• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlocker

pfSense Packages
143
896
1.3m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • K
    Kamel
    last edited by Nov 28, 2011, 3:22 AM

    Forgive me if my comments seemed a bit tasteless. I got the impression marcelloc was insinuating that my abilities were insufficient. I know I shouldn't have so I apologize for that.

    I still believe it would be a good idea (and should be relatively simple to add) to check if there are enough firewall entries available for the amount of rules pfblocker applying before you submit. This was actually my primary concern, the idea of system resource usage was only secondary to this.

    1 Reply Last reply Reply Quote 0
    • M
      marcelloc
      last edited by Nov 28, 2011, 11:37 AM

      Forgive me if my comments seemed a bit tasteless. I got the impression marcelloc was insinuating that my abilities were insufficient. I know I shouldn't have so I apologize for that.

      I'm not insinuating anything. I'm here to help the project just like everybody.
      I'm sorry if my post sound offensive. It was not my intention.

      I'm improving some help messages on package gui to help even more admins.
      PfBlocker checks the ammount of entries in a list before apply, but it Does not sum all lists. I will try to include this in version 1.0.1. You maybe still getting this error if you have many rules or aliases. Just like the chart, we can get close to all situations but not all.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • S
        slagr
        last edited by Nov 28, 2011, 7:11 PM

        I have two pfsense v.2 instances, i386 (2 different networks). pfBlocker has been installed on both ones.
        It works just fine on one instance, and doesn't work on another - it doesn't block anything at all.
        I have disabled all existing firewall rules, have checked tables in Diagnostics->Tables (they exist indeed) - everything looks just fine.
        But when trying accessing internal network (WAN interface was selected for inbound rules), I'm not being blocked from the target
        network which is supposed to be blocked. Tried adding custom rules list - no luck, added a country to block list - no luck to see it working.
        The only difference between these 2 instances is that on pfBlocker has a combobox menu selector, another one has tabs.
        Both were installed from GUI. I'm totally lost. Any ideas how to check why it didn't work ?

        1 Reply Last reply Reply Quote 0
        • M
          marcelloc
          last edited by Nov 28, 2011, 8:04 PM

          make sure you are using the same version on both.

          gui was designed to fit tabs and prevent combolist.

          also check pfblocker applied rules on wan or lan.

          you need at least one rule on interface you want to apply rules.

          if you don't mind, post your rules screenshot.

          note: pfblocker use native pfsense functions to help admins. So if you have rules not working, check what is going wrong with your box.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • K
            Kamel
            last edited by Nov 29, 2011, 12:05 AM

            @marcelloc:

            Forgive me if my comments seemed a bit tasteless. I got the impression marcelloc was insinuating that my abilities were insufficient. I know I shouldn't have so I apologize for that.

            I'm not insinuating anything. I'm here to help the project just like everybody.
            I'm sorry if my post sound offensive. It was not my intention.

            I'm improving some help messages on package gui to help even more admins.
            PfBlocker checks the ammount of entries in a list before apply, but it Does not sum all lists. I will try to include this in version 1.0.1. You maybe still getting this error if you have many rules or aliases. Just like the chart, we can get close to all situations but not all.

            Increasing my firewall rules limit worked fine and it's fast with no issues (assuming I disable some other services to reduce my RAM consumption). I will admit, it was a bit of a pain figuring out what was wrong at first. Even many searches going by, it seemed people were referring to things like memory etc. I hadn't realized the number of rules in the blocklists were impacted by the number of firewall rules or I would have known what to do immediately.

            In any case, thanks for that – I think it will be a simple enough but helpful addition. I know for me personally, I'll never make the mistake again :P

            1 Reply Last reply Reply Quote 0
            • K
              Kamel
              last edited by Nov 29, 2011, 12:14 AM

              @slagr:

              it doesn't block anything at all.

              This may sound silly, but do you have any catch-all rules that might be allowing the traffic to pass before the pfblocker rules have a chance to block it?

              1 Reply Last reply Reply Quote 0
              • A
                andrew0401
                last edited by Nov 29, 2011, 1:43 PM

                Just loaded pfBlocker - initially it seemed to be just what we needed - (had a recent flurry of far eastern IP addresses appearing in the logs) - but whilst it works it seems that SquidGuard has stopped working.

                Just me or have I missed  a thread somewhere?

                Andrew

                1 Reply Last reply Reply Quote 0
                • S
                  slagr
                  last edited by Nov 29, 2011, 2:06 PM

                  @Kamel:

                  @slagr:

                  it doesn't block anything at all.

                  This may sound silly, but do you have any catch-all rules that might be allowing the traffic to pass before the pfblocker rules have a chance to block it?

                  For wan interface I disabled all rules, but not pfBlocker test one.
                  Don't have any floating rules for now. I'm trying to have as clean as possible system for testing.

                  1 Reply Last reply Reply Quote 0
                  • S
                    slagr
                    last edited by Nov 29, 2011, 2:08 PM

                    @marcelloc:

                    make sure you are using the same version on both.

                    gui was designed to fit tabs and prevent combolist.

                    also check pfblocker applied rules on wan or lan.

                    you need at least one rule on interface you want to apply rules.

                    if you don't mind, post your rules screenshot.

                    note: pfblocker use native pfsense functions to help admins. So if you have rules not working, check what is going wrong with your box.

                    1. I'm sure.
                    2. Can see only combobox (uninstalled, rebooted, cleared config.xml before rebooting - no changes.)
                    3. See my screen shots
                    4. I have one (the same) rule in both cases.
                    5. Attached.
                    6. Where can I read how to use pfsense native functions ? I'm a pfsense novice.

