Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.3m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      S_D
      last edited by

      Just built a VM replica enviroment to test this again and have confirmed it there to, so it's not corruption on that system i don't think.

      I can see the blocks in the firewall logs.

      1 Reply Last reply Reply Quote 0
      • S
        S_D
        last edited by

        A final bit of diagnosis.

        I've changed the LAN network to be 10.1.1.0/24 (firewall on .1), and pfBlocker is not blocking traffic. That leads me to believe it is something to do with the way it is summarising it's 192.x network somewhere, but as I say I don't know how to properly query the compiled list. :)

        1 Reply Last reply Reply Quote 0
        • S
          S_D
          last edited by

          @marcelloc:

          P2p lists are converted to cidr format after download. If p2p range generates a network mask bigger then /16, pfBlocker will TRF to find a network cidr for this, What could result on a /12 or /8 network. In this situation, you may have some non blacklisted ips blocked.

          Cidr is the recommended format for lists.

          Sorry to spam this thread, this is the last question I promise.

          Above you mention CIDR as the recommended format.

          I've been downloading in P2P format (http://list.iblocklist.com/?list=bt_level1&fileformat=p2p&archiveformat=gz)

          When I tell pfBlocker do download the same list in CIDR format instead, the traffic now flows! So I assume the pfBlocker conversion of P2P to CIDR is what was causing the issue. I also now only get around half the number of CIDRs showing in the widget now (approx 252000). Is that right?

          Thanks!

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @S_D:

            Sorry to spam this thread, this is the last question I promise.

            No problem. Today the forum helps you, tomorrow you help the forum  ;)

            @S_D:

            I also now only get around half the number of CIDRs showing in the widget now (approx 252000). Is that right?

            Probably yes.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • J
              jp141
              last edited by

              Thanks guys this is amazing, a vast improvement over the older packages :D

              The only 2 requests I have are:

              1.) Have its own log tab so you can quickly and easily see what has been blocked

              2.) On the dashboard widget breakdown the blocked stats to incoming/outgoing

              Would they be possible?

              Thanks again

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                @jp141:

                1.) Have its own log tab so you can quickly and easily see what has been blocked

                pfblocker just create firewall rules with log options selected, so there is no way to distinct from other firewall log rules

                @S_D:

                2.) On the dashboard widget breakdown the blocked stats to incoming/outgoing

                No plans for that yet.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • J
                  jp141
                  last edited by

                  Ok thanks for the update.

                  Keep up the great work  ;D

                  1 Reply Last reply Reply Quote 0
                  • J
                    jp141
                    last edited by

                    @marcelloc:

                    Pfsense is trying to update urltables applied by pfblocker during boot.

                    I'll try to find a way to prevent this if there is no link/ip/webserver up.

                    Hi marcelloc,

                    I am also getting this issue, it is preventing pfsense fully booting, if I go in via SSH and force the web configurator to start then disable  pfblocker the system continues to boot fine.

                    I have multi wan, not sure if that is the issue?

                    I just get this for each list in the startup log:

                    php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerDshield.txt.tmp' 'https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerDshield'' returned exit code '1', the output was 'fetch: transfer timed out'

                    Once the system has booted I can start pfblocker with no issues.

                    Edit: this is on nanobsd if it matters and the latest pfblocker (only installed today)
                    I can also see "No pfBlocker action during boot process." in the logs a couple of times so it is obviously trying to delay but going wrong somewhere.

                    1 Reply Last reply Reply Quote 0
                    • S
                      S_D
                      last edited by

                      One little bug, Marcelloc.

                      When i use a list with deny inbound (for example), the widget 'packets' (blocked) counter counts up. However, if I just alias a list, and reference that in a firewall wall (even if that rule is logged) then the packet counter doesn't work at all (the field remains blank).

                      Is this by design or a bug?

                      If so, I guess I could work around it by using deny inbound, and then modifying the resulting rule in the rulebase to point to the one LAN host that I want. However, will this modification be remembered, or will it revert to it's default 'all/all/all' settings??

