IP-Blocklist
-
Thanks
I thought maybe formatting was a problem, so I re-typed it. Probably shorter, too.
I did as you suggested. The before and after are images here.
I'm perplexed.
I thought about maybe d/l tom's file, and adding mine to the end, then saving so there is only 1 location to look at.
-
how do i get this error message out of my system logs
php: : The command '/usr/local/pkg/pf/IP-Blocklist.sh start' returned exit code '2', the output was 'not running root: IP-Blocklist was found not running 0 table deleted. 0 table deleted. rm: /tmp/rules.debug.tmp: No such file or directory /usr/local/pkg/pf/IP-Blocklist.sh: cannot create /usr/local/www/packages/ipblocklist/errorOUT.txt: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 cat: /usr/local/www/packages/ipblocklist/interfaces.txt: No such file or directory 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 15
-
Oh, an yes, I am running country block.
-
I discovered that Cisco makes a list of the Top 100 spammers, for the last 24 hours.
You can export that list. Way cool.
Now, if I can only make my list work, I'm cooking with hydrogen ;DHere's a link to the list in case anyone else wants it.
http://senderbase.com/home/detail_spam_source?displayed=lastday;amp;order=volume_change+desc
-
I used your spam list, http://www.tomschaefer.org/temp/pfsense/IP-Blocklist-ForumSpam.txt, and then created my own, it's small, but it's a start,
http://www.safetyservicesinc.com/spamlist/spamlist2.txt
and added it to IP Blocklist. When I started, the package reported
You are blocking 46182 Networks/IPs
I added about 25 ip's, but the number being blocked did not change. Did I do something wrong??The two lists are added to ipfw.ipfw in /usr/local/www/packages/ipblocklist/lists
Try adding just the one list and click save/update. See how many lines in that file
Now add both lists and click save/update. See how many lines in that file.Is there a difference?
-
There was not.
I'll try deleting both lists, then add one in, then delete it, then add both in and report back the difference if any. -
There must be something I'm wrong with my list, because when I added it in, all by itself, I'm blocking 0 IP's
I added to the list based on the stuff from the Cisco list, so it's more than the 25 I had this AM
Do they need to be sorted??
-
found a semi-colon instead of a colon, but the results are the same.
RATS. -
/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw
is blank when I used my file. -
Your custom list, is it hosted on a webserver on the same lan as the pfsense router?
-
yes. The custom list is on the web server that is behind the firewall.
Also, I signed up for I-Block list, and got their spam list, when I pasted in the link, in either p2p format or cidr format, nothing loaded. -
When a list is hosted on a server that is on the same network as the router, you have to use the private IP address of the webserver for the list.
Fetch does not work when you tell pfsense to fetch from itself. Try modifying your link with the IP in the URL instead of the FQDN. I think you will find that your list will work now.
-
YahOOO
I'm not certain which format worked, but I am no blocking 64 IP addresses.
Tommy, YOU ARE A HERONow, why won't the I-Block list list work??
Not as important as having my list work, I can assure you.
Thank you
-
YahOOO
I'm not certain which format worked, but I am no blocking 64 IP addresses.
Tommy, YOU ARE A HERONow, why won't the I-Block list list work??
Not as important as having my list work, I can assure you.
Thank youGlad that's working.
So the I-Blocklist.com list url is http://list.iblocklist.com/?list=rynxmrknfjysesjtjlxy&fileformat=p2p&archiveformat=gz&id=ljbowdish&pin=2728 but when you open this list in a browser it redirects to http://list.iblocklist.com/f/sgtbrdkspntjshbzbimf/rynxmrknfjysesjtjlxy.gzSo http://list.iblocklist.com/f/sgtbrdkspntjshbzbimf/rynxmrknfjysesjtjlxy.gz is your true URL. I-Blocklist uses multiple mirrors to host files and the first link is just a refferer to the mirror list. The second url is where that link takes you, to the .gz file.
The version of fetch on pfsense doesn't follow links intelligently which requires users to find the true URL. Pro tip: Open the I-Blocklist.com link in a browser and download the file. Go back into the download history and copy the URL where the download came from. This is the True URL.
-
Glad that's working.
So the I-Blocklist.com list url is http://list.iblocklist.com/?. Pro tip: Open the I-Blocklist.com link in a browser and download the file. Go back into the download history and copy the URL where the download came from. This is the True URL.A tip from a PRO. Thank you.
