Country Block

[tommyboy180]

@ghm:

Just a quick "Thank You, Tommy!" Package seems to run smoothly on RC1 embedded now (tested for a couple of days now, survived test reboot, rule changes, and pppoe dialups). Just did a plain install, no manual cron jobs or anything.

Best
Georg

Glad to hear it! I am constantly working on this package and other packages (even some future releases to come).
If you like it that much consider donating at http://tomschaefer.org/pfsense/

[Bummer]

I'm not sure why, but I had some issues installing Country Block.

1. Before starting, I upgraded to the most recent version of pfSense (05-27-2011).
2. After the box rebooted, I installed bandwidthd, all went good.
3. I then tired installing Country Block and it failed. I tried to install it 3 more times with no luck.
4. Finally, I un-installed bandwidthd and tried installing County Block. At this time, it appears that County Block installed okay. I then re-installed bandwidthd.

My question is… how can I tell if County Block is working? I set it to logging, but can't find the logs to see if it's working. I know I'm missing something here.

Thanks!

[tommyboy180]

@Bummer:

I'm not sure why, but I had some issues installing Country Block.

1. Before starting, I upgraded to the most recent version of pfSense (05-27-2011).
2. After the box rebooted, I installed bandwidthd, all went good.
3. I then tired installing Country Block and it failed. I tried to install it 3 more times with no luck.
4. Finally, I un-installed bandwidthd and tried installing County Block. At this time, it appears that County Block installed okay. I then re-installed bandwidthd.

My question is… how can I tell if County Block is working? I set it to logging, but can't find the logs to see if it's working. I know I'm missing something here.

Thanks!

You can tell if countryblock is running by going to the countryblock package page. At the bottom of the page it will tell you if it is running. When you have logging enabled firewall logs will be generated under the firewall tab. You may see countries being blocked or nothing at all depending on your settings.

[ghm]

@tommyboy180:

Glad to hear it! I am constantly working on this package and other packages (even some future releases to come).
If you like it that much consider donating at http://tomschaefer.org/pfsense/

Done. Have RC2 embedded now, still runs. Only thing is that I don't see blocling messages in the FW log either despite having logs enabled. Minor issue though. Still works, I can tell because I have logging on for a pass rule - and only get pass log entries for allowed countries.

[tommyboy180]

@ghm:

@tommyboy180:

Glad to hear it! I am constantly working on this package and other packages (even some future releases to come).
If you like it that much consider donating at http://tomschaefer.org/pfsense/

Done. Have RC2 embedded now, still runs. Only thing is that I don't see blocling messages in the FW log either despite having logs enabled. Minor issue though. Still works, I can tell because I have logging on for a pass rule - and only get pass log entries for allowed countries.

Thank you very much! And I will look into the logging problem.

When the rules are created the logging tag is appended to the pfsense firewall rules but I can't remember if I left out inbound on purpose or not. I'll will be able to take a look at it tonight.

[Bummer]

Now I'm really confused!

After installing County Block, a client just called and they can't access our network. Since County Block is the only thing I changed, I knew it had to be in there. So I looked up the IP of 50.11.108.126 and it shows the following.
–--------------------------
50.11.108.126 is located within the following Network:

Network: 50.8.0.0
CIDR: 50.8.0.0/13
Mask: 50.8.0.0/255.248.0.0
Network Range: 50.8.0.0 - 50.15.255.255
Total addresses: 524,288
Registrar: ARIN

The interesting thing is that when I opened access for the county of Russia on Country Block, the client was able to get to our network. When I blocked Russia, they again could not access us again. So for the final time I unblocked Russia and they can now access again.

I also tired looking the IP up in the logs and can't find it as being blocked. I did enable logging in County Block and have verified again that it is indeed enabled. Am I missing something here?

Sorry, I'm trying to get a handle on all of this.

[tommyboy180]

@Bummer:

Now I'm really confused!

