PfBlocker

kilthro · Dec 31, 2012, 10:44 AM

Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well. Its not a big deal to me. As long as its up and running is all that matters. :-D

cybercare · Dec 31, 2012, 4:55 PM

@kilthro:

Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well. Its not a big deal to me. As long as its up and running is all that matters. :-D

Some of that makes sense but in my case I have only that one package running and can just simply keep the home page up for 5 min and often it will reset to 0, or simply just hopping around in the menus, say I look at some logs, double check vpn status etc and later go back home (not making any actual changes during any of this) it will be reset.

I agree it's not a super big deal but kind of defeats the point of the widget to me as that is what I was interested in about it. I rather not have to parse through logs to see if all the sudden my box is getting a big hit from trouble makers.

Don't get me wrong though. I am grateful of the app and still learning it and other options but is a bit of a tease lol

kilthro · Dec 31, 2012, 6:41 PM

check you logs. are you getting reset interfaces? is there any other activity causing this? If you change settings in other areas that can affect the interfaces or monitoring ect it will cause them to reset. I wonder if you are getting alarms on these interfaces.. I never have the widget reset buy just moving around in the webgui.. only if i actually make changes to interfaces, pfblocker, snort, ect..

ccb056 · Dec 31, 2012, 7:37 PM

I am receiving an error:

Dashboard page - pfBlocker widget
it is reading '500 - Internal Server Error'

This is also reported here:
http://forum.pfsense.org/index.php?topic=54262.0

running: 2.0.2-RELEASE (amd64)
packages:
OpenVPN tap Bridging Fix
pfBlocker
RRD Summary

ccb056 · Dec 31, 2012, 7:50 PM

Upon investigating another error I was experiencing, see here:
http://forum.pfsense.org/index.php/topic,57113.0.html

I switched from Chrome to IE, in IE the 500 error is gone and the dashboard widget works as expected.

Maybe the pfBlocker and Traffic Graph bug are related….. both show errors in Chrome but work in IE

Supermule · Jan 4, 2013, 7:46 PM

I get this error

php: : There were error(s) loading the rules: /tmp/rules.debug:39: cannot define table pfBlockerEmerging_Block_IP: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [39]: table <pfblockeremerging_block_ip>persist file "/var/db/aliastables/pfBlockerEmerging_Block_IP.txt"

I have deleted the file, but it still shows up on the pfblocker widget on the frontpage of PFsense.

It keeps giving me errors of the list is gone, but before I deleted it, it was still there.

Very weird problem…</pfblockeremerging_block_ip>

Supermule · Jan 4, 2013, 8:18 PM

Cannot remove lists from pfblocker widget….

How to do?? They dont go away when deleted from the lists tab in the config GUI.

Supermule · Jan 4, 2013, 8:38 PM

Deleted and reinstalled. Lists are gone.

Supermule · Jan 4, 2013, 9:01 PM

Did a package delete and rebooted….

Jan 4 22:05:27 php: : There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

Jan 4 22:05:27 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

I think it has issues with 2.0.2 release…..</pfblockertopspammers></pfblockertopspammers>

Supermule · Jan 4, 2013, 9:13 PM

Did a manual delete in rules.debug to remove pfblocker aliases.

Now it says this…

Jan 4 22:16:46 php: : There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

Jan 4 22:16:46 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

It just wont go away!</pfblockertopspammers></pfblockertopspammers>

kilthro · Jan 5, 2013, 10:15 AM

Looks like memory allocation errors.

Did you go to system > Advanced > Firewall/Nat tab and increase the Firewall Maximum Table Entries?

I have had to increase mine quite a bit to run all my tables. I currently have mine set to 999999999 and no longer get any memory allocation errors.

Supermule · Jan 5, 2013, 11:10 AM

Its currently set at 200.000 table entries…and 100.000 tables...

kilthro · Jan 5, 2013, 11:16 AM

increase it way up. Thats most likely the problem. Its not going to affect the firewall negatively. You see where mine is set and all runs just fine and I dont get those errors anymore.

Supermule · Jan 5, 2013, 11:18 AM

Whats your maximum tables and table entries??

kilthro · Jan 5, 2013, 11:29 AM

Attached everything on that page. I didnt touch anything else. Left it at default.

Supermule · Jan 5, 2013, 11:59 AM

Thx!

francisuk22 · Jan 12, 2013, 10:26 PM

Love it! :)

LinuxTracker · Jan 21, 2013, 7:48 PM

I have pfBlocker loading a list from the following url:
http://www.dnsbl.manitu.net/download/nixspam-ip.dump.gz

I decompressed the .gz to look at it and found text in the following format:

2013-01-21T20:15+0100 78.39.223.180
2013-01-21T20:15+0100 49.202.135.218
2013-01-21T20:15+0100 213.108.75.31
...

I have 2 systems that handle this list fine.
One other system scrambles the file content - loads nonsense IPs the table - is why I peeked inside the .gz

The thing is, I thought pfBlocker had to have the IP addr/cidrs at the beginning of the line. Looks like I'm wrong.

In what format(s) does pfBlocker need it's IP data?

marcelloc · Jan 22, 2013, 12:40 AM

@LinuxTracker:

In what format(s) does pfBlocker need it's IP data?

It loks for ip addresses using preg_match, if you can edit it to remove ip date, it may help.

LinuxTracker · Jan 22, 2013, 8:48 PM

@marcelloc:

It looks for ip addresses using preg_match, if you can edit it to remove ip date, it may help.

The list loads fine on two systems; now I know why.

The system that scrambles the data has 27 lists loaded.
It's probably just reacting to all the abuse I heap upon it.

As always, thank you for your insight.