Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Country Block

    Scheduled Pinned Locked Moved pfSense Packages
    691 Posts 79 Posters 688.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tommyboy180
      last edited by

      Feedback:

      The GUI works nicely. I am able to maneuver and find exactly what I am looking for without issue. Excellent job.
      The GUI execution is great. Immediately the country block rule was created in the LAN firewall rules.

      Problems:
      Inbound filter did not get applied to WAN firewall rules even though it's selected. I feel this is crucial and one of countryblock's greatest features.
      No blocking is actually taking place. Rules.debug does not have countryblock rules and there seems to be an error in rules.debug```

      unresolvable dest aliases Countryblock inbound deny rule label "USER_RULE: Countryblock inbound deny rule"

      
      I see that you have a table that you create in /var/db/aliastables and it works perfectly, however when the rule is applied you always get an error like```
      # unresolvable dest aliases Countryblock inbound deny rule label "USER_RULE: Countryblock inbound deny rule"
      
      

      The rules I create with countryblock version 2.4 look like

      #countryblock
      table <countryblock>persist file '/usr/local/www/packages/countryblock/lists/countries.txt'
      table <countryblockw>persist file '/usr/local/www/packages/countryblock/countries-white.txt'
      pass quick from <countryblockw>to any label 'countryblock'
      pass quick from any to <countryblockw>label 'countryblock'
      block quick from <countryblock>to any label 'countryblock'</countryblock></countryblockw></countryblockw></countryblockw></countryblock> 
      

      This was created in it's own countryblock section which I feel I can modify version 2.4 to place these rules into the "# User-defined rules follow" section and double version 2.4's compatibility and stability. That's another topic though :)

      On another subject, I really like how you made everything work. I love the XML package and it shows me that I have much to learn!

      I'm still looking everything over to make sure everything is going the way it should. Sorry if I seem too involved but countryblock is my baby, same with ipblocklist. We need to figure out why the countryblock rules are not being applied correctly in rules.debug. I'm guessing there is a typo in the inc within the sync function. Nice validation BTW.

      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        I forgot to finish XMLRPC SYNC, I'm doing it right now.

        I saw the same problem on WAN. Its the default xml options that shows in gui but do not apply on XML, so I will remove Default option.
        To workaround that, just unselect/select WAN and save.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          Package version 0.4.1 released with many bugs fixed and sync between pfsense boxes working.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            Countryblock-dev 0.4.2 fixes pfctl rule creation.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • C
              Cino
              last edited by

              marccelloc,

              other then trying to goto a blocked country. How do we know its working? I ask because under "Services", my box is telling me its not started.

              2.1-DEVELOPMENT (i386)
              built on Tue Sep 13 17:28:43 EDT 2011
              FreeBSD 8.1-RELEASE-p4

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                There is no service in version 0.4.

                To check contryblock, look:

                • Firewall -> aliases

                • Firewall -> rules

                • Diagnostcs -> Tables

                • on console -> pfctl -sa

                I will also try to remove this service option.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • T
                  tommyboy180
                  last edited by

                  Okay,
                  So far I'm seeing good performance and it's working as I expect it to. We need to be ready to have the lists be downloaded from an archive like version 2.4 does. The reason is countryipblocks.net was getting way to much traffic from my pfsense users. It caused problems on their website so keep that in mind.

                  Still testing but I'm liking it. I do want to change some GUI components before we replace 2.4.

                  -Tom Schaefer
                  SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                  Please support pfBlocker | File Browser | Strikeback

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    Have you ever thought about joining Countryblock and IPblocklist?

                    I've looked ipblocklist and both look very similar.

                    I do want to change some GUI components before we replace 2.4.

                    Feel free to change gui options, but keep in mind that's not so easy to customize xml options while using pfsense framework.

                    The reason is countryipblocks.net was getting way to much traffic from my pfsense users

                    Is there a problem on doing it only during install?

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • T
                      tommyboy180
                      last edited by

                      @marcelloc:

                      Have you ever thought about joining Countryblock and IPblocklist?

                      I've looked ipblocklist and both look very similar.

