PfBlocker
-
thanks! I'll try out a list or two.
-
Hello, I've recently installed pfblocker and been trying it out. Unfortunately I'm getting this error.
This is just an FYI.There were error(s) loading the rules: /tmp/rules.debug:25: cannot define table pfBlockerTopSpammers: Cannot allocate memory - The line in question reads [25]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"
some details;
pfsense version: 2.1-RC0 (i386) built on Fri Jun 14 16:39:04 EDT 2013machine has 4gb of ram, swap space is 2gb, roughly 2gb free.
Memory useage displays as 7% on dashboard.pfBlocker was configured to deny in/out on wan/lan, all countries selected in topSpammers list.</pfblockertopspammers>
Did you go to system > advanced > firewall tab and increase Firewall Maximum Table Entries? if not increase that. Generally have to increase it quite a bit depending on all the lists you load. Mine is set to 999999999
-
OK one question - not seen it here so has anyone else noticed that on restart pfBlocker re-organises the rules and sticks its rules back at the top? Since I have two WAN's (WAN and OPT1) I also prefer the rules to live in 'floating' so they get applied to both interfaces and I only need to manage in one - but pFBlocker keeps putting them back into WAN and OPT1 I realise that they won't get 'executed' if they are found in floating first but it makes my configuration untidy and I do have a degree of OCD about such things.
I have a need for certain machines to come BEFORE the ad blocking - (I use the subscribed ADBlock list from iblocklist.com) but it blocks many 'robots' too, since the web server isn't used for browsing I placed it before the ad blocker rule - but on firewall restart I need to move things around again.
This just me or has anyone else spotted it?
-
OK one question - not seen it here so has anyone else noticed that on restart pfBlocker re-organises the rules and sticks its rules back at the top? … This just me or has anyone else spotted it?
Considering it's documented behaviour… huh.
-
Well it may be I confess to not reading it all, just enough to get configured and running, don't have hours to burn trawling through pages and pages of small print.
So documented it may be but it is a feature that I could do without - rules should stay where I put them since rules are executed in the order presented and I (or any other) user should be able to set the execution preference and expect it to be obeyed.
-
So documented it may be but it is a feature that I could do without - rules should stay where I put them since rules are executed in the order presented and I (or any other) user should be able to set the execution preference and expect it to be obeyed.
Rules will stay where you want once you've read the documentation and created the lists as "Alias only" in "List Action" and placed them wherever you want.
-
they are configured as alias only and yet I've had to re-arrange them 3 times now. I did the aliasing bit specifically to make sure that certain 'targets' were exempt from certain rulesets.
I have a Spammer set, a malicious set and an advertising set Spammer and Malicious I put into floating because I want them to impact on all, I then have the web server followed by the advertising set … the server is aliased as is the local subnet, since the server is encountered first i.e. before the ads then robots etc still work - anything else gets advertising blocked.
I'll scan the documentation again but I'm sure I did it right.
-
My lists are aliased - Spammer1, Malicious1 and ads1, which translate to pfblockerMalicious1, pfblockerSpammer1 and pfblockerAds1 in the rules lists, these carry a comment 'do not edit this alias'
-
Well maybe it's fixed - appreciate the input, I hadn't spotted the 'alias only' in the dropdown box of the pfBlocker itself, I had seen the 'rules and alias only' but since everything I do uses aliases figured that was it - wrong.
I rebooted and things stayed put so despite the sarcasm re documentation I do appreciate the input ;)
-
Posted 'pfBlocker disables firewall on nanobsd when no there is no internet access at boot time' at:
https://redmine.pfsense.org/issues/3109
-
I just started having a possible issue with pfblocker. Even though I have it enabled and all the aliases are created and the CIDRs are present on the dashboard widget, the dashboard widget also shows red arrows pointing down in the status column. What does that mean? I could have sworn the column had green arrows pointing up. ???
-
@nipstech:
I just started having a possible issue with pfblocker. Even though I have it enabled and all the aliases are created and the CIDRs are present on the dashboard widget, the dashboard widget also shows red arrows pointing down in the status column. What does that mean? I could have sworn the column had green arrows pointing up. ???
Did you create any rules on WAN?
-
No I didn't. The only rules are the rules that block private and bogon networks.
-
@nipstech:
No I didn't. The only rules are the rules that block private and bogon networks.
Well, that is the problem… Create something safe there (like, access from 127.0.0.1 to some port). Known bug.
-
That fixed it! I created a safe rule on the WAN interface and even disabled it. Perhaps a "dummy" rule could be created as an option for those of us who run a stripped down firewall like I'm using.
Thanks, doktornotor! :)
-
Well it'd be better to fix the bug instead of creating the dummy rules… lol :D
-
You got that right!
-
When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..
-
When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..
