IP-Blocklist

Slab

Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

After a bit of experimentation, I've been able to isolate what appears to cause IP-Blocklist to change to a disabled state. It happens every time the pfSense filter gets reloaded (at least it does with my install). If I select 'Filter Reload' in the Status menu (and then press the 'Reload Filter' button), IP-Blocklist will change to a disabled state. Presumably this will happen when the filter periodically/automatically reloads. Thx…

tommyboy180

@Slab:

@Slab:

Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

After a bit of experimentation, I've been able to isolate what appears to cause IP-Blocklist to change to a disabled state. It happens every time the pfSense filter gets reloaded (at least it does with my install). If I select 'Filter Reload' in the Status menu (and then press the 'Reload Filter' button), IP-Blocklist will change to a disabled state. Presumably this will happen when the filter periodically/automatically reloads. Thx…

Correct. This is one of the down sides to the package as it 'injects' the pfctl tables into the firewall rules. This is the way the package has always been. I have been looking for a way to make the package more resilient however I have not found that method as of yet. Perhaps I need to start talking to some of the senior devs to find this solution.

bubba

Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

I have not installed any other packages besides ipblocklist
I can add list url using the http://iblocklist….gz links
But when I check enable ip-blocklist and save/update nothing happens
If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
I know this is an issue as I see it discussed here, I have tried:
reinstalling the package
uninstall, reboot, install the package
edit a firewall rule, save, enable ip-blocklist
edit a firewall rule, save, reboot, enable ip-blocklist
Ran pfsense updates to the current update
uninstall, reinstall ip-blocklist package after running the updates.
Reboot, resave, etc.

Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
Thanks!

Supermule

Using FF or IE??

@bubba:

Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

I have not installed any other packages besides ipblocklist
I can add list url using the http://iblocklist….gz links
But when I check enable ip-blocklist and save/update nothing happens
If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
I know this is an issue as I see it discussed here, I have tried:
reinstalling the package
uninstall, reboot, install the package
edit a firewall rule, save, enable ip-blocklist
edit a firewall rule, save, reboot, enable ip-blocklist
Ran pfsense updates to the current update
uninstall, reinstall ip-blocklist package after running the updates.
Reboot, resave, etc.

Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
Thanks!

bubba

ahhhh no kidding! IE. I just went into FF and it's working beautifully! wow thanks! ;D

@Supermule:

Using FF or IE??

@bubba:

Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

I have not installed any other packages besides ipblocklist
I can add list url using the http://iblocklist….gz links
But when I check enable ip-blocklist and save/update nothing happens
If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
I know this is an issue as I see it discussed here, I have tried:
reinstalling the package
uninstall, reboot, install the package
edit a firewall rule, save, enable ip-blocklist
edit a firewall rule, save, reboot, enable ip-blocklist
Ran pfsense updates to the current update
uninstall, reinstall ip-blocklist package after running the updates.
Reboot, resave, etc.

Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
Thanks!

bubba

ok maybe another dumb question but…
I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
I have the following lists:
http://iblocklist.dbnservers.net/files/bt_spyware.gz
http://iblocklist.rlcassidy.net/files/bt_ads.gz
http://ibl.gamechaser.net/files/bt_level2.gz
http://iblocklist.rlcassidy.net/files/bt_level3.gz
http://iblocklist.dbnservers.net/files/bt_level1.gz

So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

Thanks in advance!

Slab

@bubba:

ok maybe another dumb question but…
I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
I have the following lists:
http://iblocklist.dbnservers.net/files/bt_spyware.gz
http://iblocklist.rlcassidy.net/files/bt_ads.gz
http://ibl.gamechaser.net/files/bt_level2.gz
http://iblocklist.rlcassidy.net/files/bt_level3.gz
http://iblocklist.dbnservers.net/files/bt_level1.gz

So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

Thanks in advance!