                    Thanks for the help.

                    global_settings_bad.jpg
                    global_settings_bad.jpg_thumb
                    rules_bad.jpg
                    rules_bad.jpg_thumb
                    system_bad.jpg
                    system_bad.jpg_thumb

                    1 Reply Last reply Reply Quote 0
                    • L
                      LinuxTracker
                      last edited by Nov 29, 2011, 10:16 PM

                      Since I installed pfBlocker, Aliases seem kind of wonky.
                      I've searched the thread+forum, but couldn't find the right answer to my problem.

                      If I create an alias in Firewall -> Aliases; the alias doesn't show up in the dropdown list (in Rules -> Destination -> Address field).
                      Only the Aliases created in pfBlocker are available.

                      If I type out the Alias Name (correctly) I get:

                      I've tried rebooting pfSense after creating the Alias but it didn't help.
                      Am I missing something?

                      1 Reply Last reply Reply Quote 0
                      • M
                        marcelloc
                        last edited by Nov 30, 2011, 12:49 AM

                        slarg,

                        I think your are not on latest version, it should be

                        2.0-RELEASE
                        built on Tue Sep 13 17:05:32 EDT 2011

                        update it to release version, then test again.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • M
                          marcelloc
                          last edited by Nov 30, 2011, 12:54 AM

                          LinuxTracker,

                          Port alias must be applied on port field, not in host field.  ;)

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • L
                            LinuxTracker
                            last edited by Nov 30, 2011, 6:35 AM Nov 30, 2011, 6:28 AM

                            @marcelloc:

                            LinuxTracker,
                            Port alias must be applied on port field, not in host field.  ;)

                            Edited for block-headedness.

                            Yep.  You is right on, you are.

                            I sho nuff stepped into that one.

                            1 Reply Last reply Reply Quote 0
                            • A
                              andrew0401
                              last edited by Nov 30, 2011, 8:07 AM

                              Why does pfBlock create duplicate rules (or at least they look like duplicates to me) and where does it log to?  The dashboard widget is showing an increase in packet count but I seem unable to find out what is causing it.

                              Andrew

                              1 Reply Last reply Reply Quote 0
                              • R
                                RonpfS
                                last edited by Nov 30, 2011, 8:35 AM Nov 30, 2011, 8:32 AM

                                @andrew0401:

                                Why does pfBlock create duplicate rules (or at least they look like duplicates to me) and where does it log to?  The dashboard widget is showing an increase in packet count but I seem unable to find out what is causing it.

                                Andrew

                                pfBlocker package log to Status: System logs: System
                                Just click Enable Logging under Firewall: pfBlocker for list action that are NOT Alias only.
                                The pfBlocker auto generated rules will log events under Status: System logs: Firewal.

                                When you use a pfBlocker Alias in your custom Firewall rules, select Log packets that are handled by this rule

                                You can see more details in the firewall logs when you enable Show raw filter logs under Status: System logs: Settings

                                2.4.5-RELEASE-p1 (amd64)
                                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                1 Reply Last reply Reply Quote 0
                                • A
                                  andrew0401
                                  last edited by Nov 30, 2011, 10:46 AM

                                  pfBlocker package log to Status: System logs: System

                                  ***  Thanks for the info

                                  Just click Enable Logging under Firewall: pfBlocker for list action that are NOT Alias only.

                                  ***  Already set

                                  The pfBlocker auto generated rules will log events under Status: System logs: Firewal.

                                  ***  Not found them

                                  When you use a pfBlocker Alias in your custom Firewall rules, select Log packets that are handled by this rule

                                  ***  Already set

                                  You can see more details in the firewall logs when you enable Show raw filter logs under Status: System logs: Settings

                                  ***  Still no sign of anything that matchs

                                  Also why are all the rules duplicated?

                                  Andrew

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    marcelloc
                                    last edited by Nov 30, 2011, 11:03 AM

                                    Also why are all the rules duplicated?

                                    Can you take a screenshot of this duplicates?

                                    ***  Still no sign of anything that matchs

                                    It will log as firewall rules, no extra info about pfBlocker package.

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      slagr
                                      last edited by Nov 30, 2011, 6:17 PM

                                      @marcelloc:

                                      slarg,

                                      I think your are not on latest version, it should be

                                      2.0-RELEASE
                                      built on Tue Sep 13 17:05:32 EDT 2011

                                      update it to release version, then test again.

                                      marcelloc, thank you. That was the problem. It works just fine now.
                                      Thanks again for the excellent package.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        andrew0401
                                        last edited by Dec 2, 2011, 11:43 AM

                                        Duplicate rules on the WAN - if I delete one set then everything still works - but as soon as I open the pfblocker screen they reappear.

                                        Also - when causes the count in the dashboard widget reset to zero?

                                        Andrew

                                        ![New Picture.jpg](/public/imported_attachments/1/New Picture.jpg)
                                        ![New Picture.jpg_thumb](/public/imported_attachments/1/New Picture.jpg_thumb)

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          marcelloc
                                          last edited by Dec 2, 2011, 12:08 PM Dec 2, 2011, 11:50 AM

                                          Do you have modified description rules? try to delete all pfblocker rules and then reaply config.

                                          also check what version of pfBlocker you are using. Current version is 1.0

                                          Everytime you apply rules, pfSense reset counters.

                                          Just for suggestion, spyware and Adverts works better with action deny outbound, so while browsing pfsense reject connections to these sites/links.

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          223 out of 896
                                          • First post
                                            223/896
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.