Country Block

marcelloc

Countryblock-dev 0.4.2 fixes pfctl rule creation.

Cino

marccelloc,

other then trying to goto a blocked country. How do we know its working? I ask because under "Services", my box is telling me its not started.

2.1-DEVELOPMENT (i386)
built on Tue Sep 13 17:28:43 EDT 2011
FreeBSD 8.1-RELEASE-p4

marcelloc

There is no service in version 0.4.

To check contryblock, look:

Firewall -> aliases
Firewall -> rules
Diagnostcs -> Tables
on console -> pfctl -sa

I will also try to remove this service option.

tommyboy180

Okay,
So far I'm seeing good performance and it's working as I expect it to. We need to be ready to have the lists be downloaded from an archive like version 2.4 does. The reason is countryipblocks.net was getting way to much traffic from my pfsense users. It caused problems on their website so keep that in mind.

Still testing but I'm liking it. I do want to change some GUI components before we replace 2.4.

marcelloc

Have you ever thought about joining Countryblock and IPblocklist?

I've looked ipblocklist and both look very similar.

I do want to change some GUI components before we replace 2.4.

Feel free to change gui options, but keep in mind that's not so easy to customize xml options while using pfsense framework.

The reason is countryipblocks.net was getting way to much traffic from my pfsense users

Is there a problem on doing it only during install?

tommyboy180

@marcelloc:

Have you ever thought about joining Countryblock and IPblocklist?

I've looked ipblocklist and both look very similar.

I do want to change some GUI components before we replace 2.4.

Feel free to change gui options, but keep in mind that's not so easy to customize xml options while using pfsense framework.

The reason is countryipblocks.net was getting way to much traffic from my pfsense users

Is there a problem on doing it only during install?

I have thought about joining Countryblock and IPblocklist. This idea was brought up to me not that long ago. I still consider them two separate entities but I will think about it. If we did combine the two, the IPBlocklist app would be CIDR only. We would need a new name for the packages if combined, perhaps the forums users can help us name it. I can tell you that I have plans on using your code to update IPblocklist if we don't combine them.

With countryipblocks.net, the way you're doing it shouldn't be a problem, now that I'm thinking about it. In an older version of countryblock I had it so that it would download the country list every time it was applied which is where the problems started. Downloading the lists on install is perfect.

What are your thoughts on pfsense 1.2.3 as far as these packages go? Should the older versions stay with 1.2.3 or should we work on updating them as well?

marcelloc

1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

jorgelustosa

My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

My suggestion for package name is just "blocker" …

tommyboy180

@marcelloc:

1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

pf-blocker. I'm sold.
Description: Block countries and IP ranges. Replaces Countryblock and IPblocklist

I'm liking how that sounds. Great work marcelloc! :)

johnnybe

@tommyboy180:

@marcelloc:

1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

pf-blocker. I'm sold.
Description: Block countries and IP ranges. Replaces Countryblock and IPblocklist

I'm liking how that sounds. Great work marcelloc! :)

I like it as well.
And thanks, both.

Cino

looking good!!

I did noticed their is still a table for countryblock and countryblockW. Not sure if that is left overs from my uninstall of countryblock.

marcelloc

;DpfBlocker 0.1.1 is out with: ;D

Countryblock features
Ipblocklist features
network block to CIDR internal feature to maintain compatibility with I-Blocklist free lists
many new options to choose what you want to block in and block out

This new package is awesome in my opinion!

TODO list:

code 'Update frequency' option together with cron package to stay away from file hacks
create a new tab for stats on what is blocked(maybe)
wait fixed pkg_edit.php in pfsense 2.0.1 or 2.1 to do not need a checkbox for rowhelper description

tommyboy180

We also need a dashboard widget. We can query how many IP ranges in a pf table to display stats.

marcelloc

How countryblock widget works?

tommyboy180

in /usr/local/www/widgets/widgets

Basically you get the number if entries in the table to get the IP ranges

pfctl -T show -t countryblock |grep -v -c Z

Here is my working widget for version 2.4 and IPblocklist.

