Country Block

Luzemario

Sorry… An memory module was badly inserted, giving only 128MB of ram to system.

I am wondering how much ram memory CIDR table needs to get loaded.

System activity (CountryBlocks not running):

last pid: 61581; load averages: 0.00, 0.00, 0.00 up 0+02:26:21 13:27:14
104 processes: 2 running, 85 sleeping, 17 waiting

Mem: 40M Active, 34M Inact, 40M Wired, 32M Buf, 108M Free
Swap: 512M Total, 512M Free

PID USERNAME PRI NICE SIZE RES STATE TIME WCPU COMMAND
11 root 171 ki31 0K 8K RUN 140:01 98.19% idle
56575 root 48 0 34140K 21968K piperd 0:07 1.66% php
12 root -32 - 0K 136K WAIT 0:47 0.00% {swi4: clock}
0 root 76 0 0K 56K sched 0:41 0.00% {swapper}
12 root -68 - 0K 136K WAIT 0:10 0.00% {irq11: vr0 ehci0}
6364 root 76 20 3656K 1496K wait 0:05 0.00% sh
45484 root 44 0 3316K 1336K select 0:05 0.00% apinger
56548 root 76 0 33116K 19020K accept 0:04 0.00% php
50217 root 44 0 6588K 4808K kqread 0:03 0.00% lighttpd
12 root -68 - 0K 136K WAIT 0:02 0.00% {irq10: ral0 uhci}
14 root -16 - 0K 8K - 0:02 0.00% yarrow
60024 dhcpd 44 0 8436K 5100K select 0:01 0.00% dhcpd
4 root -8 - 0K 8K - 0:01 0.00% g_down
22 root 44 - 0K 8K syncer 0:01 0.00% syncer
3 root -8 - 0K 8K - 0:01 0.00% g_up
27717 root 44 0 4944K 2512K select 0:01 0.00% syslogd
2 root -8 - 0K 8K - 0:01 0.00% g_event
2651 root 64 20 7824K 5880K select 0:01 0.00% {siproxd}

tommyboy180

Like I said it depends on your usage. If you block a small country range then you won't need much RAM at all, but if you're blocking large ranges then you will need more RAM.

Luzemario

Thanks for the info. Usually I let only my country unblocked (Brazil), leaving all other countries checked. Despite this, I can't understand why I have 512MB of swap, and it is not used during table loading. Could you explain how loading is done (it is a RAM-only function)?

Thank you for your time.

tommyboy180

pfctl is used to inspect every packet that enters and exits FreeBSD. If those rules were on the disk in swap then you can image how slow inspection would take. Your entire network would slow to a crawl. This is why RAM is the only respectable option with our current technology.

Luzemario

It's clear for me now. Thanks! ;D

cmb

WARNING: Adding a heads up here, I wasn't able to fully troubleshoot the issue given it was repeatedly crashing both firewalls in a production setup, but something about the way this package modifies PF tables is able to cause recurring kernel panics in some circumstances. Seems to be only with larger rulesets given I've only seen it once (on a box that has a couple dozen interfaces and around 400 NAT and firewall rules). In this case, the package was installed but wasn't actually configured. But it still mucks with the ruleset and tables, and something it does causes serious stability problems with recurring panics that were immediately resolved by uninstalling the package.

Sorry I don't have any more to go on than that, tommyboy. If you create about 20 dummy VLANs, assign those as interfaces, and add a bunch of rules, you may be able to easily replicate. I haven't tried.

Also the way it modifies the rules file outside the normal rules process is really, really ugly and prone to race conditions. That may be the cause of the panics, or related at least. Short of using the existing package hooks in filter.inc, which aren't ideal for this kind of setup but certainly better than trying to manually hack the rules, I don't know of a perfect alternative.

I would NOT run this on any critical production system until that problem can be tracked down and resolved in the package. Those with small rulesets are probably safe given no one else seems to have seen this. But as always, take caution with packages labeled as anything other than stable, beta packages have the possibility of regressing the stability of your entire system to beta quality or worse.

tommyboy180

Thank you for the warning! I will look into it. I know it's kind of crazy how the rule sets are modified but I was never able to get countryblock working any other way. What would be a good package or file to look at that would help me with this problem?

cmb

@tommyboy180:

What would be a good package or file to look at that would help me with this problem?

I was trying to think of a good one when I posted that, but there isn't one that's really related to what you're doing. Squid adds its own things to the filter, though I'm not sure how offhand or if that's a good example (it's much different, so probably not).

tommyboy180

What about the rules page? Are there any functions that I should pay attention to? I'm amusing I would store that info in the config but can the config be used that way?
Sorry for the basic questions but this is taking me back to square one.

marcelloc

Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

I will take a look on this and see if I can help.

tommyboy180

@marcelloc:

Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

I will take a look on this and see if I can help.

That is an idea I had myself. My only concern is if we can use that to create a table in pfctl the same way i do in the current version. Unless there is a better way, the pfctl table allows the user selected countries to be manipulated easily and be addressed separately than the other firewall rules.

marcelloc

So if networks been stored on alias and read by countryblock While creating or updating the table could be a 50% goal?

tommyboy180

I think that would be more than 50%. Basically if we can reach that functionality while moving away from the injection script then I would say that's a 90% solution.

cmb

The way I typically set up country blocking is with URL table aliases, just pasting in the countryblocks URL. That's limited to one country per alias though.

marcelloc

Great idea! :)

I will try to create this url table alias via php and then apply it to a rule.

Thanks for that.

marcelloc

I looked at countryblock package code and saw many system calls to files and filters and many javascripts.

To reach our goal to write most config to xml, I decided to use pfsense's framework and replace countryblock list from letters to continents.

Alias auto insertion is done and I'm very close to reach rule creation. As Url Table alias feature also implements a table on firewall rules, I think is better to use pfsenses already done functions instead of rewriting everything.

tommyboy,
I know that you spent many many hours on package evolution, but I think it's time to adapt this package to 2.0 features.

I'm planning to create a countryblock-dev package, so we can test it more deeply.

Please, feedback.

countryblock_03.png_thumb

tommyboy180

It looks great! You're really going out of your way here and I really appreciate your help!
If you get it to a point where you have stable operation please send some files my way. I would like to take a look at what you have done.

pfsense_isti

Hi,

I use PFSense 2.0 on a small Alix-Board.

My Questions:

As I know there was a tab (Reiter) also for Mail to avoid Spams. In my version I have seen it no longer… Why?
This CountryBlock denies traffic from these countries. Is there any way to block IN THESE countries I chosen for being blocked.

Thank you for your help and the many hours you spent with thr development.

Rergards,

I.

tommyboy180

@pfsense_isti:

Hi,

I use PFSense 2.0 on a small Alix-Board.

My Questions:

As I know there was a tab (Reiter) also for Mail to avoid Spams. In my version I have seen it no longer… Why?

This CountryBlock denies traffic from these countries. Is there any way to block IN THESE countries I chosen for being blocked.

Thank you for your help and the many hours you spent with thr development.

Rergards,

I.

The mail tab never blocked SPAM. It would send you an email if countryblock stopped working but since that time this package works relatively stable.
To answer your second question, no. If you are in that country then I would not recommend doing that. You may experience negative effects.

marcelloc

HI all,

I've just finished countryblock rule creation. ;D

I will fix instalation and publish countryblock-dev package today.

Now contryblock only uses pfsense native options, so I think stable state will be very soon.