Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.4m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fragged
      last edited by

      Thanks for the double rules fix! :)

      1 Reply Last reply Reply Quote 0
      • L
        LinuxTracker
        last edited by

        @LinuxTracker:

        re: UrlQuery based blocklist.

        Well the urlquery list seems to have gone off the rails, but I haven't abandoned it yet.

        The UrlQuery stats page is no longer updating it's data reliably. I am pulling the list.

        and
        I've come to the conclusion that these list-posts of mine are cluttering up the thread.
        I'd prefer to go back and update the original post but the allotted time-window to do that isn't long enough.

        I'll have a better way of announcing block lists in the near future.

        1 Reply Last reply Reply Quote 0
        • N
          noco
          last edited by

          First I wanted to say thanks for a great utility. This has been quite helpful in many ways.
          I was hoping that if someone could shed a little bit of light of if there is a possibility of importing / utilizing a list from the given site. Or if there is a way of cleaning it up to be utilized in PFBlocker?

          http://hosts-file.net/?s=Download

          Thanks again…

          1 Reply Last reply Reply Quote 0
          • P
            pftdm007
            last edited by

            Hi all!  Can someone help with this problem?  I have installed pfblocker a while ago but never actually checked the "enable pfblocker" checkbox in the options.  Once I checked the box and clicked "Save", I saw a yellow warning scrolling on the right top corner of the pfsense window.

            The message says

            11-10-12 19:21:25 - [filter_load]There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table pfBlockerEurope: Cannot allocate memory/tmp/rules.debug:24: cannot define table pfBlockerOceania: Cannot allocate memorypfctl: Syntax error in config file: pf rules not loaded The line in question reads [20]: table <pfblockereurope>persist file /var/db/aliastables/pfBlockerEurope.txt</pfblockereurope>

            What is wrong?  i have tried to reinstall pfblocker, no success…

            Please let me know what should I do to make it work!

            Thanks!

            1 Reply Last reply Reply Quote 0
            • marcellocM
              marcelloc
              last edited by

              take a look on forum search or pfblocker wiki.

              you need to increase Firewall Maximum Table Entries on system-> advanced -> firewall/nat

              Treinamentos de Elite: http://sys-squad.com

              Help a community developer! ;D

              1 Reply Last reply Reply Quote 0
              • L
                LinuxTracker
                last edited by

                The list of pfBlocker countries.

                https://gist.github.com/4150111

                or

                http://pastebin.com/1e5ysreB

                1 Reply Last reply Reply Quote 0
                • X
                  xxGBHxx
                  last edited by

                  Hi,

                  I'm new user of pfSense but pretty savvy from a networking perspective. I have everything working including Snort and other addons but I just don't seem to be able to get pfBlocker working at all. Originally when I first set this up I added multiple iBlocker lists and had many out of memory errors. Since then I've done a combination of removing rules (at times leaving a single rule with a single address) and increasing all the memory allocation I could find. The only "error" that I can now see is that the pfBlocker dashboard widget in the Dashboard gives a downward red arrow indicating it's down. In my attempts to fix it I've

                  1. Tried iBlocker lists
                  2. Tried custom lists consisting of a single address or just a few addresses
                  3. Tried upping the Max Tables entry from 200,000 to multiple values from 350,000-10,000,000 (it's currently sitting at 10 million). This is with single addresses as well as 1000's
                  4. Given the VM it's running in more ram from it's initial 512MB to its current 4GB
                  5. Upped the PHP memory allocation from the default 256M to anything from 2G to 512M (though regardless of the value above 256M it gives an error on reboot)
                  6. Checked the FW functionality by manually adding rules (it works)
                  7. Re-installed pfBlocker about 15 times
                  8. Added a countries list
                  9. Added single lists to single rules and multiple lists to single rules

                  None of this had any difference whatsoever as every single alias it created showed up with a downward red arrow in the Dash and when I went to try to see if the rule was applied none of them seemed to be applied. I've checked every log I can find and nothing tells me theres a problem. All filters re-load without a problem.

                  So I'm left with the following conclusion

                  1. It's completely broken
                  2. It's working but I just can't tell because the Dashboard widget is broken

                  Does anyone have any ideas as to why I just don't seem to be able to get pfBlocker to work or what else I can do to try and track down why it's not working? Is there any foolproof way that I can prove it's working or otherwise?

                  I REALLY want this to work :)

                  Cheers in advance

                  G

                  1 Reply Last reply Reply Quote 0
                  • X
                    xxGBHxx
                    last edited by

                    @xxGBHxx:

                    Hi,

                    I'm new user of pfSense but pretty savvy from a networking perspective.

                    Worked on this again today and I think I solved it (but in a brazen show of poor troubleshooting skills I'm not sure which bit fixed it)

                    I changed the right php.ini file located in /usr/local/etc/ so that

                    suhosin.memory_limit = 16384000000

                    This got rid of the warnings on the increase in the php memory space I attempted to apply.

                    I left max table entries at 10,000,000

                    I went into the interface config for the WAN and added a gateway to it. I suspect this might have been the main problem that was causing it to fail as it fixed other strange problems I was getting.

                    After that, it all started working. Thought I should post here in case it helps someone else. It's DEFINITELY worth doing incremental changes here however to get it right with the minimum overhead. I'm just massively impatient…

                    G

                    1 Reply Last reply Reply Quote 0
                    • marcellocM
                      marcelloc
                      last edited by

                      @xxGBHxx:

                      suhosin.memory_limit = 16384000000

                      Maybe yo're applying really big lists. on amd64 pfblocker php limit is 250Mb.

