but perhaps peerblock is giving you the total IP addresses in each subnet that is blocked in addition to any individual IP addresses that may be blocked, while IP-Blocklist is only counting each subnet (not the address totals within each subnet) plus any individual IP addresses that may be blocked...

                          That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
                          You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

                          -Tom Schaefer
                          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                          Please support pfBlocker | File Browser | Strikeback

                          1 Reply Last reply Reply Quote 0
                          • B
                            bubba
                            last edited by

                            ok thanks. So it would be best to keep running peerblock then as well I assume…

                            One other problem I'm having is when Level1 list is running and I go to yahoo.ca or yahoo.com I cannot perform a search (on both IE and FF). If I delete level1 it works. So as an experiment I added "Search Engines" http://list.iblocklist.com/?list=pfefqteoxlfzopecdtyw to the whitelist. Now yahoo is functioning just fine. So is this ok to use something that is meant to be blocked as something to allow? Anyone have issues with yahoo and level1 list? Is there a better list I should use to make search engines work? I'd prefer not to have to create one.

                            @tommyboy180:

                            That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
                            You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

                            1 Reply Last reply Reply Quote 0
                            • T
                              tommyboy180
                              last edited by

                              @bubba:

                              ok thanks. So it would be best to keep running peerblock then as well I assume…

                              One other problem I'm having is when Level1 list is running and I go to yahoo.ca or yahoo.com I cannot perform a search (on both IE and FF). If I delete level1 it works. So as an experiment I added "Search Engines" http://list.iblocklist.com/?list=pfefqteoxlfzopecdtyw to the whitelist. Now yahoo is functioning just fine. So is this ok to use something that is meant to be blocked as something to allow? Anyone have issues with yahoo and level1 list? Is there a better list I should use to make search engines work? I'd prefer not to have to create one.

                              @tommyboy180:

                              That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
                              You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

                              It wouldn't hurt to keep running peerblock but I think you misunderstood. Some of the outbound traffic will try to go to the blocked IP addresses. This is because of the peer sources and data that torrents give your torrent client to talk to other peers. So your peerblock will log those outbound attempts even though the IP-Blocklist package will still block those packets. You're covered either way. If you're paranoid then just run both.

                              As far as the yahoo thing goes, sure that's fine. That's what the whitelist is for. If yahoo is being blocked in the level1 and you need access then keep using the search engine list for your whitelist. That's the proper way of doing things. It's like permanently allowing yahoo within your peerblock. I do the same for banking sites and alike.

                              Take care!

                              -Tom Schaefer
                              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                              Please support pfBlocker | File Browser | Strikeback

                              1 Reply Last reply Reply Quote 0
                              • M
                                mxx
                                last edited by

                                Hi,

                                does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
                                Something like a list for blocking known torrent trackers or something like that?

                                I searched and searched the net but all I could find was related to the opposite.

                                Thank you very much!

                                1 Reply Last reply Reply Quote 0
                                • T
                                  tommyboy180
                                  last edited by

                                  @mxx:

                                  Hi,

                                  does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
                                  Something like a list for blocking known torrent trackers or something like that?

                                  I searched and searched the net but all I could find was related to the opposite.

                                  Thank you very much!

                                  Level1 List is exactly that.

                                  -Tom Schaefer
                                  SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                  Please support pfBlocker | File Browser | Strikeback

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mxx
                                    last edited by

                                    Oh, thank you! I must have confused something in that description then. Will take another look.
                                    Sorry to have asked the obvious..

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      mxx
                                      last edited by

                                      @tommyboy180:

                                      @mxx:

                                      Hi,

                                      does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
                                      Something like a list for blocking known torrent trackers or something like that?

                                      I searched and searched the net but all I could find was related to the opposite.

                                      Thank you very much!

                                      Level1 List is exactly that.

                                      Hmm..

                                      is this it?

                                      List name: level1
                                      Author: Bluetack
                                      Author's website: bluetack.co.uk
                                      Author's description:
                                      Companies or organizations who are clearly involved with trying to stop filesharing.
                                      Companies which anti-p2p activity has been seen from.
                                      Companies that produce or have a strong financial interest in copyrighted material.
                                      Government ranges or companies that have a strong financial interest in doing work for governments.
                                      Legal industry ranges.
                                      IPs or ranges of ISPs from which anti-p2p activity has been observed.

                                      So judging from its description it's a p2p enhancing blocklist, not designed to BLOCK FILESHARING (or at least make it more difficult).

                                      I'm looking for a list that carries ip's of -for example- known torrent tracker sites and block that…

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tommyboy180
                                        last edited by

                                        @mxx:

                                        @tommyboy180:

                                        @mxx:

                                        Hi,

                                        does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
                                        Something like a list for blocking known torrent trackers or something like that?

                                        I searched and searched the net but all I could find was related to the opposite.

                                        Thank you very much!

                                        Level1 List is exactly that.

                                        Hmm..

                                        is this it?

                                        List name: level1
                                        Author: Bluetack
                                        Author's website: bluetack.co.uk
                                        Author's description:
                                        Companies or organizations who are clearly involved with trying to stop filesharing.
                                        Companies which anti-p2p activity has been seen from.
                                        Companies that produce or have a strong financial interest in copyrighted material.
                                        Government ranges or companies that have a strong financial interest in doing work for governments.
                                        Legal industry ranges.
                                        IPs or ranges of ISPs from which anti-p2p activity has been observed.

                                        So judging from its description it's a p2p enhancing blocklist, not designed to BLOCK FILESHARING (or at least make it more difficult).

                                        I'm looking for a list that carries ip's of -for example- known torrent tracker sites and block that…

                                        lol. I completely miss understood you. You want a list that blocks P2P, correct?

                                        Not sure. I guess you would have to google that. Pfsense 2.0 has layer 7 support so you will be able to block all P2P without using a list. This may be the better solution for you.

                                        -Tom Schaefer
                                        SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                        Please support pfBlocker | File Browser | Strikeback

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          mxx
                                          last edited by

                                          ;)

                                          The problem is that layer7 doesn't work properly on 2.0 yet..
                                          Also it would be nice to have some additional options to reduce p2p to a minimum…

                                          I can't believe there's no blocklist for that.. well I couldn't find one..

                                          Please, if someone knows anything, help me out ;)

                                          Thank you!

                                          Max

                                          1 Reply Last reply Reply Quote 0
                                          • L
                                            larathydo
                                            last edited by

                                            Hey All,

                                            Just installed PFSense (2.0-RC1 (i386), built on Wed Apr 6 23:30:13 EDT 2011) and tried to install the IP-Blocklist package through the GUI package installer.

                                            No matter what I do, it always is showing "You are blocking 0 Networks/IPs". I've tried using the official 'level' lists which are mentioned on the configuration page:

                                            http://iblocklist.whitacrecomputers.com/files/bt_level1.gz
                                            http://iblocklist.whitacrecomputers.com/files/bt_level2.gz
                                            http://iblocklist.whitacrecomputers.com/files/bt_level3.gz

                                            In addition, i've tried using the lists located here: http://www.iblocklist.com/lists.php. I make sure when entering in the address that I do so with the full path to the .gz file itself.

                                            I've tried uninstalling, reinstalling again, reinstalling the package & GUI components (from the package management page). All the while, logging is enabled and yet under Status > System Logs, i see no issues or warnings being generated by the package. Every time I check the status of the package (I.E. "You are blocking 0 Networks/IPs") the package is always listed as being in a "Running" state.

                                            Any suggestions / help? I have no idea what is wrong…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.