PfBlocker

marcelloc

this way you can add port alias to firewall or just block ports

On current version, you can use alias only option and create your own rules using, port aliases, connection limit, limiter, etc, etc ,etc.

elterrible

thanks for the great package. have been playing around with it for a couple months now, but just realized something a little odd. i have a few iblocklist and linuxtracker lists, but i've never seen them update (at least the system log doesn't say so). anyone else have the same issue? i know the iblocklist lists are updated weekly at least and linuxtracker used to update his twice a week. any help would be much appreciated.

marcelloc

What update frequency did you applied to this list?

Can you install cron package and check if pfblocker schedules are there?

elterrible

the lists (alias only, with corresponding firewall rules) are set to update every day. there seem to be two jobs in cron that relate to this:

0 * * * * root /usr/local/bin/php -q /usr/local/www/pfblocker.php cron
30 12 * * 0,2,4 root /usr/bin/nice -n20 /etc/rc.update_urltables

and here are snippets of the logs that relate to those jobs:

Feb 17 12:30:53 php: : /etc/rc.update_urltables: pfBlockerlevel1 does not need updated.
Feb 17 12:30:53 php: : /etc/rc.update_urltables: pfBlockerNorthAmerica does not need updated.
Feb 17 12:30:53 php: : /etc/rc.update_urltables: Starting URL table alias updates
Feb 17 12:30:01 php: : /etc/rc.update_urltables: Sleeping for 51 seconds.
Feb 17 12:30:01 php: : /etc/rc.update_urltables: Starting up.
Feb 16 23:00:23 php: : [pfblocker] pfblocker_xmlrpc_sync.php is starting.
Feb 16 23:00:23 check_reload_status: Reloading filter
Feb 16 23:00:23 check_reload_status: Syncing firewall
Feb 16 23:00:01 php: : Starting pfBlocker sync process.

the update_urltables job has never said that a list was updated. and the pfblocker sync has only repeated those four lines every day.

thanks.

traxxus

Hi

I have added the package "Ads" and want to block it, but on this site: http://www.hardwareluxx.de/community/forum.php for example i can see the ads.

Is there a mistake by me, or anythign else?

mint64

why does pfBlocker set it's rules in LAN instead of WAN? or is it just me? I'm asking because the Ip's that i want to block still connect to my pfSense machine and i want to stop that.

traxxus

@mint64:

why does pfBlocker set it's rules in LAN instead of WAN? or is it just me? I'm asking because the Ip's that i want to block still connect to my pfSense machine and i want to stop that.

pfSense put the rules only into LAN when you choose "deny both" by "List action" in pfBlocker i think.

francisuk22

Thanks for all the work!

Once thing i would like to share is my Mobile Broadband UK list as im badly getting targeted by them http://francisuk22.webspace.virginmedia.com/ukmobilebroadband.txt this hopefully will keep the mobile hackers out! (Please note this might only work for UK and Ireland but im just in the middle of getting my webhost up and running so ill share it asap from another webserver.

EE UK (Including: EE, Orange and T-Mobile)
O2 UK
Vodafone UK
3 UK

Please choose "Deny_Inbound" by "List action (Deny Inbound Will deny access from selected lists to your network) as for some reason Google blocked but ill look into this more over the weekend :)

Also malware patrol is a free, automated and user contributed system for checking URLs for the presence of Viruses, Trojans, Worms, or any other software considered Malware. The list is available in 29 formats. If you need another format please let us know

http://www.malware.com.br/cgi/submit?action=list

Works but what is it picking up?

Another useful website :) http://www.selectrealsecurity.com/public-block-lists

francisuk22

More list's if interested to you

http://www.stopforumspam.com (need to upload to an External webserver)
http://www.nothink.org/honeypots.php (very useful for Malware, SSH, IRC)
http://www.okean.com/thegoods.html (fed up with the amount of spam from Chinese and Korean? This will keep them out!)

S_D

Hi there,

I think I've an issue with pfBlocker, when used with a IPv6 tunnel and a DHCP IPv4 WAN address:

http://forum.pfsense.org/index.php/topic,60146.0.html

Could anyone please offer any thoughts on this?

Many thanks,

Simon

elterrible

@elterrible:

one of linuxtracker's lists (alias only, with corresponding firewall rules) is set to update every day.

30 12 * * 0,2,4 root /usr/bin/nice -n20 /etc/rc.update_urltables

Mar 10 12:30:42 php: : /etc/rc.update_urltables: pfBlockerp2p does not need updated.
Mar 10 12:30:42 php: : /etc/rc.update_urltables: Starting URL table alias updates
Mar 10 12:30:01 php: : /etc/rc.update_urltables: Sleeping for 41 seconds.
Mar 10 12:30:01 php: : /etc/rc.update_urltables: Starting up.

i ran a few tests with dropbox and some random ip addresses. pfblocker doesnt seem to be updating after it initially pulls the ip's from the list. any ideas? thanks.

marcelloc

@elterrible:

i ran a few tests with dropbox and some random ip addresses. pfblocker doesnt seem to be updating after it initially pulls the ip's from the list. any ideas? thanks.

IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

traxxus

Are the "Top spammers" list also automatically updatet ???
I ask because i can't define an update interval.

And what's the "source" of the list for the "Top spammers"?

marcelloc

@traxxus:

Are the "Top spammers" list also automatically updatet ???

Since blocklists got paid, there is no update anymore.

fragged


Crash report begins.  Anonymous machine information:

amd64
8.3-RELEASE-p7
FreeBSD 8.3-RELEASE-p7 #1: Thu Apr  4 13:16:33 EDT 2013     root@snapshots-8_3-amd64.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262

I keep getting this error report all the time on 2.1 for the past month or so. Nothing interesting going on in the system log.

elterrible

@marcelloc:

IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

you're right, but looking at the logs, it seems like the rc.update_urltables script is the one invoking the update. it just never updates, for whatever reason.

traxxus

@marcelloc:

@traxxus:

Are the "Top spammers" list also automatically updatet ???

Since blocklists got paid, there is no update anymore.

Could you implement another source? I mean the top spammers list is useless if no updates are available.

This one:
http://ipinfodb.com/ip_country_block.php#blocklist

There also directlinks available. China for example:
http://ipinfodb.com/country_query.php?country=CN&output=simple&filename=blocklist.txt

godbolt

This is a great package. Very useful. My apologies in advance if this has already been answered, but I was just wondering exactly what the packets column in the dashboard widget was. It seems to count up for a while then rest to zero. Is it packets dropped per hour or per day?

fragged

The package count zero's on filter reload if my memory serves me right. Could be some other regularly happening event also.

traxxus

Same here. Package count goes back to zero in dashboard widget. Don't know when or why.