Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.3m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      traxxus
      last edited by

      Hi

      I have added the package "Ads" and want to block it, but on this site: http://www.hardwareluxx.de/community/forum.php for example i can see the ads.

      Is there a mistake by me, or anythign else?

      1 Reply Last reply Reply Quote 0
      • M
        mint64
        last edited by

        why does pfBlocker set it's rules in LAN instead of WAN? or is it just me? I'm asking because the Ip's that i want to block still connect to my pfSense machine and i want to stop that.

        1 Reply Last reply Reply Quote 0
        • T
          traxxus
          last edited by

          @mint64:

          why does pfBlocker set it's rules in LAN instead of WAN? or is it just me? I'm asking because the Ip's that i want to block still connect to my pfSense machine and i want to stop that.

          pfSense put the rules only into LAN when you choose "deny both" by "List action" in pfBlocker i think.

          1 Reply Last reply Reply Quote 0
          • F
            francisuk22
            last edited by

            Thanks for all the work!

            Once thing i would like to share is my Mobile Broadband UK list as im badly getting targeted by them http://francisuk22.webspace.virginmedia.com/ukmobilebroadband.txt this hopefully will keep the mobile hackers out! (Please note this might only work for UK and Ireland but im just in the middle of getting my webhost up and running so ill share it asap from another webserver.

            EE UK (Including: EE, Orange and T-Mobile)
            O2 UK
            Vodafone UK
            3 UK

            Please choose "Deny_Inbound" by "List action (Deny Inbound Will deny access from selected lists to your network) as for some reason Google blocked but ill look into this more over the weekend :)

            Also malware patrol is a free, automated and user contributed system for checking URLs for the presence of Viruses, Trojans, Worms, or any other software considered Malware. The list is available in 29 formats. If you need another format please let us know

            http://www.malware.com.br/cgi/submit?action=list

            Works but what is it picking up?

            Another useful website :) http://www.selectrealsecurity.com/public-block-lists

            2.0.2-RELEASE (amd64) - Dell OptiPlex GX520 SFF @ Intel P4 HT 3.0GHz
            Cisco SR224 24-port Switch (4 PCs, 1 Wireless AP, 2 Consoles)

            1 Reply Last reply Reply Quote 0
            • F
              francisuk22
              last edited by

              More list's if interested to you

              http://www.stopforumspam.com (need to upload to an External webserver)
              http://www.nothink.org/honeypots.php (very useful for Malware, SSH, IRC)
              http://www.okean.com/thegoods.html (fed up with the amount of spam from Chinese and Korean? This will keep them out!)

              2.0.2-RELEASE (amd64) - Dell OptiPlex GX520 SFF @ Intel P4 HT 3.0GHz
              Cisco SR224 24-port Switch (4 PCs, 1 Wireless AP, 2 Consoles)

              1 Reply Last reply Reply Quote 0
              • S
                S_D
                last edited by

                Hi there,

                I think I've an issue with pfBlocker, when used with a IPv6 tunnel and a DHCP IPv4 WAN address:

                http://forum.pfsense.org/index.php/topic,60146.0.html

                Could anyone please offer any thoughts on this?

                Many thanks,

                Simon

                1 Reply Last reply Reply Quote 0
                • E
                  elterrible
                  last edited by

                  @elterrible:

                  one of linuxtracker's lists (alias only, with corresponding firewall rules) is set to update every day.

                  30   12   *   *   0,2,4   root   /usr/bin/nice -n20 /etc/rc.update_urltables

                  Mar 10 12:30:42 php: : /etc/rc.update_urltables: pfBlockerp2p does not need updated.
                  Mar 10 12:30:42 php: : /etc/rc.update_urltables: Starting URL table alias updates
                  Mar 10 12:30:01 php: : /etc/rc.update_urltables: Sleeping for 41 seconds.
                  Mar 10 12:30:01 php: : /etc/rc.update_urltables: Starting up.

                  i ran a few tests with dropbox and some random ip addresses.  pfblocker doesnt seem to be updating after it initially pulls the ip's from the list.  any ideas?  thanks.

                  1 Reply Last reply Reply Quote 0
                  • marcellocM
                    marcelloc
                    last edited by

                    @elterrible:

                    i ran a few tests with dropbox and some random ip addresses.  pfblocker doesnt seem to be updating after it initially pulls the ip's from the list.  any ideas?  thanks.

                    IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

                    Treinamentos de Elite: http://sys-squad.com

                    Help a community developer! ;D

                    1 Reply Last reply Reply Quote 0
                    • T
                      traxxus
                      last edited by

                      Are the "Top spammers" list also automatically updatet  ???
                      I ask because i can't define an update interval.