                      Thank's for posting a manual fix for those who needs to apply ruge lists  :)

                      Treinamentos de Elite: http://sys-squad.com

                      Help a community developer! ;D

                      1 Reply Last reply Reply Quote 0
                      • S
                        SamSquanch
                        last edited by

                        Is there a way to determine how old the built in lists are that PFBLocker is currently running with?

                        How often does one really need to update those lists? Does an ISP's whole IP block really get reassigned to another country very often?

                        I cound't find that information when I searched around here.

                        Thanks

                        1 Reply Last reply Reply Quote 0
                        • marcellocM
                          marcelloc
                          last edited by

                          It stopped being updated since this list got paid.

                          For now, no other lists in mind. :(

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • T
                            tommyboy180
                            last edited by

                            I saved all my lists locally. They don't change often, but there are changes. The old countryblock package still has a decent list.

                            -Tom Schaefer
                            SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                            Please support pfBlocker | File Browser | Strikeback

                            1 Reply Last reply Reply Quote 0
                            • marcellocM
                              marcelloc
                              last edited by

                              Hi tommyboy, do you have a list newer then the latest provided by country block? ???

                              Treinamentos de Elite: http://sys-squad.com

                              Help a community developer! ;D

                              1 Reply Last reply Reply Quote 0
                              • S
                                SamSquanch
                                last edited by

                                Ok, so I found out today that pfBlocker thinks www.facebook.com or 173.252.100.16 is in Europe somewhere.

                                So now my question is how do I get my hands on the lists that pfBLocker is using so I can view them in the raw format?

                                And if I edit that file/files can I replace the current ones by hand?

                                Thanks.

                                1 Reply Last reply Reply Quote 0
                                • T
                                  tommyboy180
                                  last edited by

                                  @marcelloc:

                                  Hi tommyboy, do you have a list newer then the latest provided by country block? ???

                                  I don't think it's newer but it's reliable. I've been using it this whole time.

                                  -Tom Schaefer
                                  SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                  Please support pfBlocker | File Browser | Strikeback

                                  1 Reply Last reply Reply Quote 0
                                  • marcellocM
                                    marcelloc
                                    last edited by

                                    @briand72:

                                    Ok, so I found out today that pfBlocker thinks www.facebook.com or 173.252.100.16 is in Europe somewhere.

                                    So now my question is how do I get my hands on the lists that pfBLocker is using so I can view them in the raw format?

                                    And if I edit that file/files can I replace the current ones by hand?

                                    Thanks.

                                    cidr lists are on /usr/local/pkg/ dir.

                                    South_America_cidr.txt
                                    Oceania_cidr.txt
                                    North_America_cidr.txt
                                    Europe_cidr.txt
                                    Asia_cidr.txt
                                    Africa_cidr.txt

                                    Treinamentos de Elite: http://sys-squad.com

                                    Help a community developer! ;D

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      cybercare
                                      last edited by

                                      So I tried to search some but too many pages lol.

                                      On the widget, what determines the "Packets" count?

                                      Initially I thought it would keep a rolling count of blocked packets but it seems to go up and down. Like right now it says 6 but in a few min it will say 0.

                                      I feel kind of dumb asking because I'm sure it's answered some place obvious.

                                      Everything I could find makes me think rolling count but why would it go to 0 so often, shouldn't it keep growing if anything?

                                      FWIW I am on 2.1 latest snap.

                                      1 Reply Last reply Reply Quote 0
                                      • chpalmerC
                                        chpalmer
                                        last edited by

                                        @cybercare:

                                        So I tried to search some but too many pages lol.

                                        On the widget, what determines the "Packets" count?

                                        Initially I thought it would keep a rolling count of blocked packets but it seems to go up and down. Like right now it says 6 but in a few min it will say 0.

                                        I feel kind of dumb asking because I'm sure it's answered some place obvious.

                                        Everything I could find makes me think rolling count but why would it go to 0 so often, shouldn't it keep growing if anything?

                                        FWIW I am on 2.1 latest snap.

                                        Mine does this also.  At first I thought it was because I occasionally clear my firewall logs. But it just happened and coincided with a modem going down and resetting which has started to happen here.  Will keep watching unless anyone else knows.

                                        Triggering snowflakes one by one..
                                        Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                        1 Reply Last reply Reply Quote 0
                                        • K
                                          kilthro
                                          last edited by

                                          Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well.  Its not a big deal to me. As long as its up and running is all that matters. :-D

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            cybercare
                                            last edited by

                                            @kilthro:

                                            Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well.  Its not a big deal to me. As long as its up and running is all that matters. :-D

                                            Some of that makes sense but in my case I have only that one package running and can just simply keep the home page up for 5 min and often it will reset to 0, or simply just hopping around in the menus, say I look at some logs, double check vpn status etc and later go back home (not making any actual changes during any of this) it will be reset.

                                            I agree it's not a super big deal but kind of defeats the point of the widget to me as that is what I was interested in about it. I rather not have to parse through logs to see if all the sudden my box is getting a big hit from trouble makers.

                                            Don't get me wrong though. I am grateful of the app and still learning it and other options but is a bit of a tease lol

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.