• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlocker

Scheduled Pinned Locked Moved pfSense Packages
896 Posts 143 Posters 1.3m Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • T
    tommyboy180
    last edited by Dec 24, 2012, 3:23 PM

    @marcelloc:

    Hi tommyboy, do you have a list newer then the latest provided by country block? ???

    I don't think it's newer but it's reliable. I've been using it this whole time.

    -Tom Schaefer
    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

    Please support pfBlocker | File Browser | Strikeback

    1 Reply Last reply Reply Quote 0
    • M
      marcelloc
      last edited by Dec 26, 2012, 2:00 PM

      @briand72:

      Ok, so I found out today that pfBlocker thinks www.facebook.com or 173.252.100.16 is in Europe somewhere.

      So now my question is how do I get my hands on the lists that pfBLocker is using so I can view them in the raw format?

      And if I edit that file/files can I replace the current ones by hand?

      Thanks.

      cidr lists are on /usr/local/pkg/ dir.

      South_America_cidr.txt
      Oceania_cidr.txt
      North_America_cidr.txt
      Europe_cidr.txt
      Asia_cidr.txt
      Africa_cidr.txt

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • C
        cybercare
        last edited by Dec 31, 2012, 1:25 AM Dec 31, 2012, 1:23 AM

        So I tried to search some but too many pages lol.

        On the widget, what determines the "Packets" count?

        Initially I thought it would keep a rolling count of blocked packets but it seems to go up and down. Like right now it says 6 but in a few min it will say 0.

        I feel kind of dumb asking because I'm sure it's answered some place obvious.

        Everything I could find makes me think rolling count but why would it go to 0 so often, shouldn't it keep growing if anything?

        FWIW I am on 2.1 latest snap.

        1 Reply Last reply Reply Quote 0
        • C
          chpalmer
          last edited by Dec 31, 2012, 6:07 AM

          @cybercare:

          So I tried to search some but too many pages lol.

          On the widget, what determines the "Packets" count?

          Initially I thought it would keep a rolling count of blocked packets but it seems to go up and down. Like right now it says 6 but in a few min it will say 0.

          I feel kind of dumb asking because I'm sure it's answered some place obvious.

          Everything I could find makes me think rolling count but why would it go to 0 so often, shouldn't it keep growing if anything?

          FWIW I am on 2.1 latest snap.

          Mine does this also.  At first I thought it was because I occasionally clear my firewall logs. But it just happened and coincided with a modem going down and resetting which has started to happen here.  Will keep watching unless anyone else knows.

          Triggering snowflakes one by one..
          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

          1 Reply Last reply Reply Quote 0
          • K
            kilthro
            last edited by Dec 31, 2012, 10:44 AM

            Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well.  Its not a big deal to me. As long as its up and running is all that matters. :-D

            1 Reply Last reply Reply Quote 0
            • C
              cybercare
              last edited by Dec 31, 2012, 4:55 PM

              @kilthro:

              Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well.  Its not a big deal to me. As long as its up and running is all that matters. :-D

              Some of that makes sense but in my case I have only that one package running and can just simply keep the home page up for 5 min and often it will reset to 0, or simply just hopping around in the menus, say I look at some logs, double check vpn status etc and later go back home (not making any actual changes during any of this) it will be reset.

              I agree it's not a super big deal but kind of defeats the point of the widget to me as that is what I was interested in about it. I rather not have to parse through logs to see if all the sudden my box is getting a big hit from trouble makers.

              Don't get me wrong though. I am grateful of the app and still learning it and other options but is a bit of a tease lol

              1 Reply Last reply Reply Quote 0
              • K
                kilthro
                last edited by Dec 31, 2012, 6:41 PM

                check you logs. are you getting reset interfaces? is there any other activity causing this? If you change settings in other areas that can affect the interfaces or monitoring ect it will cause them to reset. I wonder if you are getting alarms on these interfaces.. I never have the widget reset buy just moving around in the webgui.. only if i actually make changes to interfaces, pfblocker, snort, ect..

