• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Country Block

Scheduled Pinned Locked Moved pfSense Packages
691 Posts 79 Posters 694.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • T
    tommyboy180
    last edited by Oct 26, 2011, 9:48 PM

    @marcelloc:

    1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

    My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

    pf-blocker. I'm sold.
    Description: Block countries and IP ranges. Replaces Countryblock and IPblocklist

    I'm liking how that sounds. Great work marcelloc! :)

    -Tom Schaefer
    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

    Please support pfBlocker | File Browser | Strikeback

    1 Reply Last reply Reply Quote 0
    • J
      johnnybe
      last edited by Oct 27, 2011, 12:53 AM

      @tommyboy180:

      @marcelloc:

      1.2.3 does not has Url table alias, so we can leave current version of countryblock and ipblocklist just for this release and release a new package for 2.0

      My suggestion for package name is pf-blocker and on package description we say that its countryblock + ipblocklist.

      pf-blocker. I'm sold.
      Description: Block countries and IP ranges. Replaces Countryblock and IPblocklist

      I'm liking how that sounds. Great work marcelloc! :)

      I like it as well.
      And thanks, both.

      you would not believe the view up here

      1 Reply Last reply Reply Quote 0
      • C
        Cino
        last edited by Oct 27, 2011, 3:26 PM

        looking good!!

        I did noticed their is still a table for countryblock and countryblockW. Not sure if that is left overs from my uninstall of countryblock.

        1 Reply Last reply Reply Quote 0
        • M
          marcelloc
          last edited by Oct 27, 2011, 10:44 PM Oct 27, 2011, 10:42 PM

          ;DpfBlocker 0.1.1 is out with: ;D

          • Countryblock features

          • Ipblocklist features

          • network block to CIDR internal feature to maintain compatibility with I-Blocklist free lists

          • many new options to choose what you want to block in and block out

          This new package is awesome in my opinion!

          TODO list:

          • code 'Update frequency' option together with cron package to stay away from file hacks

          • create a new tab for stats on what is blocked(maybe)

          • wait fixed pkg_edit.php in pfsense 2.0.1 or 2.1 to do not need a checkbox for rowhelper description

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • T
            tommyboy180
            last edited by Oct 27, 2011, 11:16 PM

            We also need a dashboard widget. We can query how many IP ranges in a pf table to display stats.

            -Tom Schaefer
            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

            Please support pfBlocker | File Browser | Strikeback

            1 Reply Last reply Reply Quote 0
            • M
              marcelloc
              last edited by Oct 27, 2011, 11:25 PM

              How countryblock widget works?

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • T
                tommyboy180
                last edited by Oct 27, 2011, 11:36 PM

                in /usr/local/www/widgets/widgets

                Basically you get the number if entries in the table to get the IP ranges

                pfctl -T show -t countryblock |grep -v -c Z
                

                Here is my working widget for version 2.4 and IPblocklist.

                @require_once("guiconfig.inc");
                @require_once("pfsense-utils.inc");
                @require_once("functions.inc");
                
                $ipblocklist_file = "/usr/local/www/packages/ipblocklist/ipblocklist.php";
                $countryblock_file = "/usr/local/www/packages/countryblock/countryblock.php";
                
                echo "echo"  ";
                if (file_exists($ipblocklist_file)) {
                	 echo "    ";
                }
                if (file_exists($countryblock_file)) {
                	 echo "    ";
                }
                echo"  ";
                echo"  ";
                if (file_exists($ipblocklist_file)) {
                	 echo "    ";
                }
                if (file_exists($countryblock_file)) {
                	 echo "    ";
                }
                echo"  ";
                echo"  ";
                if (file_exists($ipblocklist_file)) {
                	 ob_start();
                	 $resultsIP = exec("tail -r /usr/local/www/packages/ipblocklist/errorOUT.txt");
                	 ob_end_clean(); 
                	 if ($resultsIP == "") {
                	 	echo "    ";
                	 } else {
                		echo "    ";
                	 }
                }
                if (file_exists($countryblock_file)) {
                	 ob_start();
                	 $resultsCB = exec("tail -r /usr/local/www/packages/countryblock/errorOUT.txt");
                	 ob_end_clean(); 
                	 if ($resultsCB == "") {
                	 	echo "    ";
                	 } else {
                		echo "    ";
                	 }
                }
                echo"  ";
                //echo"  ";
                //if (file_exists($ipblocklist_file)) echo "    ";
                //if (file_exists($countryblock_file)) echo "    ";
                //echo"  ";
                echo"
                