                      And what's the "source" of the list for the "Top spammers"?

                      1 Reply Last reply Reply Quote 0
                      • marcellocM
                        marcelloc
                        last edited by

                        @traxxus:

                        Are the "Top spammers" list also automatically updatet  ???

                        Since blocklists got paid, there is no update anymore.

                        Treinamentos de Elite: http://sys-squad.com

                        Help a community developer! ;D

                        1 Reply Last reply Reply Quote 0
                        • F
                          fragged
                          last edited by 

                          
Crash report begins.  Anonymous machine information:

amd64
8.3-RELEASE-p7
FreeBSD 8.3-RELEASE-p7 #1: Thu Apr  4 13:16:33 EDT 2013     root@snapshots-8_3-amd64.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262

                          I keep getting this error report all the time on 2.1 for the past month or so. Nothing interesting going on in the system log.

                          1 Reply Last reply Reply Quote 0
                          • E
                            elterrible
                            last edited by

                            @marcelloc:

                            IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

                            you're right, but looking at the logs, it seems like the rc.update_urltables script is the one invoking the update.  it just never updates, for whatever reason.

                            1 Reply Last reply Reply Quote 0
                            • T
                              traxxus
                              last edited by

                              @marcelloc:

                              @traxxus:

                              Are the "Top spammers" list also automatically updatet  ???

                              Since blocklists got paid, there is no update anymore.

                              Could you implement another source? I mean the top spammers list is useless if no updates are available.

                              This one:
                              http://ipinfodb.com/ip_country_block.php#blocklist

                              There also directlinks available. China for example:
                              http://ipinfodb.com/country_query.php?country=CN&output=simple&filename=blocklist.txt

                              1 Reply Last reply Reply Quote 0
                              • G
                                godbolt
                                last edited by

                                This is a great package.  Very useful.  My apologies in advance if this has already been answered, but I was just wondering exactly what the packets column in the dashboard widget was.  It seems to count up for a while then rest to zero.  Is it packets dropped per hour or per day?

                                1 Reply Last reply Reply Quote 0
                                • F
                                  fragged
                                  last edited by

                                  The package count zero's on filter reload if my memory serves me right. Could be some other regularly happening event also.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    traxxus
                                    last edited by

                                    Same here. Package count goes back to zero in dashboard widget. Don't know when or why.

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kilthro
                                      last edited by

                                      When ever you filter reload or package updates anything that soft refreshes will reset it back to 0 as the interface resets.. same thing will happen changing network settings… I have never seen the widget reset on its own without either changing system setting/network setting/updates ect.

                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        godbolt
                                        last edited by

                                        Thanks for the reply.  Filter reload explains it.  Every once and a while I change some rules.  I guess I just didn't notice the connection.

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          Cino
                                          last edited by

                                          @fragged:

                                          
Crash report begins.  Anonymous machine information:

amd64
8.3-RELEASE-p7
FreeBSD 8.3-RELEASE-p7 #1: Thu Apr  4 13:16:33 EDT 2013     root@snapshots-8_3-amd64.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262

                                          I keep getting this error report all the time on 2.1 for the past month or so. Nothing interesting going on in the system log.

                                          I've had the same issue for the past couple of months. I haven't dug deeper to see if it causing any problems

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            thebiznes
                                            last edited by

                                            New to pfblocker had used country blocker earlier before moving to untangle.

                                            New to software routers although have been running a untangle box for some time, but I wanted the flexibility of routing with pfsense and filtering with Untangle in Bridge mode. Also I wanted squid for web caching as it's paid option in Untangle  so I have them working in ESXI and virtual box. The performance is much better in esxi though.

                                            The problem I have with pfblocker is that I can't block on inbound the default without selecting block on both. The rule in the firewall just doesn't appear and the dashboard widget just displays a red down arrow. Which I take as not on.

                                            The only way to get some of the functionality is either block both or permit outbound. Please could someone clarify exactly what "permit outbound" this means.

                                            1/ Does this as I have read, allow user to get to sites on the list, but block incoming traffic by default?

                                            2/ Any ideas why I can't block inbound traffic without selecting both. I have it set on Wan inbound and Lan outbound?

                                            3/ With one of the list an ads one. With block both it actually stops my email service. I can see the IP in the list. Is there a way to whitelist that IP to allow?

                                            Because of my lack of understanding of this package. Should I just resort back to the country block part and forego the lists?

                                            Probably a question to myself the last one, but if it protects then it would be a nice feature to use.

                                            Lists I am using Level1, Level2, Level3 Ads, Edu, Spyware, Hacked and Dshield and top spammers.

                                            Any advice would be appreciated :)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.