-
lol. Perhaps one day I may get around this by using wget, but I don't like adding bells and whistles unless you need to. KISS is how you get stable packages.
Maybe fetch will get an upgrade one day, but until then the user will have to ensure they have the true URL. Once you have that URL, you don't have to worry about that list anymore.Thank you for your time sir and your generous donation!
-
p2p format?? That's what I downloaded.
I saw something about CDIR format. Which is preferred?? -
p2p format?? That's what I downloaded.
I saw something about CDIR format. Which is preferred??p2p format is the only supported format right now. Soon, the package will move to CIDR only.
I created a poll on this. It has a list of pro's and con's and is still open for voting
http://forum.pfsense.org/index.php/topic,39649.0.html -
If this has already been asked, I apologize, but I'm wondering: Is there a best practice for blocking domains? While searching for blocklists, I found a very extensive collection but it only listed the domains, not the actual IP's.
-
If this has already been asked, I apologize, but I'm wondering: Is there a best practice for blocking domains? While searching for blocklists, I found a very extensive collection but it only listed the domains, not the actual IP's.
Not sure on that one. It seems like a simple thing to script though. Feed a list of domains and for each domain ping it to have DNS resolve the IP and output that into an IP list. Should be less than 10 lines to script.
-
This seems to be a never ending battle. I'm adding 20-30 Ip's every night.
Is there a better list?? -
This seems to be a never ending battle. I'm adding 20-30 Ip's every night.
Is there a better list??Context? List for what and why are IP's being added every night?
-
I really want to get this to work… I've tried all the suggestions in this thread, but nothing seems to work. Host package locally, get true URL, reinstall pfsense from scratch, and so on...
What happens is this: I add the URL, click 'save/update', and nothing. No update, no page activity, nada. I've left it for hours and it just sits there. Am I missing something? If I'm just dense, please let me know, but I don't see any obvious fix for this issue in the forum. Flame away if there is a fix and I missed it... Thanks!
-
What version of pfsense are you running?
Can you provide a sample list (url)?-
Ensure the Enable checkbox is checked before you click save/update
-
Use firefox or Chrome. IE is not supported
-
-
i tried to uninstall the package. in the log i get :
php: : The command '/usr/local/pkg/pf/IP-Blocklist.sh start' returned exit code '2', the output was 'not running root: IP-Blocklist was found not running 0 table deleted. 0 table deleted. rm: /tmp/rules.debug.tmp: No such file or directory /usr/local/pkg/pf/IP-Blocklist.sh: cannot create /usr/local/www/packages/ipblocklist/errorOUT.txt: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 cat: /usr/local/www/packages/ipblocklist/interfaces.txt: No such file or directory 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 15
using pfsense 2.1-ipv6 (today snapshot)
-
What happens when you reboot and then try to uninstall?
-
What version of pfsense are you running?
Can you provide a sample list (url)?-
Ensure the Enable checkbox is checked before you click save/update
-
Use firefox or Chrome. IE is not supported
Looks like I found the problem. I only use IE ;) But for brevity, I am using bleeding-edge pfsense. The URLs are the true redirect URLs, and I also hosted a package on my web server but was still unable to get it to update. I'll go ahead and try with a portable version of FF and see how it goes. Thanks for the assist!
-
-
What version of pfsense are you running?
Can you provide a sample list (url)?-
Ensure the Enable checkbox is checked before you click save/update
-
Use firefox or Chrome. IE is not supported
Looks like I found the problem. I only use IE ;) But for brevity, I am using bleeding-edge pfsense. The URLs are the true redirect URLs, and I also hosted a package on my web server but was still unable to get it to update. I'll go ahead and try with a portable version of FF and see how it goes. Thanks for the assist!
IE was the cause. Tried Chrome portable and the rules updated like magic. Thanks for the assist!
-
-
No problem!
-
Hi, I'm getting this error message on the latest RC3 embedded builds:
"Warning: fopen(lists.txt): failed to open stream: Read-only file system in /usr/local/www/packages/ipblocklist/ipblocklist_list.php on line 69 Warning: fclose(): supplied argument is not a valid stream resource in /usr/local/www/packages/ipblocklist/ipblocklist_list.php on line 75 "
-
Hey Tom,
I see the package has come a long way since we first spoke. I might have lost a bit track of the project and have some questions ;)
Did you now completely remove the email function or are you running it trough pfSense its own email routine?