Let me restate the problem: if your WAN contains no rules (beyond the default pseudo-rules - block private/bogon networks) this does NOT work. The rules are not added and the enable pfBlocker checkbox gets unchecked, and the widget looks as shown in this post. BUG.
-
Backing up libraries…
Removing package...
Removing pfBlocker components...
Tabs items... done.
Menu items... done.
Loading package instructions...I just updated to 2.1 release on my box here. Getting stuck at this while trying to reload pfblocker. Help!
Thanks! :)
-
Anyone else running pfblocker that's updated to 2.1 had issues with lists not updating / populating - all my list URL's are valid, reduced update time to 1 hour but the IP's aren't getting read / or the aliases populated.
As a result the alias is not 'created' and raises rule alerts for unreachable alias's.
Tried uninstalling and re-installing it didn't help - deleted the lists and re-added and that didn't help either …
Also getting a notice that Wan gateway is unknown not using it - which is utter tosh because it is both present and connected - this may or may not be related to pfBlocker
UPDATE : Typing the above prompted a grey cell - I went to check my 'routing' tables and when 2.1 was installed (2.0.3 update) the interfaces got renamed but the routing gateways did not - OPT1 did to OPT1_PPPOE but not WAN which in the system was now WAN_PPPOE ... only in the routing table it wasn't it was still 'WAN' ...
Sorting this sorted pfBlocker ...
-
Backing up libraries…
Removing package...
Removing pfBlocker components...
Tabs items... done.
Menu items... done.
Loading package instructions...I just updated to 2.1 release on my box here. Getting stuck at this while trying to reload pfblocker. Help!
Thanks! :)
found it.
https://forum.pfsense.org/index.php/topic,66571.msg363755.html#msg363755
-
I can't get pfblocker to load this list doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt
Has anyone used this list before?
Any ideas on this list? Also pfsense says it detected a crash and this is the info it contains:
Crash report begins. Anonymous machine information:
i386
8.3-RELEASE-p8
FreeBSD 8.3-RELEASE-p8 #1: Tue Jun 11 06:34:27 EDT 2013 root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8Crash report details:
PHP Errors:
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262Filename: /var/crash/minfree
2048Still getting the same as the quoted user and I haven't seen anyone respond to his post yet.
I'm running 2.1-RELEASE at the moment on my firewall and tested the same on 2 virtualbox VM's. Only difference from 2.1-BETA/RC being that php errors now get suppressed.
The list has ~9000 lines in it. I have tried to increase "Firewall Maximum Table Entries" to 999999999, but the list still wont load. Is the php process running out of memory or whats going on?
Also, does changing "Firewall Maximum Table Entries" require a reboot?
-
Also, does changing "Firewall Maximum Table Entries" require a reboot?
It does not require a reboot if you do not had exceeded it.
If you are getting max entries error, clean you lists before increasing "Firewall Maximum Table Entries" value.
-
Good afternoon ;D
I have pfblocker installed and running for months, but I never see any blocking going on at all. The tables do contain IP-adresses, I checked. What might be the cause of this if I may politely ask?
Thank you in advance for your help :-)
-
do you have any rules enabled? Its not showing anything most likely due to that.
-
-
Your list action is set to alias only.
In this situation, you need to create rules on wan and/or lan manually.
this is part of help text on list action field:
While creating rules with this list, keep aliasname in the beggining of rule description and do not end description with 'rule'.
custom rules with 'Aliasname something rule' description will be removed by package.The rule description is usefull only for pfblocker widget, It will block ips with or without this description :)
-
Your list action is set to alias only.
In this situation, you need to create rules on wan and/or lan manually.
this is part of help text on list action field:
While creating rules with this list, keep aliasname in the beggining of rule description and do not end description with 'rule'.
custom rules with 'Aliasname something rule' description will be removed by package.Thank you very much, Marcello :P
But isn't that what I did, per the above screenshots ( did I do it wrong? :-). Or is it the problem with the rule description?
Thank you sir ;D
-
keep pfblocker_emerging_block at the beggining of wan rule description.
On screenshot you have Emerging Threads Block ip list on rule description.
-
Also, does changing "Firewall Maximum Table Entries" require a reboot?
It does not require a reboot if you do not had exceeded it.
If you are getting max entries error, clean you lists before increasing "Firewall Maximum Table Entries" value.
I'm not getting any errors, the lists are simply not downloaded and I have no idea of how to debug this further. The list in question won't download on either of my pfSense virtual machines either, with or without touching the "Firewall Maximum Table Entries" value.
I am able to load much larger lists, like iblocklist's badpeers, that contains +40k CIDR's or the level1 list containing +250k entries.
Regards,
Joona -
keep pfblocker_emerging_block at the beggining of wan rule description.
On screenshot you have Emerging Threads Block ip list on rule description.
