• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlocker

pfSense Packages
143
896
1.3m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • B
    BenKenobe
    last edited by Sep 3, 2013, 1:38 PM

    OK one question - not seen it here so has anyone else noticed that on restart pfBlocker re-organises the rules and sticks its rules back at the top? Since I have two WAN's (WAN and OPT1) I also prefer the rules to live in 'floating' so they get applied to both interfaces and I only need to manage in one - but pFBlocker keeps putting them back into WAN and OPT1 I realise that they won't get 'executed' if they are found in floating first but it makes my configuration untidy and I do have a degree of OCD about such things.

    I have a need for certain machines to come BEFORE the ad blocking - (I use the subscribed ADBlock list from iblocklist.com) but it blocks many 'robots' too, since the web server isn't used for browsing I placed it before the ad blocker rule - but on firewall restart I need to move things around again.

    This just me or has anyone else spotted it?

    1 Reply Last reply Reply Quote 0
    • D
      doktornotor Banned
      last edited by Sep 3, 2013, 4:32 PM

      @BenKenobe:

      OK one question - not seen it here so has anyone else noticed that on restart pfBlocker re-organises the rules and sticks its rules back at the top? … This just me or has anyone else spotted it?

      Considering it's documented behaviour… huh.

      1 Reply Last reply Reply Quote 0
      • B
        BenKenobe
        last edited by Sep 3, 2013, 5:01 PM

        Well it may be I confess to not reading it all, just enough to get configured and running, don't have hours to burn trawling through pages and pages of small print.

        So documented it may be but it is a feature that I could do without - rules should stay where I put them since rules are executed in the order presented and I (or any other) user should be able to set the execution preference and expect it to be obeyed.

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by Sep 3, 2013, 5:10 PM

          @BenKenobe:

          So documented it may be but it is a feature that I could do without - rules should stay where I put them since rules are executed in the order presented and I (or any other) user should be able to set the execution preference and expect it to be obeyed.

          Rules will stay where you want once you've read the documentation and created the lists as "Alias only" in "List Action" and placed them wherever you want.

          1 Reply Last reply Reply Quote 0
          • B
            BenKenobe
            last edited by Sep 3, 2013, 5:16 PM

            they are configured as alias only and yet I've had to re-arrange them 3 times now. I did the aliasing bit specifically to make sure that certain 'targets' were exempt from certain rulesets.

            I have a Spammer set, a malicious set and an advertising set Spammer and Malicious I put into floating because I want them to impact on all, I then have the web server followed by the advertising set … the server is aliased as is the local subnet, since the server is encountered first i.e. before the ads then robots etc still work - anything else gets advertising blocked.

            I'll scan the documentation again but I'm sure I did it right.

            1 Reply Last reply Reply Quote 0
            • B
              BenKenobe
              last edited by Sep 3, 2013, 5:26 PM

              My lists are aliased - Spammer1, Malicious1 and ads1, which translate to pfblockerMalicious1, pfblockerSpammer1 and pfblockerAds1 in the rules lists, these carry a comment 'do not edit this alias'

              1 Reply Last reply Reply Quote 0
              • B
                BenKenobe
                last edited by Sep 3, 2013, 6:03 PM

                Well maybe it's fixed - appreciate the input, I hadn't spotted the 'alias only' in the dropdown box of the pfBlocker itself, I had seen the 'rules and alias only' but since everything I do uses aliases figured that was it - wrong.

                I rebooted and things stayed put so despite the sarcasm re documentation I do appreciate the input  ;)

                1 Reply Last reply Reply Quote 0
                • T
                  ttblum
                  last edited by Sep 10, 2013, 7:26 PM

                  Posted 'pfBlocker disables firewall on nanobsd when no there is no internet access at boot time' at:

                  https://redmine.pfsense.org/issues/3109

                  1 Reply Last reply Reply Quote 0
                  • J
                    JSmorada
                    last edited by Sep 14, 2013, 5:17 AM

                    I just started having a possible issue with pfblocker. Even though I have it enabled and all the aliases are created and the CIDRs are present on the dashboard widget, the dashboard widget also shows red arrows pointing down in the status column. What does that mean? I could have sworn the column had green arrows pointing up. ???

                    pfblocker.png
                    pfblocker.png_thumb

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by Sep 14, 2013, 7:32 AM

                      @nipstech:

                      I just started having a possible issue with pfblocker. Even though I have it enabled and all the aliases are created and the CIDRs are present on the dashboard widget, the dashboard widget also shows red arrows pointing down in the status column. What does that mean? I could have sworn the column had green arrows pointing up. ???

