Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.3m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      S_D
      last edited by

      I think I've answered my own question just now. If the comment field for the rule you create contains the Alias name then the widget counter goes up correctly…. :)

      1 Reply Last reply Reply Quote 0
      • marcellocM
        marcelloc
        last edited by

        @S_D:

        I think I've answered my own question just now. If the comment field for the rule you create contains the Alias name then the widget counter goes up correctly…. :)

        That's it, You need to follow alias name pattern to get a working widget.  :)

        Treinamentos de Elite: http://sys-squad.com

        Help a community developer! ;D

        1 Reply Last reply Reply Quote 0
        • E
          eri--
          last edited by

          @marcelloc:

          @jp141:

          1.) Have its own log tab so you can quickly and easily see what has been blocked

          pfblocker just create firewall rules with log options selected, so there is no way to distinct from other firewall log rules

          You could create the rules with 'label pfBlocker' and get stats based on that.
          pf(4) allows that and this will give you stats.

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @ermal:

            You could create the rules with 'label pfBlocker' and get stats based on that.
            pf(4) allows that and this will give you stats.

            Is it possible to include label on firewall rules gui?

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • E
              eri--
              last edited by

              Yes, the description that you put on the rules transforms into the label option behind.
              Beaware that is limited to 64 chars in pf(4)

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                Maybe it's the way I get rules counters on widget. I'll see how can I use it in logs.

                Thanks ermal for this tip.

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • L
                  LinuxTracker
                  last edited by

                  I've read some of the posts regarding the Level 1 block list.

                  I have to say, the L1 the biggest list I use and I use a lot of lists.

                  My experience is that pfBlocker loads faster and more reliably when it has more efficient lists to work with.
                  For Level 1 - I converted it into CIDR and then broke that into 3 separate lists.  It really helped.

                  You can try it yourself and see if performance improves. 
                  Here's a converted L1 from Bluetack/IBlocklist - that I did last March.
                  The urls below will plug directly into pfBlocker-> Lists, or into Aliases.

                  http://dl.dropbox.com/u/71477228/P2P_0-68.txt
                  http://dl.dropbox.com/u/71477228/P2P_69-193.txt
                  http://dl.dropbox.com/u/71477228/P2P_194-255.txt

                  FYI: To do this, I use Bluetack's Blocklist converter.
                  http://www.bluetack.co.uk/converter/

                  It's old and always takes me a few tries to get it right.
                  It's the only online tool I've found that will do the conversion properly.

                  .

                  1 Reply Last reply Reply Quote 0
                  • L
                    LinuxTracker
                    last edited by

                    My in-laws are traveling cross country and I was forced to start using Skype.
                    The thing is, I despise ads.

                    So, I've puzzled out the list of servers that deliver ads to Skype.

                    It was tricky, because Microsoft has ad servers and Microsoft services (like Hotmail) in the same IP blocks - and the IPs can switch every 5-10 minutes.
                    I had to write a couple of bash scripts to compile and separate ad-serving IPs from the service IPs.

                    Important -> You'll need to block outbound LAN connections for HTTP and HTTPS.

                    You can download the list from here.  You could also use the url directly in pfBlocker or in Aliases.
                    http://dl.dropbox.com/u/71477228/blacklistedads.txt

                    It'll be updated when/if new ad servers make themselves known.

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      @LinuxTracker:

                      So, I've puzzled out the list of servers that deliver ads to Skype.

                      good job :)

                      Do you know about android ads on free apps? it's really annoying!

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • Y
                        ypmict
                        last edited by

                        Hi there.. good day.. I am new to this pfBlocker, how to apply the pfBlocker rules to grouped interface, such as if i have grouped multiple WAN interface on pfSense setting..

                        thank you very much…

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          @ypmict:

                          how to apply the pfBlocker rules to grouped interface

                          Change list action to alias only and create rules the way you want.

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • _
                            _igor_
                            last edited by

                            pfblocker began to fill my logs with "php: : There were error(s) loading the rules: /tmp/rules.debug:17: cannot define table pfBlockerNorthAmerica: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [17]: table <pfblockernorthamerica>persist file "/var/db/aliastables/pfBlockerNorthAmerica.txt".

                            Seemed to work stable till today. The only thing i did was entering an own blocklist and put USA to my list.

