PfBlocker

[Gradius]

This only happens if I reboot/shutdown my pfSense, when I perform boot it's there (this is why is important to perform at last a reboot to check if everything comes up fine again).

[filter_load] There were errors(s) loading the rules: /tmp/rules.debug:20

cannot define table pfBlockerAsia

cannot allocate memory/tmp/rules.debug:24

cannot define table pfBlockerNorthAmerica

cannot allocate memory/tmp/rules.debug.28

cannot define table pfBlockerTopSpammers

cat /tmp/rules.debug

#System aliases

loopback = "{ lo0 }"
WAN1 = "{ pppoe0 }"
LAN1 = "{ em0 }"
LAN2 = "{ em2 }"
VDSL2 = "{ em1 }"

#SSH Lockout Table
table <sshlockout> persist
table <webconfiguratorlockout> persist
#Snort tables
table <snort2c>

table <virusprot>

# User Aliases
table <pfblockerafrica> persist file "/var/db/aliastables/pfBlockerAfrica.txt"
pfBlockerAfrica = "<pfblockerafrica>"
table <pfblockerasia> persist file "/var/db/aliastables/pfBlockerAsia.txt"                  <<< line 20
pfBlockerAsia = "<pfblockerasia>"
table <pfblockereurope> persist file "/var/db/aliastables/pfBlockerEurope.txt"
pfBlockerEurope = "<pfblockereurope>"
table <pfblockernorthamerica> persist file "/var/db/aliastables/pfBlockerNorthAmerica.txt"  <<< line 24
pfBlockerNorthAmerica = "<pfblockernorthamerica>"
table <pfblockersouthamerica> persist file "/var/db/aliastables/pfBlockerSouthAmerica.txt"
pfBlockerSouthAmerica = "<pfblockersouthamerica>"
table <pfblockertopspammers> persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"    <<< line 28
pfBlockerTopSpammers = "<pfblockertopspammers>"</pfblockertopspammers></pfblockertopspammers></pfblockersouthamerica></pfblockersouthamerica></pfblockernorthamerica></pfblockernorthamerica></pfblockereurope></pfblockereurope></pfblockerasia></pfblockerasia></pfblockerafrica></pfblockerafrica></virusprot></snort2c></webconfiguratorlockout></sshlockout>

Cannot allocate memorypfctl

syntax error in config file: pf rules not loaded The line in question reads [20]: table <pfblockerasia>persist file /var/db/aliastables/pfBlockerAsia.txt

I didn't changed any of those files, I'm only blocking that area from the files it came with pfBlocker.

Any solution?

/var/db/aliastables(15): ls -la
total 1384
drwxr-xr-x  2 root  wheel    512 May  6 01:42 .
drwxr-xr-x  12 root  wheel    1024 May 13 12:38 ..
-rw-r–r--  1 root  wheel  41499 May 13 14:12 pfBlockerAfrica.txt
-rw-r--r--  1 root  wheel  196104 May 13 14:12 pfBlockerAsia.txt
-rw-r--r--  1 root  wheel  71153 May 13 14:12 pfBlockerEurope.txt
-rw-r--r--  1 root  wheel  772252 May 13 14:12 pfBlockerNorthAmerica.txt
-rw-r--r--  1 root  wheel  36792 May 13 14:12 pfBlockerSouthAmerica.txt
-rw-r--r--  1 root  wheel  242707 May 13 14:12 pfBlockerTopSpammers.txt</pfblockerasia>

[kilthro]

Did you go to system > Advanced > Firewall/Nat tab and increase the Firewall Maximum Table Entries?

I have had to increase mine quite a bit to run all my tables. I currently have mine set to 999999999 and no longer get any memory allocation errors.

[Gradius]

@kilthro:

Did you go to system > Advanced > Firewall/Nat tab and increase the Firewall Maximum Table Entries?

I have had to increase mine quite a bit to run all my tables. I currently have mine set to 999999999 and no longer get any memory allocation errors.

Nope.

Will do.  Hope is only this.

Thanks!

[LinuxTracker]

I've been really busy (figuring out Postfix).
I don't have time to update my previously posted spam lists.

(Note: http://forum.pfsense.org/index.php/topic,42543.msg258273.html#msg258273)

For now I have a routine that extracts all new Spam IPs into one list - updated 2x/hour.
http://dl.dropbox.com/u/71477228/freshspam1.txt

I'm also now harvesting spam IPs from a 2nd email server I manage.
http://dl.dropbox.com/u/71477228/freshspam2.txt

As I update these routines, the next rewrites will:

1. filter out any IPs of major WebMail providers (GMail, AOL, Yahoo, Hotmail, etc)

For now, I whitelist US Yahoo email servers and Hotmail/Live/Microsoft Hosting.
http://dl.dropbox.com/u/71477228/YahooIPsUS.txt
http://dl.dropbox.com/u/71477228/hotmail.comIPs.txt

2. Sort spam IPs into my existing US and non-US spam lists
3. Include relevant comment for each IP
4. Drop off addresses that haven't had a spam hit in x#of days.

Edit: Here's a list of AOL outbound Email Servers
http://dl.dropbox.com/u/71477228/AOL_MailIPs.txt

It's compiled from the information on this page.
http://postmaster.info.aol.com/info/servers.html

[LinuxTracker]

These spam lists have been effective w/o giving me false positives.