                      I do want to change some GUI components before we replace 2.4.

                      Feel free to change gui options, but keep in mind that's not so easy to customize xml options while using pfsense framework.

                      The reason is countryipblocks.net was getting way to much traffic from my pfsense users

                      Is there a problem on doing it only during install?

                      I have thought about joining Countryblock and IPblocklist. This idea was brought up to me not that long ago. I still consider them two separate entities but I will think about it. If we did combine the two, the IPBlocklist app would be CIDR only. We would need a new name for the packages if combined, perhaps the forums users can help us name it. I can tell you that I have plans on using your code to update IPblocklist if we don't combine them.

                      With countryipblocks.net, the way you're doing it shouldn't be a problem, now that I'm thinking about it. In an older version of countryblock I had it so that it would download the country list every time it was applied which is where the problems started. Downloading the lists on install is perfect.

                      What are your thoughts on pfsense 1.2.3 as far as these packages go? Should the older versions stay with 1.2.3 or should we work on updating them as well?

                      -Tom Schaefer
                      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                      Please support pfBlocker | File Browser | Strikeback

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

                        My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • J
                          jorgelustosa
                          last edited by

                          My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

                          My suggestion for package name is just "blocker" …

                          1 Reply Last reply Reply Quote 0
                          • T
                            tommyboy180
                            last edited by

                            @marcelloc:

                            1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

                            My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

                            pf-blocker. I'm sold.
                            Description: Block countries and IP ranges. Replaces Countryblock and IPblocklist

                            I'm liking how that sounds. Great work marcelloc! :)

                            -Tom Schaefer
                            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                            Please support pfBlocker | File Browser | Strikeback

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnnybe
                              last edited by

                              @tommyboy180:

                              @marcelloc:

                              1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

                              My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

                              pf-blocker. I'm sold.
                              Description: Block countries and IP ranges. Replaces Countryblock and IPblocklist

                              I'm liking how that sounds. Great work marcelloc! :)

                              I like it as well.
                              And thanks, both.

                              you would not believe the view up here

                              1 Reply Last reply Reply Quote 0
                              • C
                                Cino
                                last edited by

                                looking good!!

                                I did noticed their is still a table for countryblock and countryblockW. Not sure if that is left overs from my uninstall of countryblock.

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  ;DpfBlocker 0.1.1 is out with: ;D

                                  • Countryblock features

                                  • Ipblocklist features

                                  • network block to CIDR internal feature to maintain compatibility with I-Blocklist free lists

                                  • many new options to choose what you want to block in and block out

                                  This new package is awesome in my opinion!

                                  TODO list:

                                  • code 'Update frequency' option together with cron package to stay away from file hacks

                                  • create a new tab for stats on what is blocked(maybe)

                                  • wait fixed pkg_edit.php in pfsense 2.0.1 or 2.1 to do not need a checkbox for rowhelper description

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tommyboy180
                                    last edited by

                                    We also need a dashboard widget. We can query how many IP ranges in a pf table to display stats.

                                    -Tom Schaefer
                                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                    Please support pfBlocker | File Browser | Strikeback

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      How countryblock widget works?

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tommyboy180
                                        last edited by

                                        in /usr/local/www/widgets/widgets

                                        Basically you get the number if entries in the table to get the IP ranges

                                        pfctl -T show -t countryblock |grep -v -c Z
                                        

                                        Here is my working widget for version 2.4 and IPblocklist.

                                        @require_once("guiconfig.inc");
                                        @require_once("pfsense-utils.inc");
                                        @require_once("functions.inc");
                                        
                                        $ipblocklist_file = "/usr/local/www/packages/ipblocklist/ipblocklist.php";
                                        $countryblock_file = "/usr/local/www/packages/countryblock/countryblock.php";
                                        