                | IP-Blocklist";
                	 ob_start();
                	 $results = exec("/sbin/pfctl -s rules | grep -c ipblocklist");
                	 ob_end_clean(); 
                	 if ($results > '2') echo "![](/themes/{$g[)";
                	 else
                	 	echo "![](/themes/{$g[)";
                	 echo " | Countryblock";
                	 ob_start();
                	 $results = exec("/sbin/pfctl -s rules | grep -c countryblock");
                	 ob_end_clean(); 
                	 if ($results > '0') echo "![](/themes/{$g[)";
                	 else
                	 	echo "![](/themes/{$g[)";
                	 echo " |
                | ";
                	 ob_start();
                	 $resultsIP = exec("/sbin/pfctl -T show -t ipblocklist |grep -v -c Z");
                	 ob_end_clean();
                	 echo $resultsIP;
                	 echo " Networks";
                	 echo " | ";
                	 ob_start();
                	 $resultsCB = exec("pfctl -T show -t countryblock |grep -v -c Z");
                	 ob_end_clean();
                	 echo $resultsCB;
                	 echo " Networks";
                	 echo " |
                |  | ";
                	 	echo "
                ";
                	 	echo $resultsIP;
                		echo "";
                		echo " |  | ";
                	 	echo "
                ";
                	 	echo $resultsCB;
                		echo "";
                		echo " |
                |   |   |
                
                ";
                
                

                It's very basic.

                -Tom Schaefer
                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                Please support pfBlocker | File Browser | Strikeback

                1 Reply Last reply Reply Quote 0
                • M
                  marcelloc
                  last edited by Oct 27, 2011, 11:42 PM

                  Cool,

                  I'll take a look.

                  Maybe widget will be better then stats gui.

                  Treinamentos de Elite: http://sys-squad.com

                  Help a community developer! ;D

                  1 Reply Last reply Reply Quote 0
                  • T
                    tommyboy180
                    last edited by Oct 28, 2011, 12:03 AM

                    Errors:
                    topspammers Tab -> /usr/local/pkg/pfblocker_topspammers.xml does not exists on line 175

                    I think top pfblocker_topspammers.xml was left out of pfblocker.xml

                     <additional_files_needed>http://www.pfsense.org/packages/config/pf-blocker/pfblocker_topspammers.xml
                    <prefix>/usr/local/pkg/</prefix>
                    <chmod>0755</chmod></additional_files_needed> 
                    

                    Also do we want to limit the ipblocklist functionality to CIDR lists only? I took a poll on the package forums asking users if they wanted CIDR only or to have the normal PG2 lists. If we use CIDR only then we can eliminate future problems.

                    I was talking a look at your pfblocker_Range2CIDR function and it looks good but it's a long process for very large files like Level1 and Level2 lists.

                    -Tom Schaefer
                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                    Please support pfBlocker | File Browser | Strikeback

                    1 Reply Last reply Reply Quote 0
                    • M
                      marcelloc
                      last edited by Oct 28, 2011, 12:20 AM

                      Almost all free lists from ip-blocked are p2p, so I think we can suggest CIDR but keep p2p feature.

                      I will fix missing file and test rpc sync.

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • M
                        marcelloc
                        last edited by Oct 28, 2011, 12:32 AM

                        topspammers call fixed.

                        Can you test how many time does rules apply takes when you do not change urls?

