• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlocker

Scheduled Pinned Locked Moved pfSense Packages
896 Posts 143 Posters 1.3m Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    marcelloc
    last edited by Jan 1, 2012, 4:53 AM Jan 1, 2012, 3:18 AM

    Thanks  ;D. Did you mentioned these packages developers on donation?

    Treinamentos de Elite: http://sys-squad.com

    Help a community developer! ;D

    1 Reply Last reply Reply Quote 0
    • T
      taryezveb
      last edited by Jan 1, 2012, 5:01 AM

      @marcelloc:

      Did you mentioned these packages developers on donation?

      Yes, I broke it down on how the donation should broken up. Like so: $XX for the X package maintainer(s).

      1 Reply Last reply Reply Quote 0
      • M
        marcelloc
        last edited by Jan 1, 2012, 5:06 AM

        I'll include this ini_set('memory_limit', '250M') patch when pfblocker detects a x64 version.

        There are other places to edit it, maybe a redmine for that as diagnostics-> tables also has a 128Mb limit even on x64.

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • T
          taryezveb
          last edited by Jan 1, 2012, 5:45 AM Jan 1, 2012, 5:14 AM

          @marcelloc:

          I'll include this ini_set('memory_limit', '250M') patch when pfblocker detects a x64 version.

          There are other places to edit it, maybe a redmine for that as diagnostics-> tables also has a 128Mb limit even on x64.

          Great and yes good point, since Diagnostics -> Tables gives a similar: Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 71 bytes) in /usr/local/www/diag_tables.php on line 89

          But at least that does not affect things like the previous "Fatal error: Allowed memory size…" did.

          1 Reply Last reply Reply Quote 0
          • T
            tommyboy180
            last edited by Jan 3, 2012, 2:44 AM

            countryipblocks.net is testing their latest IPv4 Network Aggregation scripts and would like to have your help. They are in two formats:

            PG2 and IP Range.

            If you get a chance, please test them with us and give feedback so we can pass on to countryipblocks.

            www.countryipblocks.net

            -Tom Schaefer
            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

            Please support pfBlocker | File Browser | Strikeback

            1 Reply Last reply Reply Quote 0
            • R
              RonpfS
              last edited by Jan 3, 2012, 11:36 PM Jan 3, 2012, 9:01 PM

              I ran into an issue with pfBlocker when trying to copy the configuration onto a new install.

              I am using aliases only, a Block in rule on WAN, a Reject out rule on LAN.
              I have the following packages: Backup 0.1.5, Cron 0.1.5, Filemanager 0.1.1, pfBlocker 1.0.1, Snort 2.9.1 v 2.0.2
              Running pfsense 2.0.1 x86

              1. I saved the configuration including RRD data

              2. I restored the configuration to a fresh 2.0.1 install on the same machine

              It rebooted and started to install packages, but pfsense could not access the internet because of the pfBlocker was not running and the missing aliases break the firewall.
              I could not recover, removing rules didn' work. I was spending too much time trying things and failing, I ended up cloning the old disk instead.

              What is the way to recover from the pfBlocker aliases problem?
              just removing the rules in the GUI didn't work. I didn't try to remove the table or alias.
              I remove the rules in the config.xml, to no available.
              Today I see that I should have removed the alias. Is this enough?
              I do not have a spare machine to do testing.

              What is the best way to copy the configuration ?
              Was I supposed to install all the packages before restoring the configuration?
              This might have worked if the Restore config script did the package install before the reboot.
              (or download the package now before the reboot to prepare for package install)

              I guess removing the rules and disabling pfBlocker before saving the configuration should work.

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • M
                marcelloc
                last edited by Jan 3, 2012, 9:20 PM

                I restored the configuration to a fresh 2.0.1 install on the same machine

                You may need to install packages before config restore

                I did few upgrades with pfblocker installed with no erros, but I did not tried a system restore.

                I'll try to reproduce it.

                Are you using pfBlocker on full install or nanobsd?

                I guess removing the rules and disabling pfBlocker before saving the configuration should work.

                This should be the best option

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • R
                  RonpfS
                  last edited by Jan 3, 2012, 9:55 PM

                  @marcelloc:

                  Are you using pfBlocker on full install or nanobsd?