@require_once("guiconfig.inc");
@require_once("pfsense-utils.inc");
@require_once("functions.inc");

$ipblocklist_file = "/usr/local/www/packages/ipblocklist/ipblocklist.php";
$countryblock_file = "/usr/local/www/packages/countryblock/countryblock.php";

echo "echo"  ";
if (file_exists($ipblocklist_file)) {
	 echo "    ";
}
if (file_exists($countryblock_file)) {
	 echo "    ";
}
echo"  ";
echo"  ";
if (file_exists($ipblocklist_file)) {
	 echo "    ";
}
if (file_exists($countryblock_file)) {
	 echo "    ";
}
echo"  ";
echo"  ";
if (file_exists($ipblocklist_file)) {
	 ob_start();
	 $resultsIP = exec("tail -r /usr/local/www/packages/ipblocklist/errorOUT.txt");
	 ob_end_clean(); 
	 if ($resultsIP == "") {
	 	echo "    ";
	 } else {
		echo "    ";
	 }
}
if (file_exists($countryblock_file)) {
	 ob_start();
	 $resultsCB = exec("tail -r /usr/local/www/packages/countryblock/errorOUT.txt");
	 ob_end_clean(); 
	 if ($resultsCB == "") {
	 	echo "    ";
	 } else {
		echo "    ";
	 }
}
echo"  ";
//echo"  ";
//if (file_exists($ipblocklist_file)) echo "    ";
//if (file_exists($countryblock_file)) echo "    ";
//echo"  ";
echo"

| IP-Blocklist";
	 ob_start();
	 $results = exec("/sbin/pfctl -s rules | grep -c ipblocklist");
	 ob_end_clean(); 
	 if ($results > '2') echo "![](/themes/{$g[)";
	 else
	 	echo "![](/themes/{$g[)";
	 echo " | Countryblock";
	 ob_start();
	 $results = exec("/sbin/pfctl -s rules | grep -c countryblock");
	 ob_end_clean(); 
	 if ($results > '0') echo "![](/themes/{$g[)";
	 else
	 	echo "![](/themes/{$g[)";
	 echo " |
| ";
	 ob_start();
	 $resultsIP = exec("/sbin/pfctl -T show -t ipblocklist |grep -v -c Z");
	 ob_end_clean();
	 echo $resultsIP;
	 echo " Networks";
	 echo " | ";
	 ob_start();
	 $resultsCB = exec("pfctl -T show -t countryblock |grep -v -c Z");
	 ob_end_clean();
	 echo $resultsCB;
	 echo " Networks";
	 echo " |
|  | ";
	 	echo "
";
	 	echo $resultsIP;
		echo "";
		echo " |  | ";
	 	echo "
";
	 	echo $resultsCB;
		echo "";
		echo " |
|   |   |

";

It's very basic.

marcelloc

Cool,

I'll take a look.

Maybe widget will be better then stats gui.

tommyboy180

Errors:
topspammers Tab -> /usr/local/pkg/pfblocker_topspammers.xml does not exists on line 175

I think top pfblocker_topspammers.xml was left out of pfblocker.xml

 <additional_files_needed>http://www.pfsense.org/packages/config/pf-blocker/pfblocker_topspammers.xml
<prefix>/usr/local/pkg/</prefix>
<chmod>0755</chmod></additional_files_needed>

Also do we want to limit the ipblocklist functionality to CIDR lists only? I took a poll on the package forums asking users if they wanted CIDR only or to have the normal PG2 lists. If we use CIDR only then we can eliminate future problems.

I was talking a look at your pfblocker_Range2CIDR function and it looks good but it's a long process for very large files like Level1 and Level2 lists.

marcelloc

Almost all free lists from ip-blocked are p2p, so I think we can suggest CIDR but keep p2p feature.

I will fix missing file and test rpc sync.

marcelloc

topspammers call fixed.

Can you test how many time does rules apply takes when you do not change urls?

tommyboy180

iblocklist.com lets your download all lists in p2p, dat, and CIDR now. I talked with fakhir not that long ago about the ip-blocklist package and moving to CIDR.