Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.3m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tommyboy180
      last edited by

      countryipblocks.net is testing their latest IPv4 Network Aggregation scripts and would like to have your help. They are in two formats:

      PG2 and IP Range.

      If you get a chance, please test them with us and give feedback so we can pass on to countryipblocks.

      www.countryipblocks.net

      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by

        I ran into an issue with pfBlocker when trying to copy the configuration onto a new install.

        I am using aliases only, a Block in rule on WAN, a Reject out rule on LAN.
        I have the following packages: Backup 0.1.5, Cron 0.1.5, Filemanager 0.1.1, pfBlocker 1.0.1, Snort 2.9.1 v 2.0.2
        Running pfsense 2.0.1 x86

        1. I saved the configuration including RRD data

        2. I restored the configuration to a fresh 2.0.1 install on the same machine

        It rebooted and started to install packages, but pfsense could not access the internet because of the pfBlocker was not running and the missing aliases break the firewall.
        I could not recover, removing rules didn' work. I was spending too much time trying things and failing, I ended up cloning the old disk instead.

        What is the way to recover from the pfBlocker aliases problem?
        just removing the rules in the GUI didn't work. I didn't try to remove the table or alias.
        I remove the rules in the config.xml, to no available.
        Today I see that I should have removed the alias. Is this enough?
        I do not have a spare machine to do testing.

        What is the best way to copy the configuration ?
        Was I supposed to install all the packages before restoring the configuration?
        This might have worked if the Restore config script did the package install before the reboot.
        (or download the package now before the reboot to prepare for package install)

        I guess removing the rules and disabling pfBlocker before saving the configuration should work.

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          I restored the configuration to a fresh 2.0.1 install on the same machine

          You may need to install packages before config restore

          I did few upgrades with pfblocker installed with no erros, but I did not tried a system restore.

          I'll try to reproduce it.

          Are you using pfBlocker on full install or nanobsd?

          I guess removing the rules and disabling pfBlocker before saving the configuration should work.

          This should be the best option

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • RonpfSR
            RonpfS
            last edited by

            @marcelloc:

            Are you using pfBlocker on full install or nanobsd?

            Full install from CD pfSense-2.0.1-RELEASE-i386.iso.gz

            2.0.1-RELEASE (i386)
            built on Mon Dec 12 18:24:17 EST 2011
            FreeBSD 8.1-RELEASE-p6

            Platform pfSense
            CPU Type Intel(R) Pentium(R) 4 CPU 1.80GHz

            2.4.5-RELEASE-p1 (amd64)
            Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
            Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

            1 Reply Last reply Reply Quote 0
            • T
              taryezveb
              last edited by

              @marcelloc:

              I'll include this ini_set('memory_limit', '250M') patch when pfblocker detects a x64 version.

              marcelloc,

              Just wanted to report back. After using the above now for the last 6 days. I don't see that affecting anything.

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                countryipblocks.net released a new bogon network list on their site,

                check this out.  :)

                http://forum.pfsense.org/index.php/topic,44867.msg233407.html#msg233407

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • T
                  taryezveb
                  last edited by

                  I had to do a configuration restore today and I'm not getting any php memory error(s) so far. This includes reinstalling all packages. So, ini_set("memory_limit", "250M") in /usr/local/pkg/pfblocker.inc  seems to not be needed here anymore, well at least so far. Will report back if I start to get the php memory error(s). But I wonder why it is working fine now without editing /usr/local/pkg/pfblocker.inc ?

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    when you apply a new list, pfblocker may increase memory usage do download list and apply it to alias.

                    when you upgrade downloaded files are not removed. The ini_set("memory_limit", "250M") will be merged to next release and used when x64 instalation is detected.

                    Thanks for your feedback  :)

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • T
                      taryezveb
                      last edited by

                      Great, Thanks :)

                      1 Reply Last reply Reply Quote 0
                      • F
                        firestrife23
                        last edited by

                        I'm seeing double entries for each rules list auto generated by pfblocker under firewall's rules… Is that's normal?

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          If you checked deny both, then will be two rules with the same list on each interface firewall rules.

                          Can you check if they are identical?

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • F
                            firestrife23
                            last edited by

                            All of my rules are set to "Deny Inbound"

                            1 Reply Last reply Reply Quote 0
                            • B
                              biogoon
                              last edited by

                              Hi there. I'm running into a problem syncing my two pfSense 2.0.1 systems. The aliases do not appear to be synced when I make a change within pfBlocker. If I add an alias by hand, that syncs fine. Here is the error being reported in the log of the slave system when I try to turn on the TopSpammers rule:

                              php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerTopSpammers.txt.tmp' > '/var/db/aliastables/pfBlockerTopSpammers.txt'' returned exit code '1', the output was ''

                              Any hints or thoughts?

                              Thanks!

                              1 Reply Last reply Reply Quote 0
                              • marcellocM
                                marcelloc
                                last edited by

                                biogoon,

                                I'll try to simulate it this weekend.

                                Treinamentos de Elite: http://sys-squad.com

                                Help a community developer! ;D

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  @firestrife23:

                                  All of my rules are set to "Deny Inbound"

                                  I have no duplicates here, can you send screenshots of your configuration as well system version?

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    Cino
                                    last edited by

                                    I think I may have found a small bug with the package… I haven't re-read all 22 pages but did some searching within the topic and couldn't find it.

                                    I'm using squid to improve web performance and for logging.. I have setup a couple of list within pfBlocker to block inbound(WAN) and outbound(LAN) Since squid uses localhost, i figured it would need to be a floating rule for it to catch. After reading a few post, but hunch was right..

                                    After creating the floating rules, they seem to work.. But anytime I make a change within the pfBlocker config pages or just re-save, it deleted the floating rules. I'm thinking this is because pfBlocker deletes and re-creates the Alias's when the configuration its save..

                                    I tried to create a new alias and nest the pfBlockers alias's into it but pfSense didn't like that.. I thought about creating brand new url table alias but then that would be a waste of memory.

                                    any thoughts?

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      What description did you configured on floating rule?

                                      If it was pfBlockeraliasname something rule, then pfBlocker will remove it.

                                      Try 'pfBlockeraliasname for squid' and see if it survive an apply

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        Cino
                                        last edited by

                                        I tried that and it didn't work, but "pfBlocker-aliasname for Squid"  does.. The '-' made the difference.. As always, thank you!!

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          taryezveb
                                          last edited by

                                          @Cino:

                                          I'm using squid to improve web performance and for logging.. I have setup a couple of list within pfBlocker to block inbound(WAN) and outbound(LAN) Since squid uses localhost, i figured it would need to be a floating rule for it to catch. After reading a few post, but hunch was right..

                                          Can you please explain. Does this mean if one is using Squid and pfBlocker. A floating rule for Squid is need in order for Squid to use the lists used in pfBlocker?

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @taryezveb:

                                            Can you please explain. Does this mean if one is using Squid and pfBlocker. A floating rule for Squid is need in order for Squid to use the lists used in pfBlocker?

                                            Yes, read this topic.

                                            http://forum.pfsense.org/index.php/topic,44479.0.html

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.