Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.3m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      Default rules are not saved on interface rules config XML.

      Create a rule and then apply pfBlocker config.

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • F
        fsavoir
        last edited by

        Thanks again for your reply,

        Could we be more specific? I need to add a rule in Firewall -> Rules then Lan or Wan ?

        Such a dummy rules?

        Thanks again.

        Fred

        1 Reply Last reply Reply Quote 0
        • marcellocM
          marcelloc
          last edited by

          Lan has a default rule, you will see pfBlocker rules there if you apply deny outbound action on your lists.

          If you have no wan rules, you do not need deny inbound action on pfblocker lists as you are already blocking everything.

          Treinamentos de Elite: http://sys-squad.com

          Help a community developer! ;D

          1 Reply Last reply Reply Quote 0
          • F
            fsavoir
            last edited by

            ok may be I don't explain well enough… But pfblocker never add any rules in any tabs (lan, wan, floating) of the firewall.
            So even If I had one in floating ... then select turn on pfblocker and add top country spammers... always a red down arrow :( and no rules anywear.

            So I think I'm missing something here :(

            I even added a rules to myself in the Lan... Still Red arrow.

            Again thanks.

            Fred

            1 Reply Last reply Reply Quote 0
            • F
              fsavoir
              last edited by

              OK fixed…
              I had to add by adding a floating rules to myself.... then all top spammers list.... Then active the pfblocker package.
              then it works .... Thanks again for your great support and SUPER COOL package.
              Cheers,

              Fred

              1 Reply Last reply Reply Quote 0
              • F
                fsavoir
                last edited by

                Hi,

                I'm wondering if you know how to make pfBlocker XMLRPC with Denyhost site ?
                http://xmlrpc.denyhosts.net:9911

                Thanks.

                Fred

                1 Reply Last reply Reply Quote 0
                • F
                  fsavoir
                  last edited by

                  What is list format that pfBlocker could handle ? Like  : P2P, DAT or CIDR ? in .gz, zip or txt ?

                  Thanks one more for your support.

                  Fred

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    address list could be in

                    • p2p

                    • cidr (recommended)

                    • ipaddress

                    one per line

                    The web site that host this list could send list in txt(plain) format or compressed with gz

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • F
                      fsavoir
                      last edited by

                      Thanks :)

                      Any info about : pfBlocker XMLRPC ?

                      Cheers,

                      F.

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        @fsavoir:

                        Thanks :)

                        Any info about : pfBlocker XMLRPC ?

                        Cheers,

                        F.

                        No integration with http://xmlrpc.denyhosts.net:9911 for now.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • L
                          LinuxTracker
                          last edited by

                          I'd like to offer up a copy of the Spam List I've been compiling for over a year.
                          I began compiling it for use in IPBlocklist (used with Country IP Blocks). It's now optimized for pfBlocker.

                          Here's the details/disclaimer:

                          1. 505 CIDRs as of today.
                          2. Based on spams received at the mail servers I care for.
                          3. It's focused on US Spammers but includes CIDRs from some countries I couldn't block outright. Non-US CIDRs are noted.
                            3a) A few countries I eventually gave up on and just country blocked outright (ie Poland, Peru); so there may be some inconsistency.
                          4. I converted it to CIDR format 2 weeks ago. That took a long time (orig PG ranges were 1-254).
                          5. For each spam IP, I carefully examined it's host to determine the appropriate range.
                            5a) Criteria includes bot spams, dynIP ranges and scummy hosting companies.
                            5b) For a single IP, it may take 15+ minutes of careful research before I can decide what range to block.
                          6. I generally do 2-4 update sessions every month.
                          7. Use At Your Own Risk.  I'd review it first for possible editing, if I were you.

                          I've broken the list up into 3 because it became unwieldy.
                          I've recently broken off corporate spam (ie: Linkedin, Constant Contact, exacttarget) into a fourth list. I prob still need to shift some IPs into it.

                          I thought Pastebin (Private link - 1 Month expiration) would be the most transparent option for publishing this.

                          SpamIPs_0-69  http://pastebin.com/MTds2fik
                          SpamIPs_70-179 http://pastebin.com/w0ZDtMym
                          SpamIPs_180-255 http://pastebin.com/QPi4PtMN
                          CorporateSpam http://pastebin.com/95xvHnk9

                          MODS: If this violates forum protocol, please delete the post and forgive me.
                          If a mod wants the constantly updated live url (.gz format), please PM me.
                          The update URL is under my personal domain so I can't otherwise distribute it. Sorry.

                          Thanks.

                          edit: added screencap - 8 Hours of spam hits - domain w/ ~10 email accounts.

                          pfCustomSpamList = 3 SpamIP lists above.

                          1 Reply Last reply Reply Quote 0
                          • S
                            squirreldip
                            last edited by

                            First off fantastic package!

                            I'm using pfSense as a VM in ESXi 5.0 (Host is Xeon X3320 with 8Gb RAM - VM is 2Gb RAM and 20Gb Storage).  This VM is likely overkill but didn't want issues with RAM or disk space (I'm new to pfSense).

                            Two problems:

                            1.  Everything works well using smaller Lists - Currently using Level 3 from I-BlockList (about 35,000 CIDRs).  When I try Level 1 (over 400,000) I get no system errors but it won't block and listing the pfBlocker tables produces a blank page (after a fairly long wait).  Also using Level 1 pfSense will not block the 'bad' IPs (and is very slow).

