Country Block

ghm

Just curious, did you find the IP listed under Russia? Will I now be able to see the logs?

logging now works over here

Bummer

That's great!

Just to be sure all is working, I like to be down at the datacenter so I won't be able to look in to this until this weekend.

I do know that it works because a client called and their webmaster from India couldn't access their site. Plus, I run Fail2Ban on all my boxes and get notified 5 - 10 times daily when an IP has been blocked after more than 4 attempts via SSH. Since I put Country Block up, I've gone 5 days without any notification from any server! Most of these attacks for me came from China and Vietnam.

tommyboy180

@Bummer:

That's great!

Just to be sure all is working, I like to be down at the datacenter so I won't be able to look in to this until this weekend.

I do know that it works because a client called and their webmaster from India couldn't access their site. Plus, I run Fail2Ban on all my boxes and get notified 5 - 10 times daily when an IP has been blocked after more than 4 attempts via SSH. Since I put Country Block up, I've gone 5 days without any notification from any server! Most of these attacks for me came from China and Vietnam.

I would suggest removing your version and re-installing countryblock. I updated the ip lists and you want to make sure you get the latest country data.

Bummer

<sigh>It's still not working.

I un-installed Country Block and then clicked around on pfSense. When I went back to the install page, I did a hard reload in Firefox and then installed County Block again. The good thing was that I didn't have to un-install bandwidthd like I did before.

After installation, I blocked the top 10 countries and then contacted my client. He still could NOT access any part of the network. So I then un-blocked Russia and he was then able to access everything. I did this again to double check and had the same results. So Russia is still no blocked.

I did check the IP he was using and it hasn't changed from before, it's still the same.

Any other ideas?</sigh>

tommyboy180

@Bummer:

<sigh>It's still not working.

I un-installed Country Block and then clicked around on pfSense. When I went back to the install page, I did a hard reload in Firefox and then installed County Block again. The good thing was that I didn't have to un-install bandwidthd like I did before.

After installation, I blocked the top 10 countries and then contacted my client. He still could NOT access any part of the network. So I then un-blocked Russia and he was then able to access everything. I did this again to double check and had the same results. So Russia is still no blocked.

I did check the IP he was using and it hasn't changed from before, it's still the same.

Any other ideas?</sigh>

I updated the country lists to the latest. I will take a look at that IP. I'm not sure why so give me some time to research. In the mean time you can whitelist a single IP using CIDR. For example you would use /32 for a single IP.

Bummer

When installing a new version of County Block, there isn't anything special I need to do, is there? I'm just wondering if IL missed anything.

Just to verify… I can't whitlelist just one IP, I have to whitelist a range? I want to whitelist the IP 113.19.25.109. I checked and the CIDR is 113.19.0.0/16. So in Country Block, I'd put 113.19.0.0/16 for the block of IPs. Or can I put 113.19.0.0/16 to whitelist the single IP? Sorry, I'm slow to catch on at times. But once I catch on, I don't forget!

Thanks!

tommyboy180

@Bummer:

When installing a new version of County Block, there isn't anything special I need to do, is there? I'm just wondering if IL missed anything.

Just to verify… I can't whitlelist just one IP, I have to whitelist a range? I want to whitelist the IP 113.19.25.109. I checked and the CIDR is 113.19.0.0/16. So in Country Block, I'd put 113.19.0.0/16 for the block of IPs. Or can I put 113.19.0.0/16 to whitelist the single IP? Sorry, I'm slow to catch on at times. But once I catch on, I don't forget!

Thanks!

I still don't know why that IP gets blocked. I doesn't get blocked on my countryblock install. I wonder if the countryblock lists are cached which is causing your problem. You can manually update the lists if you like by extracting the lists file (http://www.pfsense.org/packages/config/countryblock/CIDR.tar.gz) to the countryblock directory.
When you want to whitelist a single IP you need to put it in CIDR format. Single IPs are represented by /32.

Bummer

I'm going to have to go to the datacenter to do what you say. It won't be for another week because on Tuesday I'm leaving on a much needed vacation to Mexico. l'm going to eat, drink, and do NOTHING.

Any way, I do have a few questions.

What version of Country Block is supposed to be installed. Did you renumber it when you made the last changes? I wanted to look at that.
Since I can't go to the datacenter yet, I tried to whiteliast the IP blocked under Russia. It wouldn't work. I put the IP as IP_Number/32. Did I do something wrong?

Thanks!

tommyboy180

@Bummer:

I'm going to have to go to the datacenter to do what you say. It won't be for another week because on Tuesday I'm leaving on a much needed vacation to Mexico. l'm going to eat, drink, and do NOTHING.

Any way, I do have a few questions.

What version of Country Block is supposed to be installed. Did you renumber it when you made the last changes? I wanted to look at that.

Since I can't go to the datacenter yet, I tried to whiteliast the IP blocked under Russia. It wouldn't work. I put the IP as IP_Number/32. Did I do something wrong?

Thanks!

The version of countryblock will be the same. I didn't version bump the package.
Yes, /32 is the correct syntax, your example is correct. You can test it by pinging the address to see if if its blocked given you are blocking outbound. Always test it by pinging the address from the pfsense console. Just member to have outbound blocked as well.

Supermule

Pls bump the version Tom!! So everyone gets aware… :)

sdnorman

I just visited www.countryipblocks.net and it appears they will be suspending services due to a lack of funds.

Stefano

Bummer

Wow, that's too bad. Once I had everything set up and working, I was going to donate $20. I do understand their time is worth something.

I think they had a great idea and I really think there is a demand for it.

tommyboy180

I just donated to the site. I hope more people will too.

Bummer

Yeah, I just donated too. Hopefully they'll get the few remaining bugs out.

We'll see what happens.

Quasar

After upgrading pfsense to snapshot built on 16.06.2011 "save/update" button is not active (I mean pressing this button doesn't do anytyhing).
In system logs often appers this:
php: : The command '/usr/local/pkg/pf/countryblock.sh start' returned exit code '1', the output was 'not running root: Countryblock was found not running Status: 404 Not Found Content-type: text/html No input file specified. 0 table deleted. 77 20 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124'

How to solve it?… Before upgrading pfsense (and auto-reinstalling CB) CB worked perfect!

Bummer

On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.

jamesidauto.net

Tom,

I'm running CountryBlock on:

2.0-RC2 (i386)
built on Tue Jun 7 20:06:07 EDT 2011 and am not sure the package is working.

I've blocked all countries except the USA and enabled the "Block outbound" option under the settings tab. The status at the bottom of the config page says:

Current Status = Running
You are blocking 72902 Networks

As a test, I browsed pages in China, Russia and India (e.g. http://india.gov.in/default.php), for example, and have no issues doing so.

I've deleted the package and reinstalled and have rebooted my pfSense box as well but no change.

Ideas?

Cheers,
James L

Bummer

Try blocking inbound also and then see if you can access those pages.

jamesidauto.net

Unless I'm missing something, there isn't an explicit block inbound option.

I am blocking inbound by having the package running with the countries selected aren't I?

Thanks
James L

tommyboy180

It sounds like you ran countryblock and then checked outbound. Outbound must be checked before you run countryblock. Make sure block outbound is checked then re-commit the countries and Save/update. That should solve your problem.