Country Block

[jaredadams]

Hi,

few more questions.

Is the IP address list updated automatically?

If not where are the files located for me to edit?

If I were to try to edit I noticed that countryipblocks.net format is x.x.x.x/sn.

I ask because I had someone spam one of my forums I host.  Their IP was in the Ukraine, but was not on the list from that website.  I have the person's IP address but I dont think theres any way for me to tell the subnet.

Any insight?

[tommyboy180]

@jaredadams:

Hi,

few more questions.

Is the IP address list updated automatically?

If not where are the files located for me to edit?

If I were to try to edit I noticed that countryipblocks.net format is x.x.x.x/sn.

I ask because I had someone spam one of my forums I host.  Their IP was in the Ukraine, but was not on the list from that website.  I have the person's IP address but I dont think theres any way for me to tell the subnet.

Any insight?

What's the IP?

[jaredadams]

At this point I dont recall.  :(

[Bummer]

Hey Tommyboy180

Don't you love it when we can't remember? I know you have to just shake your head.

[jaredadams]

I banned the previous user from my forum which deleted any information pertaining to the IP address.  However a new spammer registered and i ran an ARIN lookup on his IP address.  It comes from this CIDR block in Denmark: 91.0.0.0/8

Obviously its not in the list,  how do I add this block to my list manually?  Where are the files for the lists located?

Thanks in advance!

[tommyboy180]

@jaredadams:

I banned the previous user from my forum which deleted any information pertaining to the IP address.  However a new spammer registered and i ran an ARIN lookup on his IP address.  It comes from this CIDR block in Denmark: 91.0.0.0/8

Obviously its not in the list,  how do I add this block to my list manually?  Where are the files for the lists located?

Thanks in advance!

Take a look at the denmark country at http://www.countryipblocks.net/country-blocks/select-formats/. This list is the one I have in the package. From what I can tell most of 91 is in there.

The entire 91.0.0.0/8 block does not belong to Denmark. Denmark only has a few networks out of that range. The EU also uses 91 as well as Russia. Therefore you need to find exactly what country that IP belongs to and block that country.

[ghm]

Just a quick "Thank You, Tommy!" Package seems to run smoothly on RC1 embedded now (tested for a couple of days now, survived test reboot, rule changes, and pppoe dialups). Just did a plain install, no manual cron jobs or anything.

Best
Georg

[tommyboy180]

@ghm:

Just a quick "Thank You, Tommy!" Package seems to run smoothly on RC1 embedded now (tested for a couple of days now, survived test reboot, rule changes, and pppoe dialups). Just did a plain install, no manual cron jobs or anything.

Best
Georg

Glad to hear it! I am constantly working on this package and other packages (even some future releases to come).
If you like it that much consider donating at http://tomschaefer.org/pfsense/

[Bummer]

I'm not sure why, but I had some issues installing Country Block.

1. Before starting, I upgraded to the most recent version of pfSense (05-27-2011).
2. After the box rebooted, I installed bandwidthd, all went good.
3. I then tired installing Country Block and it failed. I tried to install it 3 more times with no luck.
4. Finally, I un-installed bandwidthd and tried installing County Block. At this time, it appears that County Block installed okay. I then re-installed bandwidthd.

My question is… how can I tell if County Block is working? I set it to logging, but can't find the logs to see if it's working. I know I'm missing something here.

Thanks!

[tommyboy180]

@Bummer:

I'm not sure why, but I had some issues installing Country Block.

1. Before starting, I upgraded to the most recent version of pfSense (05-27-2011).
2. After the box rebooted, I installed bandwidthd, all went good.
3. I then tired installing Country Block and it failed. I tried to install it 3 more times with no luck.
4. Finally, I un-installed bandwidthd and tried installing County Block. At this time, it appears that County Block installed okay. I then re-installed bandwidthd.

My question is… how can I tell if County Block is working? I set it to logging, but can't find the logs to see if it's working. I know I'm missing something here.

Thanks!

You can tell if countryblock is running by going to the countryblock package page. At the bottom of the page it will tell you if it is running. When you have logging enabled firewall logs will be generated under the firewall tab. You may see countries being blocked or nothing at all depending on your settings.

[ghm]

@tommyboy180:

Glad to hear it! I am constantly working on this package and other packages (even some future releases to come).
If you like it that much consider donating at http://tomschaefer.org/pfsense/

Done. Have RC2 embedded now, still runs. Only thing is that I don't see blocling messages in the FW log either despite having logs enabled. Minor issue though. Still works, I can tell because I have logging on for a pass rule - and only get pass log entries for allowed countries.

[tommyboy180]

@ghm:

@tommyboy180:

Glad to hear it! I am constantly working on this package and other packages (even some future releases to come).
If you like it that much consider donating at http://tomschaefer.org/pfsense/

Done. Have RC2 embedded now, still runs. Only thing is that I don't see blocling messages in the FW log either despite having logs enabled. Minor issue though. Still works, I can tell because I have logging on for a pass rule - and only get pass log entries for allowed countries.

