Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IP-Blocklist

    Scheduled Pinned Locked Moved pfSense Packages
    496 Posts 86 Posters 496.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tommyboy180
      last edited by

      @Shuey:

      I got it!  Since all I had to do was remove a few lines, I was able to find the info on how to navigate and work in Vi long enough to modify the file and I am now blocking IP's with IP-Blocklist!

      Thanks Tom, appreciate the help!

      What I can't figure out is why those lines were still in that file. That file gets deleted on system reboot and regenerated. Since you don't have the countryblock package then that shouldn't be happening unless….

      Do you have any countrblock scripts located in /usr/local/etc/rc.d or /usr/local/pkg/pf ?

      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • S
        Shuey
        last edited by

        Hey Tom, thanks for the info.  Yep, there was a countryblock.sh file still left over in /usr/local/pkg/pf.  And of course the countryblock section was back in the rules.debug file again.  I deleted the countryblock script and removed the lines again in the rules.debug file and rebooted.  IP-Blocklist is running properly again now :).

        1 Reply Last reply Reply Quote 0
        • L
          ljbowdish
          last edited by

          I used your spam list, http://www.tomschaefer.org/temp/pfsense/IP-Blocklist-ForumSpam.txt, and then created my own, it's small, but it's a start,
          http://www.safetyservicesinc.com/spamlist/spamlist2.txt
          and added it to IP Blocklist.  When I started, the package reported
          You are blocking 46182 Networks/IPs
          I added about 25 ip's, but the number being blocked did not change.  Did I do something wrong??

          1 Reply Last reply Reply Quote 0
          • S
            Shuey
            last edited by

            @ljbowdish:

            I used your spam list, http://www.tomschaefer.org/temp/pfsense/IP-Blocklist-ForumSpam.txt, and then created my own, it's small, but it's a start,
            http://www.safetyservicesinc.com/spamlist/spamlist2.txt
            and added it to IP Blocklist.  When I started, the package reported
            You are blocking 46182 Networks/IPs
            I added about 25 ip's, but the number being blocked did not change.  Did I do something wrong??

            Your syntax looks fine.  Remove the small list you made and save the changes.  See the number it's displaying.  Then add your small list again and save and see if the number changes.  If not, we'll have to refer this one to Tom.

            1 Reply Last reply Reply Quote 0
            • L
              ljbowdish
              last edited by

              Thanks
              I thought maybe formatting was a problem, so I re-typed it.  Probably shorter, too.
              I did as you suggested.  The before and after are images here.
              I'm perplexed.
              I thought about maybe d/l tom's file, and adding mine to the end, then saving so there is only 1 location to look at.

              snip1.jpg
              snip1.jpg_thumb
              snip2.jpg
              snip2.jpg_thumb

              1 Reply Last reply Reply Quote 0
              • M
                mlabenda
                last edited by

                how do i get this error message out of my system logs

                php: : The command '/usr/local/pkg/pf/IP-Blocklist.sh start' returned exit code '2', the output was 'not running root: IP-Blocklist was found not running 0 table deleted. 0 table deleted. rm: /tmp/rules.debug.tmp: No such file or directory /usr/local/pkg/pf/IP-Blocklist.sh: cannot create /usr/local/www/packages/ipblocklist/errorOUT.txt: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 cat: /usr/local/www/packages/ipblocklist/interfaces.txt: No such file or directory 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 15

                Microsoft gives you "Windows"
                Opensource gives you the whole house

                1 Reply Last reply Reply Quote 0
                • L
                  ljbowdish
                  last edited by

                  Oh, an yes, I am running country block.

                  1 Reply Last reply Reply Quote 0
                  • L
                    ljbowdish
                    last edited by

                    I discovered that Cisco makes a list of the Top 100 spammers, for the last 24 hours.
                    You can export that list.  Way cool.
                    Now, if I can only make my list work, I'm cooking with hydrogen ;D

                    Here's a link to the list in case anyone else wants it.

                    http://senderbase.com/home/detail_spam_source?displayed=lastday;amp;order=volume_change+desc

                    1 Reply Last reply Reply Quote 0
                    • T
                      tommyboy180
                      last edited by

                      @ljbowdish:

                      I used your spam list, http://www.tomschaefer.org/temp/pfsense/IP-Blocklist-ForumSpam.txt, and then created my own, it's small, but it's a start,
                      http://www.safetyservicesinc.com/spamlist/spamlist2.txt
                      and added it to IP Blocklist.  When I started, the package reported
                      You are blocking 46182 Networks/IPs
                      I added about 25 ip's, but the number being blocked did not change.  Did I do something wrong??

                      The two lists are added to ipfw.ipfw in /usr/local/www/packages/ipblocklist/lists

                      Try adding just the one list and click save/update. See how many lines in that file
                      Now add both lists and click save/update. See how many lines in that file.