Is there an auto update function so it automatically downloads new lists every night?
And probably one request i look for the most, whitelist a single ip or a range of ips instead of using lists. Some of the ips i need to access are blacklisted as part of a complete range which actually makes no sense but they are probably better save then sorry. So a whitelist function as with snort would be very nice!-m4rcu5
-
Hey Tom,
I see the package has come a long way since we first spoke. I might have lost a bit track of the project and have some questions ;)
Did you now completely remove the email function or are you running it trough pfSense its own email routine?
Is there an auto update function so it automatically downloads new lists every night?
And probably one request i look for the most, whitelist a single ip or a range of ips instead of using lists. Some of the ips i need to access are blacklisted as part of a complete range which actually makes no sense but they are probably better save then sorry. So a whitelist function as with snort would be very nice!-m4rcu5
Hello.
I completely removed the email function. It is no longer required. Email was used as a tool to be notified when the package stopped working. This is not the case with the newer versions since the package is very stable now.
Auto updating takes place on it's own. Every time your filter is modified, reloaded, etc. the package will re-download the lists and re-apply them. Filter reloads happen several times a day without any user intervention.
As far as the whitelist a single IP or range: You will have to create a custom list. It's really easy and you can host it on your pfsense router! It's the best of both worlds. The whitelist functionality is already there, you just have to maintain your own list and it's real easy to do so. -
it installs and updates lists fine, but if you reboot this happens:
Current Status = NOT running
/tmp/rules.debug:90: cannot load "/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw": No such file or directorysyslog:
php: : The command '/usr/local/pkg/pf/IP-Blocklist.sh start' returned exit code '2', the output was 'not running root: IP-Blocklist was found not running 0 table deleted. 0 table deleted. rm: /tmp/rules.debug.tmp: No such file or directory /usr/local/pkg/pf/IP-Blocklist.sh: cannot create /usr/local/www/packages/ipblocklist/errorOUT.txt: Read-only file system rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 1
I think the issue is having the file system mounted read-only under NanoBSD, it was mounted as RW for a while due to some bugs but now its fixed.
thx for the great packages.
-
Peer Guardian allows you to allow HTTP. For some lists, this doesn't make sense. All I'm trying to do is block certain organizations from my network and me from them. As far as HTTP traffic goes, I'm not interested in controlling that.
Is there a way I can have all my p2p lists and my unadulterated HTTP too?
-
Peer Guardian allows you to allow HTTP. For some lists, this doesn't make sense. All I'm trying to do is block certain organizations from my network and me from them. As far as HTTP traffic goes, I'm not interested in controlling that.
Is there a way I can have all my p2p lists and my unadulterated HTTP too?
I've thought about that as a feature but I haven't had any requests for it. You're the first person to ask about that.
I will put that in my to-do list for the next version. -
Oh, noice. :) I've been playing with squid and bit and was going to play with rules. I've had some success with squid is bypassing the rules and such, but I'm not sure about the internal workings of all of it all.
-
http://forum.pfsense.org/index.php/topic,41115.0.html Made a discussion there. I've given up for now. Also, after playing around with IPB, it still stop working and not be blocking anything. It typically happens from too much add and removing of whitelist files. Eventually, a purge will not work to remove the file(s). It seems quite buggy in this respect. Otherwise, it works as intended.
-
I installed the IP Blocklist package and it seems that perl is not installed
I tried to install perl:
pkg_add -r perl
Error: Unable to get ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8.1-release/Latest/perl.tbz: File unavailable (e.g., file not found, no access)It looks like the 'packages-8.1-release' folder is missing
However, I installed ntop, it require and install perl http://files.pfsense.org/packages/8/All/perl-5.12.3.tbz
Now IP Blocklist works fine ::)
-
The configuration is not saved when you use Diagnostics: Backup/restore
not a big deal, you just reconfigure when you migrate from on computer to another. -
Cant get it to work
Sep 30 23:23:39 php: /packages/ipblocklist/ipblocklist.php: The command 'ipfw -f flush' returned exit code '69', the output was 'ipfw: setsockopt(IP_FW_FLUSH): Protocol not available'
Sep 30 23:23:39 php: : The command '/usr/local/pkg/pf/IP-Blocklist.sh start' returned exit code '1', the output was 'not running root: IP-Blocklist was found not running 0 table deleted. 0 table deleted. rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131'