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • T
                          tommyboy180
                          last edited by Oct 28, 2011, 12:36 AM

                          iblocklist.com lets your download all lists in p2p, dat, and CIDR now. I talked with fakhir not that long ago about the ip-blocklist package and moving to CIDR.

                          -Tom Schaefer
                          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                          Please support pfBlocker | File Browser | Strikeback

                          1 Reply Last reply Reply Quote 0
                          • M
                            marcelloc
                            last edited by Oct 28, 2011, 12:41 AM

                            when I choose cidr format, all lists become 'subscription'.

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • T
                              tommyboy180
                              last edited by Oct 28, 2011, 12:48 AM

                              Copy the list URL and manually change the fileformat to "cidr". It works for all links.
                              If we can figure out how to get fetch to follow links then our users won't have to input the direct URL anymore.

                              -Tom Schaefer
                              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                              Please support pfBlocker | File Browser | Strikeback

                              1 Reply Last reply Reply Quote 0
                              • M
                                marcelloc
                                last edited by Oct 28, 2011, 1:07 AM

                                But there are other compatible lists, and custom lists can be done too.

                                I understand that CIDR is better.

                                I've tested level1 file and both(p2p and CIDR) gets errors while appying to pfsense.

                                The block2CIDR works very fine, the extra time you see is downloading time. I did a lot of tests before including it to pfBlocker.

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • T
                                  tommyboy180
                                  last edited by Oct 28, 2011, 1:11 AM

                                  I didn't think about that. You're right.
                                  I'll see if I can figure out why large lists are failing.

                                  -Tom Schaefer
                                  SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                  Please support pfBlocker | File Browser | Strikeback

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    tommyboy180
                                    last edited by Oct 28, 2011, 1:33 AM

                                    The large lists take up the default memory space. I was able to overcome this in IPblocklist version 3.5 by adding:

                                    set limit table-entries 900000
                                    

                                    I put this at the top of rules.debug. You can enter any amount that you think will be big enough but 900000 should cover all scenarios.
                                    Hopefully there is a smooth way to add this option to the rules.debug file.

                                    -Tom Schaefer
                                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                    Please support pfBlocker | File Browser | Strikeback

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      marcelloc
                                      last edited by Oct 28, 2011, 10:19 AM Oct 28, 2011, 1:44 AM

                                      @tommyboy180:

                                      The large lists take up the default memory space. I was able to overcome this in IPblocklist version 3.5 by adding:

                                      set limit table-entries 900000
                                      

                                      I put this at the top of rules.debug. You can enter any amount that you think will be big enough but 900000 should cover all scenarios.
                                      Hopefully there is a smooth way to add this option to the rules.debug file.

                                      I have no idea how to do this, but I will take a look on it.

                                      For a stand alone use, all my tests went fine. tomorrow I will check sync problems.

                                      All tests with pfBlocker, including sync between pfsenses boxes were sucessfull.

                                      Did you liked the new options in gui? It was what you were thinking?

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        Cino
                                        last edited by Oct 28, 2011, 3:11 PM

                                        Great work!! I am having an issue tho: i'm getting this error with i click on the top spammers tab:

                                        Warning: fopen(/usr/local/pkg/pfblocker_topspammers.xml): failed to open stream: No such file or directory in /etc/inc/xmlparse.inc on line 175

                                        Warning: Invalid argument supplied for foreach() in /usr/local/www/pkg_edit.php on line 418

                                        I did go thru and removed every entry of countryblock and pfblocker in my config and file system before doing installing the package again.. same results

                                        running:
                                        2.1-DEVELOPMENT (i386)
                                        built on Tue Sep 13 17:28:43 EDT 2011
                                        FreeBSD 8.1-RELEASE-p4

                                        P.S my last git sync was this morning

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          marcelloc
                                          last edited by Oct 28, 2011, 3:24 PM Oct 28, 2011, 3:22 PM

                                          Reinstall the package, there was a missing file in pfBlocker.xml

                                          I've fixed this few hours ago. Btw i'll test this in a vm.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          655 out of 691
                                          • First post
                                            655/691
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received