PfBlocker

Supermule · Aug 13, 2013, 9:10 AM

Everything…

Supermule · Aug 13, 2013, 9:26 AM

Can we somehow track a specific IP and see what country CIDR it is attached to? I have a client that got blocked yesterday and I havent got a clue what country the IP is attached to?

kilthro · Aug 13, 2013, 10:10 AM

I dont know of an easy way of doing that besides searching the tables. However what I have done is identified the mistakenly blocked ip and added it to my allow list and all is good. Not the best solution but a work around so that they are not blocked.

doktornotor · Aug 13, 2013, 10:17 AM

@Supermule:

Can we somehow track a specific IP and see what country CIDR it is attached to? I have a client that got blocked yesterday and I havent got a clue what country the IP is attached to?

http://www.geoiptool.com/

zardoz · Sep 3, 2013, 1:34 AM

Hello, I've recently installed pfblocker and been trying it out. Unfortunately I'm getting this error.
This is just an FYI.

There were error(s) loading the rules: /tmp/rules.debug:25: cannot define table pfBlockerTopSpammers: Cannot allocate memory - The line in question reads [25]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

some details;
pfsense version: 2.1-RC0 (i386) built on Fri Jun 14 16:39:04 EDT 2013

machine has 4gb of ram, swap space is 2gb, roughly 2gb free.
Memory useage displays as 7% on dashboard.

pfBlocker was configured to deny in/out on wan/lan, all countries selected in topSpammers list.</pfblockertopspammers>

doktornotor · Sep 3, 2013, 1:41 AM

@zardoz:

pfBlocker was configured to deny in/out on wan/lan, all countries selected in topSpammers list.

You realize the blocklist is not even being updated any more? (Neither are the continent/country blocklists, AFAICT. No longer free.) All this cruft should be purged from pfBlocker.

zardoz · Sep 3, 2013, 1:47 AM

Does this mean that pfBlocker is not supported?

doktornotor · Sep 3, 2013, 1:54 AM

@zardoz:

Would it make sense to only have current supported packages available in pfSense?

The package itself is still perfectly fine for custom blocklists. Just in need of a diet to lose the predefined blocklists functionality that's not really useful any more. pfBlocker Light, anyone? :D

Head over to http://www.iblocklist.com/lists.php and pick your poison (P2P/GZ format is just fine for pfblocker.)

Important note: For the not really that much sane blocklists, you'll need to go to System - Advanced - Firewall/NAT and bump the "Firewall Maximum Table Entries" way up.

zardoz · Sep 3, 2013, 1:54 AM

thanks! I'll try out a list or two.

kilthro · Sep 3, 2013, 9:03 AM

@zardoz:

Hello, I've recently installed pfblocker and been trying it out. Unfortunately I'm getting this error.
This is just an FYI.

There were error(s) loading the rules: /tmp/rules.debug:25: cannot define table pfBlockerTopSpammers: Cannot allocate memory - The line in question reads [25]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

some details;
pfsense version: 2.1-RC0 (i386) built on Fri Jun 14 16:39:04 EDT 2013

machine has 4gb of ram, swap space is 2gb, roughly 2gb free.
Memory useage displays as 7% on dashboard.

pfBlocker was configured to deny in/out on wan/lan, all countries selected in topSpammers list.</pfblockertopspammers>

Did you go to system > advanced > firewall tab and increase Firewall Maximum Table Entries? if not increase that. Generally have to increase it quite a bit depending on all the lists you load. Mine is set to 999999999

BenKenobe · Sep 3, 2013, 1:38 PM

OK one question - not seen it here so has anyone else noticed that on restart pfBlocker re-organises the rules and sticks its rules back at the top? Since I have two WAN's (WAN and OPT1) I also prefer the rules to live in 'floating' so they get applied to both interfaces and I only need to manage in one - but pFBlocker keeps putting them back into WAN and OPT1 I realise that they won't get 'executed' if they are found in floating first but it makes my configuration untidy and I do have a degree of OCD about such things.

I have a need for certain machines to come BEFORE the ad blocking - (I use the subscribed ADBlock list from iblocklist.com) but it blocks many 'robots' too, since the web server isn't used for browsing I placed it before the ad blocker rule - but on firewall restart I need to move things around again.

This just me or has anyone else spotted it?

doktornotor · Sep 3, 2013, 4:32 PM

@BenKenobe:

OK one question - not seen it here so has anyone else noticed that on restart pfBlocker re-organises the rules and sticks its rules back at the top? … This just me or has anyone else spotted it?

Considering it's documented behaviour… huh.

BenKenobe · Sep 3, 2013, 5:01 PM

Well it may be I confess to not reading it all, just enough to get configured and running, don't have hours to burn trawling through pages and pages of small print.

So documented it may be but it is a feature that I could do without - rules should stay where I put them since rules are executed in the order presented and I (or any other) user should be able to set the execution preference and expect it to be obeyed.

doktornotor · Sep 3, 2013, 5:10 PM

@BenKenobe:

So documented it may be but it is a feature that I could do without - rules should stay where I put them since rules are executed in the order presented and I (or any other) user should be able to set the execution preference and expect it to be obeyed.

Rules will stay where you want once you've read the documentation and created the lists as "Alias only" in "List Action" and placed them wherever you want.

BenKenobe · Sep 3, 2013, 5:16 PM

they are configured as alias only and yet I've had to re-arrange them 3 times now. I did the aliasing bit specifically to make sure that certain 'targets' were exempt from certain rulesets.

I have a Spammer set, a malicious set and an advertising set Spammer and Malicious I put into floating because I want them to impact on all, I then have the web server followed by the advertising set … the server is aliased as is the local subnet, since the server is encountered first i.e. before the ads then robots etc still work - anything else gets advertising blocked.

I'll scan the documentation again but I'm sure I did it right.

BenKenobe · Sep 3, 2013, 5:26 PM

My lists are aliased - Spammer1, Malicious1 and ads1, which translate to pfblockerMalicious1, pfblockerSpammer1 and pfblockerAds1 in the rules lists, these carry a comment 'do not edit this alias'

BenKenobe · Sep 3, 2013, 6:03 PM

Well maybe it's fixed - appreciate the input, I hadn't spotted the 'alias only' in the dropdown box of the pfBlocker itself, I had seen the 'rules and alias only' but since everything I do uses aliases figured that was it - wrong.

I rebooted and things stayed put so despite the sarcasm re documentation I do appreciate the input ;)

ttblum · Sep 10, 2013, 7:26 PM

Posted 'pfBlocker disables firewall on nanobsd when no there is no internet access at boot time' at:

https://redmine.pfsense.org/issues/3109

JSmorada · Sep 14, 2013, 5:17 AM

I just started having a possible issue with pfblocker. Even though I have it enabled and all the aliases are created and the CIDRs are present on the dashboard widget, the dashboard widget also shows red arrows pointing down in the status column. What does that mean? I could have sworn the column had green arrows pointing up. ???

doktornotor · Sep 14, 2013, 7:32 AM

@nipstech:

I just started having a possible issue with pfblocker. Even though I have it enabled and all the aliases are created and the CIDRs are present on the dashboard widget, the dashboard widget also shows red arrows pointing down in the status column. What does that mean? I could have sworn the column had green arrows pointing up. ???

Did you create any rules on WAN?