Thank you very much! And I will look into the logging problem.

When the rules are created the logging tag is appended to the pfsense firewall rules but I can't remember if I left out inbound on purpose or not. I'll will be able to take a look at it tonight.

[Bummer]

Now I'm really confused!

After installing County Block, a client just called and they can't access our network. Since County Block is the only thing I changed, I knew it had to be in there. So I looked up the IP of 50.11.108.126 and it shows the following.
–--------------------------
50.11.108.126 is located within the following Network:

Network: 50.8.0.0
CIDR: 50.8.0.0/13
Mask: 50.8.0.0/255.248.0.0
Network Range: 50.8.0.0 - 50.15.255.255
Total addresses: 524,288
Registrar: ARIN

The interesting thing is that when I opened access for the county of Russia on Country Block, the client was able to get to our network. When I blocked Russia, they again could not access us again. So for the final time I unblocked Russia and they can now access again.

I also tired looking the IP up in the logs and can't find it as being blocked. I did enable logging in County Block and have verified again that it is indeed enabled. Am I missing something here?

Sorry, I'm trying to get a handle on all of this.

[tommyboy180]

@Bummer:

Now I'm really confused!

After installing County Block, a client just called and they can't access our network. Since County Block is the only thing I changed, I knew it had to be in there. So I looked up the IP of 50.11.108.126 and it shows the following.
–--------------------------
50.11.108.126 is located within the following Network:

Network: 50.8.0.0
CIDR: 50.8.0.0/13
Mask: 50.8.0.0/255.248.0.0
Network Range: 50.8.0.0 - 50.15.255.255
Total addresses: 524,288
Registrar: ARIN

The interesting thing is that when I opened access for the county of Russia on Country Block, the client was able to get to our network. When I blocked Russia, they again could not access us again. So for the final time I unblocked Russia and they can now access again.

I also tired looking the IP up in the logs and can't find it as being blocked. I did enable logging in County Block and have verified again that it is indeed enabled. Am I missing something here?

Sorry, I'm trying to get a handle on all of this.

I think you have stumbled across a huge problem!
50.11.108.126 is a US address so I need to verify the country ip block lists that come with the package are accurate.
Also as I mentioned to ghm above, I'm going to look at the logging feature. I may have left something commented out for a reason. When I get home tonight I will take a look.

For now keep Russia unblocked or whitelist that IP. I should be able to update you on this issue later tonight. Thank you!

[Bummer]

Sorry to be such a pain!

If there's a problem - I'll find it guaranteed! I have bad luck that way. That's why I wrote in to you before doing anything.

I've left Russia unblocked.

Thanks!

[tommyboy180]

@Bummer:

Sorry to be such a pain!

If there's a problem - I'll find it guaranteed! I have bad luck that way. That's why I wrote in to you before doing anything.

I've left Russia unblocked.

Thanks!

I updated the country lists. You can uninstall your countryblock package and re-install for the latest update. See if that help.

[Bummer]

Thanks Tommyboy180!

A few questions, if you don't mind.

1. Just curious, did you find the IP listed under Russia? Will I now be able to see the logs?

2. When installing Country Block, it wouldn't install if I had bandwidthd installed first. So I had to un-install bandwidthd in order to install County Block? Do you know why this is? The reason I ask is that if I un-install Country Block, I'll have to un-install bandwidthd again. This means I'll have to install bandwidthd again and set it all up again. If there's a way, I'd like to avoid that.

3. Exactly how do I whitelist and IP on Country Block? I want to white list the IP 113.19.25.109.  If I read the Country Block white listing correctly, I can't white list and IP, I do the whole range that I found at http://www.countryipblocks.net/country-blocks/select-formats/ . So I would put in: 113.19.0.0/16 - is that correct?

Thanks!

[ghm]

@Bummer:

1. Just curious, did you find the IP listed under Russia? Will I now be able to see the logs?

logging now works over here

[Bummer]

That's great!

Just to be sure all is working, I like to be down at the datacenter so I won't be able to look in to this until this weekend.

I do know that it works because a client called and their webmaster from India couldn't access their site. Plus, I run Fail2Ban on all my boxes and get notified 5 - 10 times daily when an IP has been blocked after more than 4 attempts via SSH. Since I put Country Block up, I've gone 5 days without any notification from any server! Most of these attacks for me came from China and Vietnam.

[tommyboy180]

@Bummer:

That's great!

Just to be sure all is working, I like to be down at the datacenter so I won't be able to look in to this until this weekend.

I do know that it works because a client called and their webmaster from India couldn't access their site. Plus, I run Fail2Ban on all my boxes and get notified 5 - 10 times daily when an IP has been blocked after more than 4 attempts via SSH. Since I put Country Block up, I've gone 5 days without any notification from any server! Most of these attacks for me came from China and Vietnam.

I would suggest removing your version and re-installing countryblock. I updated the ip lists and you want to make sure you get the latest country data.