                      Did you create any rules on WAN?

                      1 Reply Last reply Reply Quote 0
                      • J
                        JSmorada
                        last edited by Sep 14, 2013, 1:52 PM

                        No I didn't. The only rules are the rules that block private and bogon networks.

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by Sep 14, 2013, 2:08 PM

                          @nipstech:

                          No I didn't. The only rules are the rules that block private and bogon networks.

                          Well, that is the problem… Create something safe there (like, access from 127.0.0.1 to some port). Known bug.

                          1 Reply Last reply Reply Quote 0
                          • J
                            JSmorada
                            last edited by Sep 14, 2013, 3:01 PM

                            That fixed it! I created a safe rule on the WAN interface and even disabled it. Perhaps a "dummy" rule could be created as an option for those of us who run a stripped down firewall like I'm using.

                            Thanks, doktornotor! :)

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by Sep 14, 2013, 3:14 PM

                              Well it'd be better to fix the bug instead of creating the dummy rules… lol :D

                              1 Reply Last reply Reply Quote 0
                              • J
                                JSmorada
                                last edited by Sep 14, 2013, 3:24 PM

                                You got that right!

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kilthro
                                  last edited by Sep 14, 2013, 11:28 PM

                                  When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by Sep 15, 2013, 3:07 AM Sep 15, 2013, 3:04 AM

                                    @kilthro:

                                    When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..

                                    Let me restate the problem: if your WAN contains no rules (beyond the default pseudo-rules - block private/bogon networks) this does NOT work. The rules are not added and the enable pfBlocker checkbox gets unchecked, and the widget looks as shown in this post. BUG.

                                    1 Reply Last reply Reply Quote 0
                                    • chpalmerC
                                      chpalmer
                                      last edited by Sep 16, 2013, 5:25 AM

                                      Backing up libraries…
                                      Removing package...
                                      Removing pfBlocker components...
                                      Tabs items... done.
                                      Menu items... done.
                                      Loading package instructions...

                                      I just updated to 2.1 release on my box here. Getting stuck at this while trying to reload pfblocker.  Help!

                                      Thanks!  :)

                                      Triggering snowflakes one by one..
                                      Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                      1 Reply Last reply Reply Quote 0
                                      • B
                                        BenKenobe
                                        last edited by Sep 16, 2013, 6:36 PM Sep 16, 2013, 6:29 PM

                                        Anyone else running pfblocker that's updated to 2.1 had issues with lists not updating / populating - all my list URL's are valid, reduced update time to 1 hour but the IP's aren't getting read / or the aliases populated.

                                        As a result the alias is not 'created' and raises rule alerts for unreachable alias's.

                                        Tried uninstalling and re-installing it didn't help - deleted the lists and re-added and that didn't help either …

                                        Also getting a notice that Wan gateway is unknown not using it - which is utter tosh because it is both present and connected - this may or may not be related to pfBlocker

                                        UPDATE : Typing the above prompted a grey cell - I went to check my 'routing' tables and when 2.1 was installed (2.0.3 update) the interfaces got renamed but the routing gateways did not - OPT1 did to OPT1_PPPOE but not WAN which in the system was now WAN_PPPOE ... only in the routing table it wasn't it was still 'WAN' ...

                                        Sorting this sorted pfBlocker ...

                                        1 Reply Last reply Reply Quote 0
                                        • chpalmerC
                                          chpalmer
                                          last edited by Sep 17, 2013, 3:57 AM

                                          @chpalmer:

                                          Backing up libraries…
                                          Removing package...
                                          Removing pfBlocker components...
                                          Tabs items... done.
                                          Menu items... done.
                                          Loading package instructions...

                                          I just updated to 2.1 release on my box here. Getting stuck at this while trying to reload pfblocker.  Help!

                                          Thanks!  :)

                                          found it.

                                          https://forum.pfsense.org/index.php/topic,66571.msg363755.html#msg363755

                                          Triggering snowflakes one by one..
                                          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.