                1 Reply Last reply Reply Quote 0
                • C
                  ccb056
                  last edited by Dec 31, 2012, 7:37 PM

                  I am receiving an error:

                  Dashboard page - pfBlocker widget
                  it is reading '500 - Internal Server Error'

                  This is also reported here:
                  http://forum.pfsense.org/index.php?topic=54262.0

                  running: 2.0.2-RELEASE (amd64)
                  packages:
                  OpenVPN tap Bridging Fix
                  pfBlocker
                  RRD Summary

                  1 Reply Last reply Reply Quote 0
                  • C
                    ccb056
                    last edited by Dec 31, 2012, 7:50 PM

                    Upon investigating another error I was experiencing, see here:
                    http://forum.pfsense.org/index.php/topic,57113.0.html

                    I switched from Chrome to IE, in IE the 500 error is gone and the dashboard widget works as expected.

                    Maybe the pfBlocker and Traffic Graph bug are related….. both show errors in Chrome but work in IE

                    1 Reply Last reply Reply Quote 0
                    • S
                      Supermule Banned
                      last edited by Jan 4, 2013, 7:46 PM

                      I get this error

                      php: : There were error(s) loading the rules: /tmp/rules.debug:39: cannot define table pfBlockerEmerging_Block_IP: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [39]: table <pfblockeremerging_block_ip>persist file "/var/db/aliastables/pfBlockerEmerging_Block_IP.txt"

                      I have deleted the file, but it still shows up on the pfblocker widget on the frontpage of PFsense.

                      It keeps giving me errors of the list is gone, but before I deleted it, it was still there.

                      Very weird problem…</pfblockeremerging_block_ip>

                      1 Reply Last reply Reply Quote 0
                      • S
                        Supermule Banned
                        last edited by Jan 4, 2013, 8:18 PM

                        Cannot remove lists from pfblocker widget….

                        How to do?? They dont go away when deleted from the lists tab in the config GUI.

                        1 Reply Last reply Reply Quote 0
                        • S
                          Supermule Banned
                          last edited by Jan 4, 2013, 8:38 PM

                          Deleted and reinstalled. Lists are gone.

                          1 Reply Last reply Reply Quote 0
                          • S
                            Supermule Banned
                            last edited by Jan 4, 2013, 9:01 PM

                            Did a package delete and rebooted….

                            Jan 4 22:05:27 php: : There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

                            Jan 4 22:05:27 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

                            I think it has issues with 2.0.2 release…..</pfblockertopspammers></pfblockertopspammers>

                            1 Reply Last reply Reply Quote 0
                            • S
                              Supermule Banned
                              last edited by Jan 4, 2013, 9:13 PM

                              Did a manual delete in rules.debug to remove pfblocker aliases.

                              Now it says this…

                              Jan 4 22:16:46 php: : There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

                              Jan 4 22:16:46 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

                              It just wont go away!</pfblockertopspammers></pfblockertopspammers>

                              1 Reply Last reply Reply Quote 0
                              • K
                                kilthro
                                last edited by Jan 5, 2013, 10:15 AM

                                Looks like memory allocation errors.

                                Did you go to system > Advanced > Firewall/Nat tab and increase the Firewall Maximum Table Entries?

                                I have had to increase mine quite a bit to run all my tables. I currently have mine set to 999999999 and no longer get any memory allocation errors.

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Supermule Banned
                                  last edited by Jan 5, 2013, 11:10 AM

                                  Its currently set at 200.000 table entries…and 100.000 tables...

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    kilthro
                                    last edited by Jan 5, 2013, 11:16 AM

                                    increase it way up. Thats most likely the problem. Its not going to affect the firewall negatively. You see where mine is set and all runs just fine and I dont get those errors anymore.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Supermule Banned
                                      last edited by Jan 5, 2013, 11:18 AM

                                      Whats your maximum tables and table entries??

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kilthro
                                        last edited by Jan 5, 2013, 11:29 AM

                                        Attached everything on that page. I didnt touch anything else. Left it at default.

                                        states.jpg
                                        states.jpg_thumb

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          Supermule Banned
                                          last edited by Jan 5, 2013, 11:59 AM

                                          Thx!

                                          1 Reply Last reply Reply Quote 0
                                          615 out of 896
                                          • First post
                                            615/896
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received