Country Block

tommyboy180 · Jun 18, 2011, 7:14 PM

@jamesL2012:

Thanks Tom …. that worked.

I assume these preferences are maintained across reboots and pfSense Firmware Upgrades?

Thanks
James L

Yup. No problem!

Bummer · Jun 18, 2011, 8:53 PM

Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.

I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?

Any ideas?

tommyboy180 · Jun 19, 2011, 12:51 AM

@Bummer:

Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.

I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?

Any ideas?

Are you sure that ip is responding. It doesn't respond to ICMP and port 80 for me. The best way to see if whitelisting is working is to ping that address (without CIDR) in the pfsense console. If it's not blocked then you will have normal behavior. If it is blocked then pfsense will say "operation not permitted".
Try that.

Bummer · Jun 20, 2011, 8:38 PM

I know that it's blocked, because when the country is blocked, so is the IP. The only way I can allow the IP to work is by unblocking country India. So when the country of India is blocked, the people using that Ip can't get in, even after I white-list it.

The only way I can allow them access is to not block the country India.

Quasar · Jun 21, 2011, 8:12 PM

@Bummer:

On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.

I mean, I can't start Country Block. Pressing "save/update" doesn't start CB.
And how can I solve this problem (I see it every first time I visit 'Country Block' section web-interface):
'/tmp/rules.debug:79: cannot load "/usr/local/www/packages/countryblock/lists/countries.txt": No such file or directory'

Status of CB is always "not running".

Sorry for my english..

ghm · Jun 22, 2011, 4:29 PM

@Bummer:

The only way I can allow them access is to not block the country India.

Yes the list is not perfect - I just had a case where a German IP got blocked, had to allow European Union to let it access. Reverse IP Check clearly said it's a German IP. Works for me but shows that the lists may have some errors (blocks moving I guess).

Spy Alelo · Jun 22, 2011, 6:08 PM

Anyone having issues when saving/committing countries? I had a write error and I was able to login to the shell and run 'mount -u -w /' to get country block to save the settings.

tommyboy180 · Jun 23, 2011, 11:30 PM

@Spy:

Anyone having issues when saving/committing countries? I had a write error and I was able to login to the shell and run 'mount -u -w /' to get country block to save the settings.

Are you using embedded?

Spy Alelo · Jun 24, 2011, 5:34 AM

yeah, but it always worked fine until now.

tommyboy180 · Jul 5, 2011, 7:15 PM

Should be good!

chpalmer · Jul 6, 2011, 1:19 AM

CIDR.php wont load this evening so the install fails for me…

Ill try again later.

tommyboy180 · Jul 6, 2011, 1:25 AM

@chpalmer:

CIDR.php wont load this evening so the install fails for me…

Ill try again later.

Thank you. I'm having issue with the host. Pfsense does not host binary files anymore so it must be hosted somewhere.
Check back in 2 hours.

chpalmer · Jul 6, 2011, 7:23 AM

Thanks Tom! Working now. :)

cmb · Jul 7, 2011, 4:24 AM

Tom, you can just send me or Jim P. binaries and we'll get them uploaded.

tommyboy180 · Jul 7, 2011, 12:47 PM

@cmb:

Tom, you can just send me or Jim P. binaries and we'll get them uploaded.

Awesome!
I update the binary every so often. I hope that won't be an issue.

JSmorada · Jul 8, 2011, 1:04 PM

I'm having problems getting Country Block to run. I keep getting the error Current Status = NOT running
/tmp/rules.debug:102: cannot load "/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw": No such file or directory
You are blocking 0 Networks.

PfSense 2.0-RC3 (i386)
built on Thu Jul 7 22:58:43 EDT 2011.

One country selected and I tried the suggested workarounds (edited a single rule without changing it, saving, etc.). I also rebooted the firewall box…

darklogic · Jul 8, 2011, 6:08 PM

I had a simalure issue. I did a simple reinstall of the package and everything worked from that point forward. Also did this issue start after a firmware update? I always have to reinstall Country Block after a firmware update.

JSmorada · Jul 8, 2011, 6:18 PM

it was the only package i installed after upgrading to 2.0. i did try reinstalling the package but get the same error.

cmb · Jul 8, 2011, 11:55 PM

@tommyboy180:

Awesome!
I update the binary every so often. I hope that won't be an issue.

No problem.

darklogic · Jul 11, 2011, 12:03 PM

There were a couple of Times I had to uninstall the package, reboot, and then reinstall.