Just a guess …but perhaps peerblock is giving you the total IP addresses in each subnet that is blocked in addition to any individual IP addresses that may be blocked, while IP-Blocklist is only counting each subnet (not the address totals within each subnet) plus any individual IP addresses that may be blocked...

tommyboy180

@Slab:

@bubba:

ok maybe another dumb question but…
I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
I have the following lists:
http://iblocklist.dbnservers.net/files/bt_spyware.gz
http://iblocklist.rlcassidy.net/files/bt_ads.gz
http://ibl.gamechaser.net/files/bt_level2.gz
http://iblocklist.rlcassidy.net/files/bt_level3.gz
http://iblocklist.dbnservers.net/files/bt_level1.gz

So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

Thanks in advance!

Just a guess …but perhaps peerblock is giving you the total IP addresses in each subnet that is blocked in addition to any individual IP addresses that may be blocked, while IP-Blocklist is only counting each subnet (not the address totals within each subnet) plus any individual IP addresses that may be blocked...

That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

bubba

ok thanks. So it would be best to keep running peerblock then as well I assume…

One other problem I'm having is when Level1 list is running and I go to yahoo.ca or yahoo.com I cannot perform a search (on both IE and FF). If I delete level1 it works. So as an experiment I added "Search Engines" http://list.iblocklist.com/?list=pfefqteoxlfzopecdtyw to the whitelist. Now yahoo is functioning just fine. So is this ok to use something that is meant to be blocked as something to allow? Anyone have issues with yahoo and level1 list? Is there a better list I should use to make search engines work? I'd prefer not to have to create one.

@tommyboy180:

That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

tommyboy180

@bubba:

ok thanks. So it would be best to keep running peerblock then as well I assume…

One other problem I'm having is when Level1 list is running and I go to yahoo.ca or yahoo.com I cannot perform a search (on both IE and FF). If I delete level1 it works. So as an experiment I added "Search Engines" http://list.iblocklist.com/?list=pfefqteoxlfzopecdtyw to the whitelist. Now yahoo is functioning just fine. So is this ok to use something that is meant to be blocked as something to allow? Anyone have issues with yahoo and level1 list? Is there a better list I should use to make search engines work? I'd prefer not to have to create one.

@tommyboy180:

That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

It wouldn't hurt to keep running peerblock but I think you misunderstood. Some of the outbound traffic will try to go to the blocked IP addresses. This is because of the peer sources and data that torrents give your torrent client to talk to other peers. So your peerblock will log those outbound attempts even though the IP-Blocklist package will still block those packets. You're covered either way. If you're paranoid then just run both.

As far as the yahoo thing goes, sure that's fine. That's what the whitelist is for. If yahoo is being blocked in the level1 and you need access then keep using the search engine list for your whitelist. That's the proper way of doing things. It's like permanently allowing yahoo within your peerblock. I do the same for banking sites and alike.

Take care!

mxx

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

tommyboy180

@mxx:

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

Level1 List is exactly that.

mxx

Oh, thank you! I must have confused something in that description then. Will take another look.
Sorry to have asked the obvious..

mxx

@tommyboy180:

@mxx:

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

Level1 List is exactly that.

Hmm..

is this it?

List name: level1
Author: Bluetack
Author's website: bluetack.co.uk
Author's description:
Companies or organizations who are clearly involved with trying to stop filesharing.
Companies which anti-p2p activity has been seen from.
Companies that produce or have a strong financial interest in copyrighted material.
Government ranges or companies that have a strong financial interest in doing work for governments.
Legal industry ranges.
IPs or ranges of ISPs from which anti-p2p activity has been observed.

So judging from its description it's a p2p enhancing blocklist, not designed to BLOCK FILESHARING (or at least make it more difficult).

I'm looking for a list that carries ip's of -for example- known torrent tracker sites and block that…

tommyboy180

@mxx:

@tommyboy180:

@mxx:

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

Level1 List is exactly that.

Hmm..

is this it?

List name: level1
Author: Bluetack
Author's website: bluetack.co.uk
Author's description:
Companies or organizations who are clearly involved with trying to stop filesharing.
Companies which anti-p2p activity has been seen from.
Companies that produce or have a strong financial interest in copyrighted material.
Government ranges or companies that have a strong financial interest in doing work for governments.
Legal industry ranges.
IPs or ranges of ISPs from which anti-p2p activity has been observed.

