Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Country Block

    Scheduled Pinned Locked Moved pfSense Packages
    691 Posts 79 Posters 762.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mentalhemroids
      last edited by

      I had to do a fresh install of 2.0 to get Country and IP Blocker to stop giving messages in the system log.  After that it seems like Country Blocker is working okay; I am still getting this message in the system log Oct 8 08:04:06 php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'

      I've tested previously posted sites and they are getting blocked.  For me it seems to work better after a clean 2.0 install.

      ** Update **
      I am getting these messages on both servers though and the Country Block still says it is running; if I say SAVE/UPDATE it starts working again.

      Oct 8 19:18:36 root: Countryblock was found not running
      Oct 8 19:18:29 root: Countryblock was found not running

      Update  After telling it to SAVE/UPDATE the service stopped again… does it seem related to the alarms?
      Oct 9 07:19:53 root: Countryblock was found not running
      Oct 9 07:19:47 root: Countryblock was found not running
      Oct 9 07:19:40 check_reload_status: Reloading filter
      Oct 9 07:19:40 check_reload_status: Reloading filter
      Oct 9 07:19:30 apinger: alarm canceled: WAN(70.239..) *** down ***
      Oct 9 07:19:30 apinger: ALARM: WAN(70.239.
      .) *** down ***
      Oct 9 07:19:12 root: Countryblock was found not running
      Oct 9 07:19:08 root: Countryblock was found not running
      Oct 9 07:19:00 check_reload_status: Reloading filter
      Oct 9 07:19:00 check_reload_status: Reloading filter
      Oct 9 07:18:50 apinger: alarm canceled: WAN(70.239..) *** down ***
      Oct 9 07:18:50 apinger: ALARM: WAN(70.239.
      .) *** down ***
      Oct 9 07:17:32 root: Countryblock was found not running
      Oct 9 07:17:31 dhclient: Creating resolv.conf
      Oct 9 07:17:31 dhclient: RENEW
      Oct 9 07:17:27 root: Countryblock was found not running
      Oct 9 07:17:20 check_reload_status: Reloading filter
      Oct 9 07:17:20 check_reload_status: Reloading filter
      Oct 9 07:17:10 apinger: alarm canceled: WAN(70.239..) *** down ***
      Oct 9 07:17:10 apinger: ALARM: WAN(70.239.
      .) *** down ***
      Oct 9 07:12:46 php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'

      1 Reply Last reply Reply Quote 0
      • L
        Luzemario
        last edited by

        Hello,

        My machine is a Celeron 1.7GHz with 256MB ram only. I am getting the error below:

        Current Status = NOT running
        /tmp/rules.debug:87: cannot define table countryblock: Cannot allocate memory
        You are blocking 0 Networks

        What are the minimum prerequisites for 0.2.4 version?

        Thanks

        Cheapest hosting - Bom e barato! - www.luzehost.com.br :D

        1 Reply Last reply Reply Quote 0
        • T
          tommyboy180
          last edited by

          There are no minimum requirements; It all depends on your usage. You can either minimize countryblock's usage or expand your RAM.

          -Tom Schaefer
          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

          Please support pfBlocker | File Browser | Strikeback

          1 Reply Last reply Reply Quote 0
          • L
            Luzemario
            last edited by

            Sorry… An memory module was badly inserted, giving only 128MB of ram to system.

            I am wondering how much ram memory CIDR table needs to get loaded.

            System activity (CountryBlocks not running):

            last pid: 61581;  load averages:  0.00,  0.00,  0.00  up 0+02:26:21    13:27:14
            104 processes: 2 running, 85 sleeping, 17 waiting

            Mem: 40M Active, 34M Inact, 40M Wired, 32M Buf, 108M Free
            Swap: 512M Total, 512M Free

            PID USERNAME      PRI NICE  SIZE    RES STATE    TIME  WCPU COMMAND
              11 root              171 ki31      0K    8K RUN      140:01 98.19% idle
            56575 root              48    0  34140K 21968K piperd  0:07  1.66% php
              12 root              -32    -    0K  136K WAIT    0:47  0.00% {swi4: clock}
                0 root                76    0    0K    56K sched    0:41  0.00% {swapper}
              12 root              -68    -    0K  136K WAIT    0:10  0.00% {irq11: vr0 ehci0}
            6364 root              76  20  3656K  1496K wait    0:05  0.00% sh
            45484 root              44    0  3316K  1336K select  0:05  0.00% apinger
            56548 root              76    0 33116K 19020K accept  0:04  0.00% php
            50217 root              44    0  6588K  4808K kqread  0:03  0.00% lighttpd
              12 root              -68    -    0K  136K WAIT    0:02  0.00% {irq10: ral0 uhci}
              14 root              -16    -    0K    8K -        0:02  0.00% yarrow
            60024 dhcpd          44    0  8436K  5100K select  0:01  0.00% dhcpd
                4 root                -8    -    0K    8K -        0:01  0.00% g_down
              22 root              44    -    0K    8K syncer  0:01  0.00% syncer
                3 root                -8    -    0K    8K -        0:01  0.00% g_up
            27717 root            44    0  4944K  2512K select  0:01  0.00% syslogd
                2 root              -8    -    0K    8K -        0:01  0.00% g_event
            2651 root            64  20  7824K  5880K select  0:01  0.00% {siproxd}

            Cheapest hosting - Bom e barato! - www.luzehost.com.br :D

            1 Reply Last reply Reply Quote 0
            • T
              tommyboy180
              last edited by

              Like I said it depends on your usage. If you block a small country range then you won't need much RAM at all, but if you're blocking large ranges then you will need more RAM.