                      Is there a difference?

                      -Tom Schaefer
                      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                      Please support pfBlocker | File Browser | Strikeback

                      1 Reply Last reply Reply Quote 0
                      • L
                        ljbowdish
                        last edited by

                        There was not.
                        I'll try deleting both lists, then add one in, then delete it, then add both in and report back the difference if any.

                        1 Reply Last reply Reply Quote 0
                        • L
                          ljbowdish
                          last edited by

                          There must be something I'm wrong with my list, because when I added it in, all by itself, I'm blocking 0 IP's
                          I added to the list based on the stuff from the Cisco list, so it's more than the 25 I had this AM
                          Do they need to be sorted??

                          snip3.jpg
                          snip3.jpg_thumb

                          1 Reply Last reply Reply Quote 0
                          • L
                            ljbowdish
                            last edited by

                            found a semi-colon instead of a colon, but the results are the same.
                            RATS.

                            1 Reply Last reply Reply Quote 0
                            • L
                              ljbowdish
                              last edited by

                              /usr/local/www/packages/ipblocklist/lists/ipfw.ipfw
                              is blank when I used my file.

                              1 Reply Last reply Reply Quote 0
                              • T
                                tommyboy180
                                last edited by

                                Your custom list, is it hosted on a webserver on the same lan as the pfsense router?

                                -Tom Schaefer
                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                Please support pfBlocker | File Browser | Strikeback

                                1 Reply Last reply Reply Quote 0
                                • L
                                  ljbowdish
                                  last edited by

                                  yes.  The custom list is on the web server that is behind the firewall.
                                  Also, I signed up for I-Block list, and got their spam list, when I pasted in the link, in either p2p format or cidr format, nothing loaded.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tommyboy180
                                    last edited by

                                    When a list is hosted on a server that is on the same network as the router, you have to use the private IP address of the webserver for the list.

                                    Fetch does not work when you tell pfsense to fetch from itself. Try modifying your link with the IP in the URL instead of the FQDN. I think you will find that your list will work now.

                                    -Tom Schaefer
                                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                    Please support pfBlocker | File Browser | Strikeback

                                    1 Reply Last reply Reply Quote 0
                                    • L
                                      ljbowdish
                                      last edited by

                                      YahOOO
                                      I'm not certain which format worked, but I am no blocking 64 IP addresses.
                                      Tommy, YOU ARE A HERO

                                      Now, why won't the I-Block list list work??
                                      Not as important as having my list work, I can assure you.
                                      Thank you

                                      snip3.jpg
                                      snip3.jpg_thumb

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tommyboy180
                                        last edited by

                                        @ljbowdish:

                                        YahOOO
                                        I'm not certain which format worked, but I am no blocking 64 IP addresses.
                                        Tommy, YOU ARE A HERO

                                        Now, why won't the I-Block list list work??
                                        Not as important as having my list work, I can assure you.
                                        Thank you

                                        Glad that's working.
                                        So the I-Blocklist.com list url is http://list.iblocklist.com/?list=rynxmrknfjysesjtjlxy&fileformat=p2p&archiveformat=gz&id=ljbowdish&pin=2728 but when you open this list in a browser it redirects to http://list.iblocklist.com/f/sgtbrdkspntjshbzbimf/rynxmrknfjysesjtjlxy.gz

                                        So http://list.iblocklist.com/f/sgtbrdkspntjshbzbimf/rynxmrknfjysesjtjlxy.gz is your true URL. I-Blocklist uses multiple mirrors to host files and the first link is just a refferer to the mirror list. The second url is where that link takes you, to the .gz file.

                                        The version of fetch on pfsense doesn't follow links intelligently which requires users to find the true URL. Pro tip: Open the I-Blocklist.com link in a browser and download the file. Go back into the download history and copy the URL where the download came from. This is the True URL.

                                        -Tom Schaefer
                                        SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                        Please support pfBlocker | File Browser | Strikeback

                                        1 Reply Last reply Reply Quote 0
                                        • L
                                          ljbowdish
                                          last edited by

                                          @tommyboy180:

                                          Glad that's working.
                                          So the I-Blocklist.com list url is http://list.iblocklist.com/?. Pro tip: Open the I-Blocklist.com link in a browser and download the file. Go back into the download history and copy the URL where the download came from. This is the True URL.

                                          A tip from a PRO.  Thank you.

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tommyboy180
                                            last edited by

                                            lol. Perhaps one day I may get around this by using wget, but I don't like adding bells and whistles unless you need to. KISS is how you get stable packages.
                                            Maybe fetch will get an upgrade one day, but until then the user will have to ensure they have the true URL. Once you have that URL, you don't have to worry about that list anymore.

                                            Thank you for your time sir and your generous donation!

                                            -Tom Schaefer
                                            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                            Please support pfBlocker | File Browser | Strikeback

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.