So judging from its description it's a p2p enhancing blocklist, not designed to BLOCK FILESHARING (or at least make it more difficult).

I'm looking for a list that carries ip's of -for example- known torrent tracker sites and block that…

lol. I completely miss understood you. You want a list that blocks P2P, correct?

Not sure. I guess you would have to google that. Pfsense 2.0 has layer 7 support so you will be able to block all P2P without using a list. This may be the better solution for you.

mxx

;)

The problem is that layer7 doesn't work properly on 2.0 yet..
Also it would be nice to have some additional options to reduce p2p to a minimum…

I can't believe there's no blocklist for that.. well I couldn't find one..

Please, if someone knows anything, help me out ;)

Thank you!

Max

larathydo

Hey All,

Just installed PFSense (2.0-RC1 (i386), built on Wed Apr 6 23:30:13 EDT 2011) and tried to install the IP-Blocklist package through the GUI package installer.

No matter what I do, it always is showing "You are blocking 0 Networks/IPs". I've tried using the official 'level' lists which are mentioned on the configuration page:

http://iblocklist.whitacrecomputers.com/files/bt_level1.gz
http://iblocklist.whitacrecomputers.com/files/bt_level2.gz
http://iblocklist.whitacrecomputers.com/files/bt_level3.gz

In addition, i've tried using the lists located here: http://www.iblocklist.com/lists.php. I make sure when entering in the address that I do so with the full path to the .gz file itself.

I've tried uninstalling, reinstalling again, reinstalling the package & GUI components (from the package management page). All the while, logging is enabled and yet under Status > System Logs, i see no issues or warnings being generated by the package. Every time I check the status of the package (I.E. "You are blocking 0 Networks/IPs") the package is always listed as being in a "Running" state.

Any suggestions / help? I have no idea what is wrong…

ia2130

Hi All,
Please help me block single ip adress (89.34.12.145)
When I try to add rule some like NAS:89.34.12.145-89.34.12.145
It did not work.

Atlanta-Mike

I have looked through this tread and can't seem to find it, how do you keep IP-Block list running? I can hit save and it will run for a little while but then when I check a few minutes later it is not running again. I have tried uninstalling and reinstalling and am getting the same results. I am also getting the same results with Country Block. However using the cron job below, I can at least get it going again automatically. It does make me wonder if these two packages spend more time not running than running, just how much use I am getting out of them.

*/5 * * * * root /usr/local/etc/rc.d/countryblock.sh

I should say, my assumption is always that I did something wrong, I just need a little help solving this one.

m4rcu5

@Atlanta-Mike:

I have looked through this tread and can't seem to find it, how do you keep IP-Block list running? I can hit save and it will run for a little while but then when I check a few minutes later it is not running again. I have tried uninstalling and reinstalling and am getting the same results. I am also getting the same results with Country Block. However using the cron job below, I can at least get it going again automatically. It does make me wonder if these two packages spend more time not running than running, just how much use I am getting out of them.

*/5 * * * * root /usr/local/etc/rc.d/countryblock.sh

I should say, my assumption is always that I did something wrong, I just need a little help solving this one.

I guess this is due to another process reloading the filters. If i am correct this will remove the ipblocklist from the rules and therefore disable it.

@Tom,
Can't you add a link to '/usr/local/pkg/pf/' qouting from http://remcobressers.nl/2009/08/configuring-native-ipv6-pfsense/:

After some searching on the box, i noticed that after changing things in the GUI the function filter_configure_sync() is called and the rules will be flushed.
This function can be found in /etc/inc/filter.inc (line 78). In the function, there’s a hook to a plugin directory. When the function filter_configure_sync() is called, the function will look in the /usr/local/pkg/pf directory for scripts, which will be executed. This only happens if scripts end with “.sh” as the extension.

-m4rcu5