After installing County Block, a client just called and they can't access our network. Since County Block is the only thing I changed, I knew it had to be in there. So I looked up the IP of 50.11.108.126 and it shows the following.
–--------------------------
50.11.108.126 is located within the following Network:

Network: 50.8.0.0
CIDR: 50.8.0.0/13
Mask: 50.8.0.0/255.248.0.0
Network Range: 50.8.0.0 - 50.15.255.255
Total addresses: 524,288
Registrar: ARIN

The interesting thing is that when I opened access for the county of Russia on Country Block, the client was able to get to our network. When I blocked Russia, they again could not access us again. So for the final time I unblocked Russia and they can now access again.

I also tired looking the IP up in the logs and can't find it as being blocked. I did enable logging in County Block and have verified again that it is indeed enabled. Am I missing something here?

Sorry, I'm trying to get a handle on all of this.

I think you have stumbled across a huge problem!
50.11.108.126 is a US address so I need to verify the country ip block lists that come with the package are accurate.
Also as I mentioned to ghm above, I'm going to look at the logging feature. I may have left something commented out for a reason. When I get home tonight I will take a look.

For now keep Russia unblocked or whitelist that IP. I should be able to update you on this issue later tonight. Thank you!

[Bummer]

Sorry to be such a pain!

If there's a problem - I'll find it guaranteed! I have bad luck that way. That's why I wrote in to you before doing anything.

I've left Russia unblocked.

Thanks!

[tommyboy180]

@Bummer:

Sorry to be such a pain!

If there's a problem - I'll find it guaranteed! I have bad luck that way. That's why I wrote in to you before doing anything.

I've left Russia unblocked.

Thanks!

I updated the country lists. You can uninstall your countryblock package and re-install for the latest update. See if that help.

[Bummer]

Thanks Tommyboy180!

A few questions, if you don't mind.

1. Just curious, did you find the IP listed under Russia? Will I now be able to see the logs?

2. When installing Country Block, it wouldn't install if I had bandwidthd installed first. So I had to un-install bandwidthd in order to install County Block? Do you know why this is? The reason I ask is that if I un-install Country Block, I'll have to un-install bandwidthd again. This means I'll have to install bandwidthd again and set it all up again. If there's a way, I'd like to avoid that.

3. Exactly how do I whitelist and IP on Country Block? I want to white list the IP 113.19.25.109.  If I read the Country Block white listing correctly, I can't white list and IP, I do the whole range that I found at http://www.countryipblocks.net/country-blocks/select-formats/ . So I would put in: 113.19.0.0/16 - is that correct?

Thanks!

[ghm]

@Bummer:

1. Just curious, did you find the IP listed under Russia? Will I now be able to see the logs?

logging now works over here

[Bummer]

That's great!

Just to be sure all is working, I like to be down at the datacenter so I won't be able to look in to this until this weekend.

I do know that it works because a client called and their webmaster from India couldn't access their site. Plus, I run Fail2Ban on all my boxes and get notified 5 - 10 times daily when an IP has been blocked after more than 4 attempts via SSH. Since I put Country Block up, I've gone 5 days without any notification from any server! Most of these attacks for me came from China and Vietnam.

[tommyboy180]

@Bummer:

That's great!

Just to be sure all is working, I like to be down at the datacenter so I won't be able to look in to this until this weekend.

I do know that it works because a client called and their webmaster from India couldn't access their site. Plus, I run Fail2Ban on all my boxes and get notified 5 - 10 times daily when an IP has been blocked after more than 4 attempts via SSH. Since I put Country Block up, I've gone 5 days without any notification from any server! Most of these attacks for me came from China and Vietnam.

I would suggest removing your version and re-installing countryblock. I updated the ip lists and you want to make sure you get the latest country data.

[Bummer]

<sigh>It's still not working.

I un-installed Country Block and then clicked around on pfSense. When I went back to the install page, I did a hard reload in Firefox and then installed County Block again. The good thing was that I didn't have to un-install bandwidthd like I did before.

