Country Block

tommyboy180

The problem is it isn't a RAM limitation. It's a memory max allocation variable that is small to begin with. So no matter how much RAM you have on x86 or x64 you will get that error once that limitation is hit.

This is why it is a problem. We need to be able to raise that limit other wise the functionality will be greatly limited, leaving users to fall back on IP-Blocklist.

tommyboy180

449418 Networks seems very small for level1, 2, and 3 with others. Are you sure those lists were all successful?

marcelloc

Could we include in GUI an option to increase this value and advise users that its unsupported?

EDIT:

wc -l in level files downloaded in cidr from fetch:

245749 level1
85703 level2
18753 level3
350205 total

tommyboy180

kk. We could give the users the option. It would just be inserting that text every time that file gets recreated. I've already done most of the work in IP-Blocklist and Countryblock.

/usr/local/pkg/pf/pf-blocker.sh


#!/bin/sh
export t=`grep -n 'User Aliases' /tmp/rules.debug |grep -o '[0-9]\{1,2\}'`
t=$(($t+'1'))
#Insert table-entry limit 
/usr/bin/sed -i -e '/900000/d' /tmp/rules.debug

while read line
	do a=$(($a+1)); 
	#echo $a;
	if [ "$a" = "$t" ]; then
		echo "" >> /tmp/rules.debug.tmp
		echo "set limit table-entries 900000" >> /tmp/rules.debug
	fi
	echo $line >> /tmp/rules.debug
done < "/tmp/rules.debug"

This code isn't tested but it's on the right track. We will have to have it check if the user has enabled this feature. I do this is IP-Blocklist and countryblock. Basically if the user enables it the package will create a file. If it's disabled the the file will be deleted. The script above will check if the file exists```
if [ -e FILE ] ....code here

marcelloc

ok, I think its good enough to prevent errors until some 'core developer' could help us.

I'll try to put it in php way for most code compatibility.

The last thing to finish pfBlocker is cron package integration.

tommyboy180

Cron for the updates?

marcelloc

use cron package instead of editing /etc/cront for lists updates…

sekular

Great work so far on the pfblocker package. I currently have a problem with it. I had countryblock installed and working previously. I removed that package and then installed the pfblocker package. The widget says that it is blocking networks but it comes up with a fail to load list message in the syslog.

Oct 29 01:38:43 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was 'no IP address found for 1139.82.0.0/16 /tmp/rules.debug:16: file "/var/db/aliastables/pfBlockerInbound.txt" contains bad data no IP address found for 1139.82.0.0/16 /tmp/rules.debug:18: file "/var/db/aliastables/pfBlockerOutbound.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded'
Oct 29 01:38:43 php: : New alert found: There were error(s) loading the rules: no IP address found for 1139.82.0.0/16 /tmp/rules.debug:16: file "/var/db/aliastables/pfBlockerInbound.txt" contains bad data no IP address found for 1139.82.0.0/16 /tmp/rules.debug:18: file "/var/db/aliastables/pfBlockerOutbound.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded The line in question reads [16]: table <pfblockerinbound>persist file "/var/db/aliastables/pfBlockerInbound.txt"
Oct 29 01:38:43 php: : There were error(s) loading the rules: no IP address found for 1139.82.0.0/16 /tmp/rules.debug:16: file "/var/db/aliastables/pfBlockerInbound.txt" contains bad data no IP address found for 1139.82.0.0/16 /tmp/rules.debug:18: file "/var/db/aliastables/pfBlockerOutbound.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [16]: table <pfblockerinbound>persist file "/var/db/aliastables/pfBlockerInbound.txt"

This is what happens when i only try to block countries and set none on the list block. I can try inbound or outbound and still get same error. I have tried reinstalling it. Do you know what it might be?</pfblockerinbound></pfblockerinbound>

marcelloc

Post here the countries you selected.

I will check the script.

sekular

I tired various countries, I get the same result when I select whitelist. I get the same result with all the countries. I have selected one from top spammers and one from south america. I also noticed that when i select one country from a tab then i can not unselect it. I can only select other ones. Using Chrome.

Oct 29 02:07:23 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was 'no IP address found for 192.168.81.0/2411.0.1.0/24 /tmp/rules.debug:16: file "/var/db/aliastables/pfBlockerWL.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded'
Oct 29 02:07:23 php: : New alert found: There were error(s) loading the rules: no IP address found for 192.168.81.0/2411.0.1.0/24 /tmp/rules.debug:16: file "/var/db/aliastables/pfBlockerWL.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded The line in question reads [16]: table <pfblockerwl>persist file "/var/db/aliastables/pfBlockerWL.txt"
Oct 29 02:07:23 php: : There were error(s) loading the rules: no IP address found for 192.168.81.0/2411.0.1.0/24 /tmp/rules.debug:16: file "/var/db/aliastables/pfBlockerWL.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [16]: table <pfblockerwl>persist file "/var/db/aliastables/pfBlockerWL.txt"

The rules and alias appear to be created ok.</pfblockerwl></pfblockerwl>

marcelloc

I found the error.

It's fixed now.

marcelloc

tommyboy,

Instead of editing /tmp/rules.debug, i will 'patch' filter.inc file with table-entries when clients choose to increase table.

I will also write some code to alert user when table gets larger then default limit.

tommyboy180

That sounds like a good solution. We can use sed to insert the line to 'patch' and remove the line to 'unpatch'

marcelloc

I don't believe this:

Look what i found in filter.inc after coding everything…

set limit table-entries {$config['system']['maximumtableentries']}

it was all time in front of our noses :D

I'll fix the code and relase a new version..

marcelloc

PfBlocker 0.1.3 is out.

Main improvement:

Check network list size before applying rules. If lists are bigger then table size, pfBlocker sends a warning to user and suggest new value for table size.

marcelloc

tommyboy,

I've started a new topip for pfBlocker, if you don't mind.

http://forum.pfsense.org/index.php/topic,42543.0.html

Supermule

Pfblocker???

marcelloc

@Supermule:

Pfblocker???

yes, countryblock evolution started after this post from cmb

http://forum.pfsense.org/index.php/topic,25732.msg218002.html#msg218002

take a look.

tommyboy180

@Supermule:

Pfblocker???

pfblocker will combine IP-Blocklist and Countryblock into a single package. It is going to be officially more stable than any release of Countryblock and IP-Blocklist thanks to all the hard work of marcelloc!

@marcelloc:

I don't believe this:

Look what i found in filter.inc after coding everything…

set limit table-entries {$config['system']['maximumtableentries']}

it was all time in front of our noses :D

I'll fix the code and relase a new version..

That is awesome! I didn't even see that. Glad you caught it.

Supermule

Who came up with the idea for this??? ;)