                                        echo "echo"  ";
                                        if (file_exists($ipblocklist_file)) {
                                        	 echo "    ";
                                        }
                                        if (file_exists($countryblock_file)) {
                                        	 echo "    ";
                                        }
                                        echo"  ";
                                        echo"  ";
                                        if (file_exists($ipblocklist_file)) {
                                        	 echo "    ";
                                        }
                                        if (file_exists($countryblock_file)) {
                                        	 echo "    ";
                                        }
                                        echo"  ";
                                        echo"  ";
                                        if (file_exists($ipblocklist_file)) {
                                        	 ob_start();
                                        	 $resultsIP = exec("tail -r /usr/local/www/packages/ipblocklist/errorOUT.txt");
                                        	 ob_end_clean(); 
                                        	 if ($resultsIP == "") {
                                        	 	echo "    ";
                                        	 } else {
                                        		echo "    ";
                                        	 }
                                        }
                                        if (file_exists($countryblock_file)) {
                                        	 ob_start();
                                        	 $resultsCB = exec("tail -r /usr/local/www/packages/countryblock/errorOUT.txt");
                                        	 ob_end_clean(); 
                                        	 if ($resultsCB == "") {
                                        	 	echo "    ";
                                        	 } else {
                                        		echo "    ";
                                        	 }
                                        }
                                        echo"  ";
                                        //echo"  ";
                                        //if (file_exists($ipblocklist_file)) echo "    ";
                                        //if (file_exists($countryblock_file)) echo "    ";
                                        //echo"  ";
                                        echo"
                                        
                                        | IP-Blocklist";
                                        	 ob_start();
                                        	 $results = exec("/sbin/pfctl -s rules | grep -c ipblocklist");
                                        	 ob_end_clean(); 
                                        	 if ($results > '2') echo "![](/themes/{$g[)";
                                        	 else
                                        	 	echo "![](/themes/{$g[)";
                                        	 echo " | Countryblock";
                                        	 ob_start();
                                        	 $results = exec("/sbin/pfctl -s rules | grep -c countryblock");
                                        	 ob_end_clean(); 
                                        	 if ($results > '0') echo "![](/themes/{$g[)";
                                        	 else
                                        	 	echo "![](/themes/{$g[)";
                                        	 echo " |
                                        | ";
                                        	 ob_start();
                                        	 $resultsIP = exec("/sbin/pfctl -T show -t ipblocklist |grep -v -c Z");
                                        	 ob_end_clean();
                                        	 echo $resultsIP;
                                        	 echo " Networks";
                                        	 echo " | ";
                                        	 ob_start();
                                        	 $resultsCB = exec("pfctl -T show -t countryblock |grep -v -c Z");
                                        	 ob_end_clean();
                                        	 echo $resultsCB;
                                        	 echo " Networks";
                                        	 echo " |
                                        |  | ";
                                        	 	echo "
                                        ";
                                        	 	echo $resultsIP;
                                        		echo "";
                                        		echo " |  | ";
                                        	 	echo "
                                        ";
                                        	 	echo $resultsCB;
                                        		echo "";
                                        		echo " |
                                        |   |   |
                                        
                                        ";
                                        
                                        

                                        It's very basic.

                                        -Tom Schaefer
                                        SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                        Please support pfBlocker | File Browser | Strikeback

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          Cool,

                                          I'll take a look.

                                          Maybe widget will be better then stats gui.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            tommyboy180
                                            last edited by

                                            Errors:
                                            topspammers Tab -> /usr/local/pkg/pfblocker_topspammers.xml does not exists on line 175

                                            I think top pfblocker_topspammers.xml was left out of pfblocker.xml

                                             <additional_files_needed>http://www.pfsense.org/packages/config/pf-blocker/pfblocker_topspammers.xml
                                            <prefix>/usr/local/pkg/</prefix>
                                            <chmod>0755</chmod></additional_files_needed> 
                                            

                                            Also do we want to limit the ipblocklist functionality to CIDR lists only? I took a poll on the package forums asking users if they wanted CIDR only or to have the normal PG2 lists. If we use CIDR only then we can eliminate future problems.

                                            I was talking a look at your pfblocker_Range2CIDR function and it looks good but it's a long process for very large files like Level1 and Level2 lists.

                                            -Tom Schaefer
                                            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                            Please support pfBlocker | File Browser | Strikeback

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.