                  Full install from CD pfSense-2.0.1-RELEASE-i386.iso.gz

                  2.0.1-RELEASE (i386)
                  built on Mon Dec 12 18:24:17 EST 2011
                  FreeBSD 8.1-RELEASE-p6

                  Platform pfSense
                  CPU Type Intel(R) Pentium(R) 4 CPU 1.80GHz

                  2.4.5-RELEASE-p1 (amd64)
                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                  1 Reply Last reply Reply Quote 0
                  • T
                    taryezveb
                    last edited by Jan 7, 2012, 8:22 PM

                    @marcelloc:

                    I'll include this ini_set('memory_limit', '250M') patch when pfblocker detects a x64 version.

                    marcelloc,

                    Just wanted to report back. After using the above now for the last 6 days. I don't see that affecting anything.

                    1 Reply Last reply Reply Quote 0
                    • M
                      marcelloc
                      last edited by Jan 9, 2012, 2:41 AM

                      countryipblocks.net released a new bogon network list on their site,

                      check this out.  :)

                      http://forum.pfsense.org/index.php/topic,44867.msg233407.html#msg233407

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • T
                        taryezveb
                        last edited by Jan 13, 2012, 12:12 AM

                        I had to do a configuration restore today and I'm not getting any php memory error(s) so far. This includes reinstalling all packages. So, ini_set("memory_limit", "250M") in /usr/local/pkg/pfblocker.inc  seems to not be needed here anymore, well at least so far. Will report back if I start to get the php memory error(s). But I wonder why it is working fine now without editing /usr/local/pkg/pfblocker.inc ?

                        1 Reply Last reply Reply Quote 0
                        • M
                          marcelloc
                          last edited by Jan 13, 2012, 2:48 AM Jan 13, 2012, 2:29 AM

                          when you apply a new list, pfblocker may increase memory usage do download list and apply it to alias.

                          when you upgrade downloaded files are not removed. The ini_set("memory_limit", "250M") will be merged to next release and used when x64 instalation is detected.

                          Thanks for your feedback  :)

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • T
                            taryezveb
                            last edited by Jan 13, 2012, 2:42 AM

                            Great, Thanks :)

                            1 Reply Last reply Reply Quote 0
                            • F
                              firestrife23
                              last edited by Jan 14, 2012, 2:40 AM

                              I'm seeing double entries for each rules list auto generated by pfblocker under firewall's rules… Is that's normal?

                              1 Reply Last reply Reply Quote 0
                              • M
                                marcelloc
                                last edited by Jan 14, 2012, 3:17 AM

                                If you checked deny both, then will be two rules with the same list on each interface firewall rules.

                                Can you check if they are identical?

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • F
                                  firestrife23
                                  last edited by Jan 14, 2012, 4:23 AM

                                  All of my rules are set to "Deny Inbound"

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    biogoon
                                    last edited by Jan 14, 2012, 5:03 AM

                                    Hi there. I'm running into a problem syncing my two pfSense 2.0.1 systems. The aliases do not appear to be synced when I make a change within pfBlocker. If I add an alias by hand, that syncs fine. Here is the error being reported in the log of the slave system when I try to turn on the TopSpammers rule:

                                    php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerTopSpammers.txt.tmp' > '/var/db/aliastables/pfBlockerTopSpammers.txt'' returned exit code '1', the output was ''

                                    Any hints or thoughts?

                                    Thanks!

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      marcelloc
                                      last edited by Jan 14, 2012, 5:22 AM

                                      biogoon,

                                      I'll try to simulate it this weekend.

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        marcelloc
                                        last edited by Jan 14, 2012, 5:33 AM

                                        @firestrife23:

                                        All of my rules are set to "Deny Inbound"

                                        I have no duplicates here, can you send screenshots of your configuration as well system version?

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          Cino
                                          last edited by Jan 15, 2012, 4:38 PM

                                          I think I may have found a small bug with the package… I haven't re-read all 22 pages but did some searching within the topic and couldn't find it.

                                          I'm using squid to improve web performance and for logging.. I have setup a couple of list within pfBlocker to block inbound(WAN) and outbound(LAN) Since squid uses localhost, i figured it would need to be a floating rule for it to catch. After reading a few post, but hunch was right..

                                          After creating the floating rules, they seem to work.. But anytime I make a change within the pfBlocker config pages or just re-save, it deleted the floating rules. I'm thinking this is because pfBlocker deletes and re-creates the Alias's when the configuration its save..

                                          I tried to create a new alias and nest the pfBlockers alias's into it but pfSense didn't like that.. I thought about creating brand new url table alias but then that would be a waste of memory.

                                          any thoughts?

                                          1 Reply Last reply Reply Quote 0
                                          319 out of 896
                                          • First post
                                            319/896
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received