PfBlocker

wm408

Maybe you could make a shell script with a test loop to see if Snort is running. You can invoke it with cron on startup, Try just keeping it simple with grep, like:

–---------------

#!/bin/bash

while : ## while true
do ## do the following

ps auxwww |grep snort |grep -v grep ## grep for snort, and also take that output and remove any grep specific output with the '-v' option, (inverse the match).
if ! [ $? = 0 ]; then ## if the exit status of the ps command is not successful ('0'), then…
continue ## continue checking as long as the exit status ($?) of the 'ps' command is not successful, ('0').
else
break ## as soon as the exit status ($?) is equal to '0', break out of the if test.
fi

done ## when we break out of the if test, we are done with the while do loop.

You can insert whatever command you need to run just before the break. You will have '&&' in between your command and the break command, like this:

/usr/sbin/enablepfBlockerscript && break

For the sleep you could insert it before the continue, ie:

sleep 5; continue

I didn't test this on pfSense, just a Linux box, but I think it can provide you with a skeleton to play with.

Good luck. :)

@fuzzyozzy408:

Thanks Marcelloc,

I should have given more detail. For whatever reasons, snort does not start up, if i reboot the server with pfblocker enabled. Its an error i have tried to resolve and failed. (i am guessing i have been overenthusiastic subscribing to blacklists and blocking many countries as well.).

In the cron'ed script i would like to disable pfblocker and then halt the server. If the server is booted, i would like to enable pfblocker via one of the RC scripts. Obviously i need a largish sleep count, to make sure snort has started up first.

LinuxTracker

Note: I am trialing this list. I'll report back after I run it for a while (not all lists work out).
I may tweak it in the future to exclude IPs that have a low submission rate.
end-Note.

This one is a list of malicious IPs from urlquery.net.
It re-compiles from scratch every hour.

It's lightweight - ~550 IPs today.

The below link will work in pfBlocker or Aliases
http://dl.dropbox.com/u/71477228/urlquery.txt

I primarily deploy it using a blocking/rejecting LAN rule.
Anecdotally, I'd rate it 30%-70% effective against the 0day malware I'm targeting (see below) - but it'll block other bad stuff too.

Original Source:
http://urlquery.net/stats.php#tab-IP

Background:
This is in response to malicious spams that contain links back to blackhole servers.
The spams typically pose as legit mail from American Express, BBB, DHL, UPS, USPS and others.

As spams are discovered, NetSec admins run the suspicious urls through URL Query - who keep logs of dodgy IPs.

More:
I started out looking for a way to block incoming SMTP traffic from 0Access peer servers/zombots.
I had a decent sized sample group of infected IPs but over ½ of them were never flagged by anyone for anything - very not good.

I eventually figured out that UrlQuery's database should help me prevent initial infections. That's something.

LinuxTracker

re: UrlQuery based blocklist.

Well the urlquery list seems to have gone off the rails, but I haven't abandoned it yet.

Here's what's up.

The source site dumped it's data sometime today and is reporting 0 malicious IPs. I'm hopeful this is a temporary glitch.
As a workaround, I'm auto-pulling IPs from the prior day's Google's cache so the list won't go to zero.
I also found that some valid IPs had climbed onto this list (ie: url shorteners) and wrote a filter to exempt them.

Other list related info:
I have some nebulous plans to post any/all lists to a central blog that I'd keep updated.

Also - I'm investigating some free alternatives to dropbox - it's been good but not bulletproof. Suggestions are welcome.

Update: As of this evening, urlquery is back up.

fragged

Thanks for the double rules fix! :)

LinuxTracker

@LinuxTracker:

re: UrlQuery based blocklist.

Well the urlquery list seems to have gone off the rails, but I haven't abandoned it yet.

The UrlQuery stats page is no longer updating it's data reliably. I am pulling the list.

and
I've come to the conclusion that these list-posts of mine are cluttering up the thread.
I'd prefer to go back and update the original post but the allotted time-window to do that isn't long enough.

I'll have a better way of announcing block lists in the near future.

noco

First I wanted to say thanks for a great utility. This has been quite helpful in many ways.
I was hoping that if someone could shed a little bit of light of if there is a possibility of importing / utilizing a list from the given site. Or if there is a way of cleaning it up to be utilized in PFBlocker?

http://hosts-file.net/?s=Download

Thanks again…

pftdm007

Hi all! Can someone help with this problem? I have installed pfblocker a while ago but never actually checked the "enable pfblocker" checkbox in the options. Once I checked the box and clicked "Save", I saw a yellow warning scrolling on the right top corner of the pfsense window.

The message says

11-10-12 19:21:25 - [filter_load]There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table pfBlockerEurope: Cannot allocate memory/tmp/rules.debug:24: cannot define table pfBlockerOceania: Cannot allocate memorypfctl: Syntax error in config file: pf rules not loaded The line in question reads [20]: table <pfblockereurope>persist file /var/db/aliastables/pfBlockerEurope.txt</pfblockereurope>

What is wrong? i have tried to reinstall pfblocker, no success…

Please let me know what should I do to make it work!