Again thank you very much, Marcello ;D
I have changed it into what you say, but nothing happens, per the attached screenshots.
Also, I tried something else. The zedu contains the *.edu from iblocklist.com. The table contains well over 52k IP-adresses/blocks, however, I can visit all these *.edu sites (for example, harvard.edu, but I tried more sites) without any problem ???
I must be doing something stupid wrong, but I don't know what :'(
Thank you again, Marcello ;D
-
Hello everyone,
I have a quick question regarding pfBlocker: does it make sense to use the DROP list in order to avoid becoming a source of SPAM? (in case I have infected computers on my network)
I don't have a mail server behind pfSense, and I already activated the TopSpammers from pfBlocker and I disabled any outgoing connections to port 25 (SMTP).
-
I disabled any outgoing connections to port 25 (SMTP).
If you disabled tcp 25 outgoing, no need to add any list to block ips since smtp port is blocked for all.
-
When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..
Marcello…. you listening?
I agree and this is what I have on my older box (x86) running 2.0.3. everything works fine
I built up a new box (amd64) and just started with a clean install of 2.1
I absolutely could not get pfBlocker running correctly so I've completely rebuilt the box and made pfBlocker the first package installed. All the lists are enabled and set to "deny both" for now. The system will not autopopulate the WAN rules. I get the LAN rules but NO WAN RULES.
Any ideas?
Rick
UPDATE… Read back a few days, created a dummy rule and stop/started pfBlocker. Rules populated and its all working.
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?Rick
-
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?
If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.
There is no wan rule problem. :)
-
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?
If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.
There is no wan rule problem. :)
So, if the lights are off you don't need to turn them off… but if you put a broken bulb in the socket then you can turn them off...
Ok, I don't understand... but its working so thats what matters.Thanks,
Rick -
I believe that I have a problem with pfblocker, but I'm not entirely sure. I am running inside of ESXi 5.5 and the blocked packets counters never show anything. I have the same setup that I had when I was running on bare metal, which would show the number of blocked packets per group increasing every day.
My basic setup:
ESXi 5.5
Wan using e1000 without passthrough (Supermicro AOC-SG-i2 with Intel 82575EB chipset)
Lan using e1000, also without passthrough (Same dual-port AOC-SG-i2 card as wan, different port of course)Installed packages:
pfblocker
snort
mailreport
rrd summaryAll group lists set up in pfblocker as aliases.
Firewall rules set up to block incoming from wan using these settings:
block, wan interface, ipv4, any protocol, source alias (eg pfblockerAfrica), any destinationI have ipv6 turned off in settings>advanced>networking.
I can successfully block and pass packets by adding different firewall rules to lan rules.
I have tried the wan rules both as standard wan and as floating (to enable instant blocking on match and eliminate the need to continue processing those packets.) Neither setting shows the blocked packet number increasing at all.
This may be related or not, but my Snort shows several alerts but no blocked IPs. I am using the settings as listed by jflsakfja in this post -> http://forum.pfsense.org/index.php/topic,64674.msg356959.html#msg356959 I would almost immediately get two blocked in snort, one had to do with ipv6 encapsulation and I can't recall what the other one was… some potential corporate policy violation that would always show up in the first two blocked violations.
As I was just going over my setup again in ESXi to see if I had any more relevant information to share, I may have stumbled on the problem. The wan vswitch/vm port group did not have promiscuous mode set. I have changed that and will see if that fixes it. If not, does anybody have any ideas of other things to check?
-
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?
If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.
There is no wan rule problem. :)
So, if the lights are off you don't need to turn them off… but if you put a broken bulb in the socket then you can turn them off...
Ok, I don't understand... but its working so thats what matters.Thanks,
RickSo if you dont have any rules enabled in pfsense on the wan interface (as in opening ports ) it is always blocking all traffic by default so pf blocker isnt going to add any extra protection. The only benefit there is to add a lan rule to block outbound traffic… ( I do this as well with adds and sites known to be malicious etc )...
If you have rules (ports open etc) then pfblocker comes in very handy in blocking traffic on those ports/rules. For example mail server.. Keeps alot of spam out or for websites alot of unnecessary traffic. I dont have people in certain countries now trying to run scripts all day long on my web servers or ftp....
-
OH, sorry if my post seemed off course…. I do understand how the pfBlocker works and works well once it's all configured.
I still think there is some sort of anomaly if you install pfBlocker on a clean slate.
I created a dummy rule (as suggested in an earlier post) and disabled it before I ever saved it. So, is it really a rule or just a place holder? A tickler to open the door for the rules to populate? I'm not complaining but rather trying to see if there is something in the system that could be "fixed/tweaked" so that future users don't encounter this issue.Having been a systems analyst for too many years, old ways die hard.
Rick