              -Tom Schaefer
              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

              Please support pfBlocker | File Browser | Strikeback

              1 Reply Last reply Reply Quote 0
              • L
                Luzemario
                last edited by

                Thanks for the info. Usually I let only my country unblocked (Brazil), leaving all other countries checked. Despite this, I can't understand why I have 512MB of swap, and it is not used during table loading. Could you explain how loading is done (it is a RAM-only function)?

                Thank you for your time.

                Cheapest hosting - Bom e barato! - www.luzehost.com.br :D

                1 Reply Last reply Reply Quote 0
                • T
                  tommyboy180
                  last edited by

                  pfctl is used to inspect every packet that enters and exits FreeBSD. If those rules were on the disk in swap then you can image how slow inspection would take. Your entire network would slow to a crawl. This is why RAM is the only respectable option with our current technology.

                  -Tom Schaefer
                  SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                  Please support pfBlocker | File Browser | Strikeback

                  1 Reply Last reply Reply Quote 0
                  • L
                    Luzemario
                    last edited by

                    It's clear for me now. Thanks!  ;D

                    Cheapest hosting - Bom e barato! - www.luzehost.com.br :D

                    1 Reply Last reply Reply Quote 0
                    • C
                      cmb
                      last edited by

                      WARNING: Adding a heads up here, I wasn't able to fully troubleshoot the issue given it was repeatedly crashing both firewalls in a production setup, but something about the way this package modifies PF tables is able to cause recurring kernel panics in some circumstances. Seems to be only with larger rulesets given I've only seen it once (on a box that has a couple dozen interfaces and around 400 NAT and firewall rules). In this case, the package was installed but wasn't actually configured. But it still mucks with the ruleset and tables, and something it does causes serious stability problems with recurring panics that were immediately resolved by uninstalling the package.

                      Sorry I don't have any more to go on than that, tommyboy. If you create about 20 dummy VLANs, assign those as interfaces, and add a bunch of rules, you may be able to easily replicate. I haven't tried.

                      Also the way it modifies the rules file outside the normal rules process is really, really ugly and prone to race conditions. That may be the cause of the panics, or related at least. Short of using the existing package hooks in filter.inc, which aren't ideal for this kind of setup but certainly better than trying to manually hack the rules, I don't know of a perfect alternative.

                      I would NOT run this on any critical production system until that problem can be tracked down and resolved in the package. Those with small rulesets are probably safe given no one else seems to have seen this. But as always, take caution with packages labeled as anything other than stable, beta packages have the possibility of regressing the stability of your entire system to beta quality or worse.

                      1 Reply Last reply Reply Quote 0
                      • T
                        tommyboy180
                        last edited by

                        Thank you for the warning! I will look into it. I know it's kind of crazy how the rule sets are modified but I was never able to get countryblock working any other way. What would be a good package or file to look at that would help me with this problem?

                        -Tom Schaefer
                        SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                        Please support pfBlocker | File Browser | Strikeback

                        1 Reply Last reply Reply Quote 0
                        • C
                          cmb
                          last edited by

                          @tommyboy180:

                          What would be a good package or file to look at that would help me with this problem?

                          I was trying to think of a good one when I posted that, but there isn't one that's really related to what you're doing. Squid adds its own things to the filter, though I'm not sure how offhand or if that's a good example (it's much different, so probably not).

                          1 Reply Last reply Reply Quote 0
                          • T
                            tommyboy180
                            last edited by

                            What about the rules page? Are there any functions that I should pay attention to? I'm amusing I would store that info in the config but can the config be used that way?
                            Sorry for the basic questions but this is taking me back to square one.

                            -Tom Schaefer
                            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                            Please support pfBlocker | File Browser | Strikeback

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

                              Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

                              I will take a look on this and see if I can help.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • T
                                tommyboy180
                                last edited by

                                @marcelloc:

                                Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

                                Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

                                I will take a look on this and see if I can help.

                                That is an idea I had myself. My only concern is if we can use that to create a table in pfctl the same way i do in the current version. Unless there is a better way, the pfctl table allows the user selected countries to be manipulated easily and be addressed separately than the other firewall rules.

                                -Tom Schaefer
                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                Please support pfBlocker | File Browser | Strikeback

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  So if networks been stored on alias and read by countryblock While creating or updating the table could be  a 50% goal?

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tommyboy180
                                    last edited by

                                    I think that would be more than 50%. Basically if we can reach that functionality while moving away from the injection script then I would say that's a 90% solution.

                                    -Tom Schaefer
                                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                    Please support pfBlocker | File Browser | Strikeback

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      cmb
                                      last edited by

                                      The way I typically set up country blocking is with URL table aliases, just pasting in the countryblocks URL. That's limited to one country per alias though.

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        Great idea!  :)

                                        I will try to create this url table alias via php and then apply it to a rule.

                                        Thanks for that.

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          I looked at countryblock package code and saw many system calls to files and filters and many javascripts.

                                          To reach our goal to write most config to xml, I decided to use pfsense's framework and replace countryblock list from letters to continents.

                                          Alias auto insertion is done and I'm very close to reach rule creation. As Url Table alias feature also implements a table on firewall rules, I think is better to use pfsenses already done functions instead of rewriting everything.

                                          tommyboy,
                                          I know that you spent many many hours on package evolution, but I think it's time to adapt this package to 2.0 features.

                                          I'm planning to create a countryblock-dev package, so we can test it more deeply.

                                          Please, feedback.

                                          countryblock_03.png
                                          countryblock_03.png_thumb

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tommyboy180
                                            last edited by

                                            It looks great! You're really going out of your way here and I really appreciate your help!
                                            If you get it to a point where you have stable operation please send some files my way. I would like to take a look at what you have done.

                                            -Tom Schaefer
                                            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                            Please support pfBlocker | File Browser | Strikeback

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.