                            Disabling the North America rules resolved the filling of systemlog, but the blocking remains down. :(

                            At the dashboard the widget shows all blockings as "down", say a red arrow.

                            New errors came up too:
                            php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerTopSpammers.txt.tmp' > '/var/db/aliastables/pfBlockerTopSpammers.txt'' returned exit code '1', the output was ''
                            Jul 18 19:27:32 php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerNorthAmerica.txt.tmp' > '/var/db/aliastables/pfBlockerNorthAmerica.txt'' returned exit code '1', the output was ''</pfblockernorthamerica>

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              Did you increased max_table_entries on system -> advanced?

                              you may need to disable lists before increase max_table value.

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • _
                                _igor_
                                last edited by

                                yes. I increased the max tables before. I had pfblocker disabled before i increased the max tables.

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  try to increase to a higher value.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • _
                                    _igor_
                                    last edited by

                                    increased to 400000, but still all Blockings down. :(

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kilthro
                                      last edited by

                                      @_igor_:

                                      increased to 400000, but still all Blockings down. :(

                                      I had to set mine to 999999999 before it all acted nice. Havent noticed any other issues with the increase.:-)

                                      1 Reply Last reply Reply Quote 0
                                      • _
                                        _igor_
                                        last edited by

                                        Increased size to 999999999, but its still not working, say the status is still down. Reinstall didnt help too. :(

                                        1 Reply Last reply Reply Quote 0
                                        • marcellocM
                                          marcelloc
                                          last edited by

                                          @_igor_:

                                          Increased size to 999999999, but its still not working, say the status is still down. Reinstall didnt help too. :(

                                          Did you disabled the server before increasing the value? You need a config apply without errors before trying a new value or a new list.

                                          Also, check custom lists if any and diagnostic tables menu.

                                          att,
                                          Marcello Coutinho

                                          Treinamentos de Elite: http://sys-squad.com

                                          Help a community developer! ;D

                                          1 Reply Last reply Reply Quote 0
                                          • _
                                            _igor_
                                            last edited by

                                            i did the following:

                                            deinstalled pfblocker, adjusted table size, installed pfblocker, started:

                                            php: /pkg_edit.php: [pfblocker] pfblocker_xmlrpc_sync.php is starting.
                                            Jul 19 17:27:00	check_reload_status: Reloading filter
                                            Jul 19 17:27:00	check_reload_status: Syncing firewall
                                            Jul 19 17:27:00	php: /pkg_edit.php: Starting pfBlocker sync process.
                                            Jul 19 17:27:00	check_reload_status: Syncing firewall
                                            snip
                                            	php: /pkg_edit.php: [pfblocker] pfblocker_xmlrpc_sync.php is starting.
                                            Jul 19 14:03:42	check_reload_status: Reloading filter
                                            Jul 19 14:03:42	php: /pkg_edit.php: Starting pfBlocker sync process.
                                            Jul 19 14:03:38	php: /pkg_edit.php: [pfblocker] pfblocker_xmlrpc_sync.php is starting.
                                            Jul 19 14:03:38	check_reload_status: Reloading filter
                                            Jul 19 14:03:38	check_reload_status: Syncing firewall
                                            Jul 19 14:03:38	php: /pkg_edit.php: Starting pfBlocker sync process.
                                            Jul 19 14:03:38	check_reload_status: Syncing firewall
                                            Jul 19 14:03:13	check_reload_status: Syncing firewall
                                            Jul 19 14:03:12	check_reload_status: Reloading filter
                                            Jul 19 14:03:12	check_reload_status: Syncing firewall
                                            Jul 19 14:03:12	php: /pkg_mgr_install.php: No pfBlocker action during boot process.
                                            Jul 19 14:03:12	php: /pkg_mgr_install.php: No pfBlocker action during boot process.
                                            Jul 19 14:03:00	check_reload_status: Syncing firewall
                                            Jul 19 14:02:58	php: /pkg_mgr_install.php: Beginning package installation for pfBlocker.
                                            Jul 19 14:02:58	check_reload_status: Syncing firewall
                                            Jul 19 14:02:44	check_reload_status: Reloading filter
                                            Jul 19 14:02:43	php: /pkg_mgr_install.php: No pfBlocker action during boot process.
                                            
                                            

                                            No errors, but Status is down. It shows cdir-entries, but no packets.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.