Thanks!

marcelloc

take a look on forum search or pfblocker wiki.

you need to increase Firewall Maximum Table Entries on system-> advanced -> firewall/nat

LinuxTracker

The list of pfBlocker countries.

https://gist.github.com/4150111

or

http://pastebin.com/1e5ysreB

xxGBHxx

Hi,

I'm new user of pfSense but pretty savvy from a networking perspective. I have everything working including Snort and other addons but I just don't seem to be able to get pfBlocker working at all. Originally when I first set this up I added multiple iBlocker lists and had many out of memory errors. Since then I've done a combination of removing rules (at times leaving a single rule with a single address) and increasing all the memory allocation I could find. The only "error" that I can now see is that the pfBlocker dashboard widget in the Dashboard gives a downward red arrow indicating it's down. In my attempts to fix it I've

1. Tried iBlocker lists
2. Tried custom lists consisting of a single address or just a few addresses
3. Tried upping the Max Tables entry from 200,000 to multiple values from 350,000-10,000,000 (it's currently sitting at 10 million). This is with single addresses as well as 1000's
4. Given the VM it's running in more ram from it's initial 512MB to its current 4GB
5. Upped the PHP memory allocation from the default 256M to anything from 2G to 512M (though regardless of the value above 256M it gives an error on reboot)
6. Checked the FW functionality by manually adding rules (it works)
7. Re-installed pfBlocker about 15 times
8. Added a countries list
9. Added single lists to single rules and multiple lists to single rules

None of this had any difference whatsoever as every single alias it created showed up with a downward red arrow in the Dash and when I went to try to see if the rule was applied none of them seemed to be applied. I've checked every log I can find and nothing tells me theres a problem. All filters re-load without a problem.

So I'm left with the following conclusion

1. It's completely broken
2. It's working but I just can't tell because the Dashboard widget is broken

Does anyone have any ideas as to why I just don't seem to be able to get pfBlocker to work or what else I can do to try and track down why it's not working? Is there any foolproof way that I can prove it's working or otherwise?

I REALLY want this to work :)

Cheers in advance

G

xxGBHxx

@xxGBHxx:

Hi,

I'm new user of pfSense but pretty savvy from a networking perspective.

Worked on this again today and I think I solved it (but in a brazen show of poor troubleshooting skills I'm not sure which bit fixed it)

I changed the right php.ini file located in /usr/local/etc/ so that

suhosin.memory_limit = 16384000000

This got rid of the warnings on the increase in the php memory space I attempted to apply.

I left max table entries at 10,000,000

I went into the interface config for the WAN and added a gateway to it. I suspect this might have been the main problem that was causing it to fail as it fixed other strange problems I was getting.

After that, it all started working. Thought I should post here in case it helps someone else. It's DEFINITELY worth doing incremental changes here however to get it right with the minimum overhead. I'm just massively impatient…

G

marcelloc

@xxGBHxx:

suhosin.memory_limit = 16384000000

Maybe yo're applying really big lists. on amd64 pfblocker php limit is 250Mb.

Thank's for posting a manual fix for those who needs to apply ruge lists :)

SamSquanch

Is there a way to determine how old the built in lists are that PFBLocker is currently running with?

How often does one really need to update those lists? Does an ISP's whole IP block really get reassigned to another country very often?

I cound't find that information when I searched around here.

Thanks

marcelloc

It stopped being updated since this list got paid.

For now, no other lists in mind. :(

tommyboy180

I saved all my lists locally. They don't change often, but there are changes. The old countryblock package still has a decent list.

marcelloc

Hi tommyboy, do you have a list newer then the latest provided by country block? ???

SamSquanch

Ok, so I found out today that pfBlocker thinks www.facebook.com or 173.252.100.16 is in Europe somewhere.

So now my question is how do I get my hands on the lists that pfBLocker is using so I can view them in the raw format?

And if I edit that file/files can I replace the current ones by hand?

Thanks.

tommyboy180

@marcelloc:

Hi tommyboy, do you have a list newer then the latest provided by country block? ???

I don't think it's newer but it's reliable. I've been using it this whole time.

marcelloc

@briand72:

Ok, so I found out today that pfBlocker thinks www.facebook.com or 173.252.100.16 is in Europe somewhere.

So now my question is how do I get my hands on the lists that pfBLocker is using so I can view them in the raw format?

And if I edit that file/files can I replace the current ones by hand?

Thanks.

cidr lists are on /usr/local/pkg/ dir.

South_America_cidr.txt
Oceania_cidr.txt
North_America_cidr.txt
Europe_cidr.txt
Asia_cidr.txt
Africa_cidr.txt

cybercare

So I tried to search some but too many pages lol.

On the widget, what determines the "Packets" count?

Initially I thought it would keep a rolling count of blocked packets but it seems to go up and down. Like right now it says 6 but in a few min it will say 0.

I feel kind of dumb asking because I'm sure it's answered some place obvious.

Everything I could find makes me think rolling count but why would it go to 0 so often, shouldn't it keep growing if anything?

FWIW I am on 2.1 latest snap.