This is a list of fresh US Spam IPs from a major source, updated hourly.
http://dl.dropbox.com/u/71477228/usspamips.txt

This list contains fresh Spam IPs from US and other countries, updated hourly.
I'll eventually get it sorted into US/non-US.
http://dl.dropbox.com/u/71477228/worldspamips.txt

PM me if you want more detail about them.

[LinuxTracker]

Just an FYI.

I looked around a lot for a versatile, online IP converter.
The only one I ever found is by Bluetack and it never showed up in any of my Google search queries.

http://www.bluetack.co.uk/converter/

[S_D]

Hi there,

Sorry if I'm being a bit thick here and/or this question has already been asked, but can i use this package download blocklists, create Aliases against them, and then use standard pfsense firewall rules to block those ranges talking to/from just ONE port on a particular IP address (ie, allow it for all other ports)?

Thanks!

[marcelloc]

S_D,

Sure you can, just configure pfblocker and set action to alias only.

This way pfblocker download,create the lists and you can assgin these aliases to your own rules.

att,
Marcello Coutinho

[S_D]

Perfect! Thanks for the reply. I'll set it up tonight.

[nesense]

Hi  :)

issue with system being stuck at "configuring firewall…" after reboot/startup with WAN interface down(or having wrong IP config)
using ctrl-c at console doesn't help.

i think the issue is pf tries to grab the lists but keeps waiting?

I tried uninstalling pfblocker and it worked fine with WAN down.
removed aliases + used deny inbound did not help

I'm using pfblocker 1.0.2 and pfs nanobsd 2.0.1

Thank u!

[marcelloc]

I've pushed an update to avoid downloads during boot process, reinstall the package and test again.

att,
Marcello Coutinho

[nesense]

@marcelloc:

I've pushed an update to avoid downloads during boot process, reinstall the package and test again.

att,
Marcello Coutinho

I tried reinstalling but package version is still 1.0.2 and I faced the same issue.

Thank u

[marcelloc]

Try to get some info on system logs.

[nesense]

php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerspyware.txt.tmp' > '/var/db/aliastables/pfBlockerspyware.txt'' returned exit code '2', the output was ''
php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerspyware.txt.tmp' 'https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerspyware'' returned exit code '1', the output was 'fetch: transfer timed out'
php: : The command '/sbin/pfctl -nf /tmp/rules.test.packages' returned exit code '1', the output was 'no IP address found for grep: /tmp/rules.test.packages:17: file "/var/db/aliastables/pfBlockerTopSpammers.txt" contains bad data no IP address found for grep: /tmp/rules.test.packages:19: file "/var/db/aliastables/pfBlockerads.txt" contains bad data no IP address found for grep: /tmp/rules.test.packages:21: file "/var/db/aliastables/pfBlockerspyware.txt" contains bad data no IP address found for grep: /tmp/rules.test.packages:23: file "/var/db/aliastables/pfBlockerhijacked.txt" contains bad data no IP address found for grep: /tmp/rules.test.packages:25: file "/var/db/aliastables/pfBlockerdshield.txt" contains bad data'

[marcelloc]

Pfsense is trying to update urltables applied by pfblocker during boot.

I'll try to find a way to prevent this if there is no link/ip/webserver up.

[TrickyWidget]

I got the dreaded error trying to load the Level 1 list:

There were error(s) loading the rules: /tmp/rules.debug:16: cannot define table pfBlockerLevel1:
 Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads
 [16]: table <pfblockerlevel1> persist file "/var/db/aliastables/pfBlockerLevel1.txt"</pfblockerlevel1>

My Firewall Maximum Table Entries is set to 4294967295 and still no love.  Freshly installed pfSense and pfBlocker, most everything at defaults.  Just the one block list.  512MB of RAM, only 32% in use.  1GHZ CPU.

Does anyone have any suggestions?

Thanks.

[TrickyWidget]

I got this suggestion from marcelloc:

@marcelloc:

Unselect the list, apply pfblocker config.

change again table max entries and apply config.

when you are sure that the new config is applied, try to enable again the list.

That seemed to work for a while, but the error eventually returned (or at once on reboot).

I've got a RAM upgrade on the way to see if going to 1GB helps any.

[fragged]

Hi,

On my physical 2.0.1 box pfblocker is making duplicate WAN rules. I only though to check after reading this thread: http://forum.pfsense.org/index.php/topic,50408.0.html . I tried to remove + reinstall the package, but it saved the config files and still keeps making duplicates.

pfblocker works fine on my VM, which also has floating rules though I've only used the latest version on it.

Is there a file / config I should also remove addition to the pfblocker package to make sure nothing is carried on.

Regards,
Joona

[marcelloc]

I've reduces duplicate cases and also applied some forum users patches but there are still duplicates on some cases.

This does not affect pfsense performance or load, is just a minor bug I could not fix 100% yet.

To workaround, you can change pfblocker action to alias only and create your own rules on wan just like the way you did on floating rules.

att,
Marcello Coutinho

[TrickyWidget]

Upgrading to 1GB RAM and further increasing the firewall table entries seems to have resolved my memory issues with the level 1 list.