Country Block
-
After upgrading pfsense to snapshot built on 16.06.2011 "save/update" button is not active (I mean pressing this button doesn't do anytyhing).
In system logs often appers this:
php: : The command '/usr/local/pkg/pf/countryblock.sh start' returned exit code '1', the output was 'not running root: Countryblock was found not running Status: 404 Not Found Content-type: text/html No input file specified. 0 table deleted. 77 20 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124'How to solve it?… Before upgrading pfsense (and auto-reinstalling CB) CB worked perfect!
-
On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.
-
Tom,
I'm running CountryBlock on:
2.0-RC2 (i386)
built on Tue Jun 7 20:06:07 EDT 2011 and am not sure the package is working.I've blocked all countries except the USA and enabled the "Block outbound" option under the settings tab. The status at the bottom of the config page says:
Current Status = Running
You are blocking 72902 NetworksAs a test, I browsed pages in China, Russia and India (e.g. http://india.gov.in/default.php), for example, and have no issues doing so.
I've deleted the package and reinstalled and have rebooted my pfSense box as well but no change.
Ideas?
Cheers,
James L -
Try blocking inbound also and then see if you can access those pages.
-
Unless I'm missing something, there isn't an explicit block inbound option.
I am blocking inbound by having the package running with the countries selected aren't I?
Thanks
James L -
It sounds like you ran countryblock and then checked outbound. Outbound must be checked before you run countryblock. Make sure block outbound is checked then re-commit the countries and Save/update. That should solve your problem.
-
Thanks Tom …. that worked.
I assume these preferences are maintained across reboots and pfSense Firmware Upgrades?
Thanks
James L -
@jamesL2012:
Thanks Tom …. that worked.
I assume these preferences are maintained across reboots and pfSense Firmware Upgrades?
Thanks
James LYup. No problem!
-
Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.
I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?
Any ideas?
-
Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.
I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?
Any ideas?
Are you sure that ip is responding. It doesn't respond to ICMP and port 80 for me. The best way to see if whitelisting is working is to ping that address (without CIDR) in the pfsense console. If it's not blocked then you will have normal behavior. If it is blocked then pfsense will say "operation not permitted".
Try that. -
I know that it's blocked, because when the country is blocked, so is the IP. The only way I can allow the IP to work is by unblocking country India. So when the country of India is blocked, the people using that Ip can't get in, even after I white-list it.
The only way I can allow them access is to not block the country India.
-
On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.
I mean, I can't start Country Block. Pressing "save/update" doesn't start CB.
And how can I solve this problem (I see it every first time I visit 'Country Block' section web-interface):
'/tmp/rules.debug:79: cannot load "/usr/local/www/packages/countryblock/lists/countries.txt": No such file or directory'Status of CB is always "not running".
Sorry for my english..
-
The only way I can allow them access is to not block the country India.
Yes the list is not perfect - I just had a case where a German IP got blocked, had to allow European Union to let it access. Reverse IP Check clearly said it's a German IP. Works for me but shows that the lists may have some errors (blocks moving I guess).
-
Anyone having issues when saving/committing countries? I had a write error and I was able to login to the shell and run 'mount -u -w /' to get country block to save the settings.
-
@Spy:
Anyone having issues when saving/committing countries? I had a write error and I was able to login to the shell and run 'mount -u -w /' to get country block to save the settings.
Are you using embedded?
-
yeah, but it always worked fine until now.
-
Should be good!
-
CIDR.php wont load this evening so the install fails for me…
Ill try again later.
-
CIDR.php wont load this evening so the install fails for me…
Ill try again later.
Thank you. I'm having issue with the host. Pfsense does not host binary files anymore so it must be hosted somewhere.
Check back in 2 hours. -
Thanks Tom! Working now. :)