                      1 Reply Last reply Reply Quote 0
                      • S
                        S_D
                        last edited by

                        I think I've answered my own question just now. If the comment field for the rule you create contains the Alias name then the widget counter goes up correctly…. :)

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          @S_D:

                          I think I've answered my own question just now. If the comment field for the rule you create contains the Alias name then the widget counter goes up correctly…. :)

                          That's it, You need to follow alias name pattern to get a working widget.  :)

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • E
                            eri--
                            last edited by

                            @marcelloc:

                            @jp141:

                            1.) Have its own log tab so you can quickly and easily see what has been blocked

                            pfblocker just create firewall rules with log options selected, so there is no way to distinct from other firewall log rules

                            You could create the rules with 'label pfBlocker' and get stats based on that.
                            pf(4) allows that and this will give you stats.

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              @ermal:

                              You could create the rules with 'label pfBlocker' and get stats based on that.
                              pf(4) allows that and this will give you stats.

                              Is it possible to include label on firewall rules gui?

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • E
                                eri--
                                last edited by

                                Yes, the description that you put on the rules transforms into the label option behind.
                                Beaware that is limited to 64 chars in pf(4)

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  Maybe it's the way I get rules counters on widget. I'll see how can I use it in logs.

                                  Thanks ermal for this tip.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • L
                                    LinuxTracker
                                    last edited by

                                    I've read some of the posts regarding the Level 1 block list.

                                    I have to say, the L1 the biggest list I use and I use a lot of lists.

                                    My experience is that pfBlocker loads faster and more reliably when it has more efficient lists to work with.
                                    For Level 1 - I converted it into CIDR and then broke that into 3 separate lists.  It really helped.

                                    You can try it yourself and see if performance improves. 
                                    Here's a converted L1 from Bluetack/IBlocklist - that I did last March.
                                    The urls below will plug directly into pfBlocker-> Lists, or into Aliases.

                                    http://dl.dropbox.com/u/71477228/P2P_0-68.txt
                                    http://dl.dropbox.com/u/71477228/P2P_69-193.txt
                                    http://dl.dropbox.com/u/71477228/P2P_194-255.txt

                                    FYI: To do this, I use Bluetack's Blocklist converter.
                                    http://www.bluetack.co.uk/converter/

                                    It's old and always takes me a few tries to get it right.
                                    It's the only online tool I've found that will do the conversion properly.

                                    .

                                    1 Reply Last reply Reply Quote 0
                                    • L
                                      LinuxTracker
                                      last edited by

                                      My in-laws are traveling cross country and I was forced to start using Skype.
                                      The thing is, I despise ads.

                                      So, I've puzzled out the list of servers that deliver ads to Skype.

                                      It was tricky, because Microsoft has ad servers and Microsoft services (like Hotmail) in the same IP blocks - and the IPs can switch every 5-10 minutes.
                                      I had to write a couple of bash scripts to compile and separate ad-serving IPs from the service IPs.

                                      Important -> You'll need to block outbound LAN connections for HTTP and HTTPS.

                                      You can download the list from here.  You could also use the url directly in pfBlocker or in Aliases.
                                      http://dl.dropbox.com/u/71477228/blacklistedads.txt

                                      It'll be updated when/if new ad servers make themselves known.

                                      1 Reply Last reply Reply Quote 0
                                      • marcellocM
                                        marcelloc
                                        last edited by

                                        @LinuxTracker:

                                        So, I've puzzled out the list of servers that deliver ads to Skype.

                                        good job :)

                                        Do you know about android ads on free apps? it's really annoying!

                                        Treinamentos de Elite: http://sys-squad.com

                                        Help a community developer! ;D

                                        1 Reply Last reply Reply Quote 0
                                        • Y
                                          ypmict
                                          last edited by

                                          Hi there.. good day.. I am new to this pfBlocker, how to apply the pfBlocker rules to grouped interface, such as if i have grouped multiple WAN interface on pfSense setting..

                                          thank you very much…

                                          1 Reply Last reply Reply Quote 0
                                          • marcellocM
                                            marcelloc
                                            last edited by

                                            @ypmict:

                                            how to apply the pfBlocker rules to grouped interface

                                            Change list action to alias only and create rules the way you want.

                                            Treinamentos de Elite: http://sys-squad.com

                                            Help a community developer! ;D

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.