After installation, I blocked the top 10 countries and then contacted my client. He still could NOT access any part of the network. So I then un-blocked Russia and he was then able to access everything. I did this again to double check and had the same results. So Russia is still no blocked.

I did check the IP he was using and it hasn't changed from before, it's still the same.

Any other ideas?</sigh>

[tommyboy180]

@Bummer:

<sigh>It's still not working.

I un-installed Country Block and then clicked around on pfSense. When I went back to the install page, I did a hard reload in Firefox and then installed County Block again. The good thing was that I didn't have to un-install bandwidthd like I did before.

After installation, I blocked the top 10 countries and then contacted my client. He still could NOT access any part of the network. So I then un-blocked Russia and he was then able to access everything. I did this again to double check and had the same results. So Russia is still no blocked.

I did check the IP he was using and it hasn't changed from before, it's still the same.

Any other ideas?</sigh>

I updated the country lists to the latest. I will take a look at that IP. I'm not sure why so give me some time to research. In the mean time you can whitelist a single IP using CIDR. For example you would use  /32 for a single IP.

[Bummer]

When installing a new version of County Block, there isn't anything special I need to do, is there? I'm just wondering if IL missed anything.

Just to verify… I can't whitlelist just one IP, I have to whitelist a range? I want to whitelist the IP 113.19.25.109. I checked and the CIDR is 113.19.0.0/16. So in Country Block, I'd put 113.19.0.0/16 for the block of IPs. Or can I put 113.19.0.0/16 to whitelist the single IP? Sorry, I'm slow to catch on at times. But once I catch on, I don't forget!

Thanks!

[tommyboy180]

@Bummer:

When installing a new version of County Block, there isn't anything special I need to do, is there? I'm just wondering if IL missed anything.

Just to verify… I can't whitlelist just one IP, I have to whitelist a range? I want to whitelist the IP 113.19.25.109. I checked and the CIDR is 113.19.0.0/16. So in Country Block, I'd put 113.19.0.0/16 for the block of IPs. Or can I put 113.19.0.0/16 to whitelist the single IP? Sorry, I'm slow to catch on at times. But once I catch on, I don't forget!

Thanks!

I still don't know why that IP gets blocked. I doesn't get blocked on my countryblock install. I wonder if the countryblock lists are cached which is causing your problem. You can manually update the lists if you like by extracting the lists file (http://www.pfsense.org/packages/config/countryblock/CIDR.tar.gz) to the countryblock directory.
When you want to whitelist a single IP you need to put it in CIDR format. Single IPs are represented by /32.

[Bummer]

I'm going to have to go to the datacenter to do what you say. It won't be for another week because on Tuesday I'm leaving on a much needed vacation to Mexico. l'm going to eat, drink, and do NOTHING.

Any way, I do have a few questions.

1. What version of Country Block is supposed to be installed. Did you renumber it when you made the last changes? I wanted to look at that.
2. Since I can't go to the datacenter yet, I tried to whiteliast the IP blocked under Russia. It wouldn't work. I put the IP as IP_Number/32. Did I do something wrong?

Thanks!

[tommyboy180]

@Bummer:

I'm going to have to go to the datacenter to do what you say. It won't be for another week because on Tuesday I'm leaving on a much needed vacation to Mexico. l'm going to eat, drink, and do NOTHING.

Any way, I do have a few questions.

1. What version of Country Block is supposed to be installed. Did you renumber it when you made the last changes? I wanted to look at that.
2. Since I can't go to the datacenter yet, I tried to whiteliast the IP blocked under Russia. It wouldn't work. I put the IP as IP_Number/32. Did I do something wrong?

Thanks!

The version of countryblock will be the same. I didn't version bump the package.
Yes, /32 is the correct syntax, your example is correct. You can test it by pinging the address to see if if its blocked given you are blocking outbound. Always test it by pinging the address from the pfsense console. Just member to have outbound blocked as well.

[Supermule]

Pls bump the version Tom!! So everyone gets aware… :)