                            Is anyone else experiencing this issue?  I've read through this entire thread but haven't seen a resolution…  Is this something that is a known issue and will be fixed in future release?  If not, is the fix a manual edit?

                            2.  Not really a problem but an annoyance...  This may be by design but when pfBlocker is updated it will move it's automatically created rules to the top of their respective lists.  In order to bypass certain IPs I've created rules that pass the IPs and place these manual rules above automatic rule.  I've created a custom internal alias for IPs I do not want to protect and another custom alias for external IPs that I need connection to.  As long as these rules are above the pfBlocker rule everything is good - any time I reset/update pfBlocker and I have to manually place the auto rule back where I want it.

                            Could a possible update be to leave the rule where it sits if it already exists (and place it at the top if it's a new rule)?

                            Cheers and Thanks!

                            1 Reply Last reply Reply Quote 0
                            • F
                              fsavoir
                              last edited by

                              Thanks a lot. It's really generous from you for sharing that….
                              Really appreciated.

                              All the best,

                              Fred

                              1 Reply Last reply Reply Quote 0
                              • S
                                squirreldip
                                last edited by

                                Okay - Answered my own for '2.' above:

                                Redefine the list to be alias only and then manually add rules.  (guess I had an extended blonde moment…)

                                '1.' still has issue even if it's alias only.

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  @squirreldip:

                                  1.  Everything works well using smaller Lists - Currently using Level 3 from I-BlockList (about 35,000 CIDRs).  When I try Level 1 (over 400,000) I get no system errors but it won't block and listing the pfBlocker tables produces a blank page (after a fairly long wait).  Also using Level 1 pfSense will not block the 'bad' IPs (and is very slow).

                                  I've read through this entire thread but haven't seen a resolution…

                                  Did you saw posts about memory limit?

                                  read again page 21 of this topic and see if it helps

                                  There is also a wiki contributed by XIII

                                  http://doc.pfsense.org/index.php/Pfblocker

                                  @squirreldip:

                                  2.  Not really a problem but an annoyance…  This may be by design but when pfBlocker is updated it will move it's automatically created rules to the top of their respective lists.  In order to bypass certain IPs I've created rules that pass the IPs and place these manual rules above automatic rule.  I've created a custom internal alias for IPs I do not want to protect and another custom alias for external IPs that I need connection to.  As long as these rules are above the pfBlocker rule everything is good - any time I reset/update pfBlocker and I have to manually place the auto rule back where I want it.

                                  Okay - Answered my own for '2.' above:

                                  One way you found by yourself, the other way is to create another list on pfBlocker, paste your whitelisted ips on custom field and define action as Allow inbound or Allow outbound.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    @LinuxTracker:

                                    I'd like to offer up a copy of the Spam List I've been compiling for over a year.
                                    I began compiling it for use in IPBlocklist (used with Country IP Blocks). It's now optimized for pfBlocker.

                                    I thought Pastebin (Private link - 1 Month expiration) would be the most transparent option for publishing this.

                                    Nice contribution, thanks. :)

                                    If you want, I can publish this list for you.

                                    You can send me in pv from time to time.

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      squirreldip
                                      last edited by

                                      @marcelloc:

                                      Did you saw posts about memory limit?

                                      Thanks for the post - I'll give it a shot when I get home tonight.

                                      Is this fix something that will eventually be added to pfBlocker?  Or fixed in pfSense?  Will this fix have to be reapplied if pfSense is updated (obviously yes for a new install)?

                                      If not then maybe something should be added to the wiki speaking to list limits and possibly something pointing to a "use at your own risk" fix.

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        taryezveb
                                        last edited by

                                        @squirreldip:

                                        Is this fix something that will eventually be added to pfBlocker?  Or fixed in pfSense?  Will this fix have to be reapplied if pfSense is updated (obviously yes for a new install)?

                                        marcelloc, said yes for x64:
                                        @marcelloc:

                                        The ini_set("memory_limit", "250M") will be merged to next release and used when x64 instalation is detected.

                                        When pfBlocker package is updated. All that should be needed is to reinstall pfBlocker package.

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          squirreldip
                                          last edited by

                                          @squirreldip:

                                          @marcelloc:

                                          Did you saw posts about memory limit?

                                          Thanks for the post - I'll give it a shot when I get home tonight.

                                          Is this fix something that will eventually be added to pfBlocker?  Or fixed in pfSense?  Will this fix have to be reapplied if pfSense is updated (obviously yes for a new install)?

                                          If not then maybe something should be added to the wiki speaking to list limits and possibly something pointing to a "use at your own risk" fix.

                                          I made the changes from Page 21 and tested:  I found an IP in the list that returned a ping.  When using Level 3 list the blocker worked (would not return ping) but doing the same with the Level 1 list did not work (the ping returned).

                                          I also increased my "Firewall Maximum Table Entries" from 1,000,000 to 100,000,000 and still no luck.

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @squirreldip:

                                            I found an IP in the list that returned a ping.  When using Level 3 list the blocker worked (would not return ping) but doing the same with the Level 1 list did not work (the ping returned).

                                            what action did you choose to level1 list and what ip did you tested?

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.