PfBlocker

JSmorada

You got that right!

kilthro

When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..

doktornotor

@kilthro:

When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..

Let me restate the problem: if your WAN contains no rules (beyond the default pseudo-rules - block private/bogon networks) this does NOT work. The rules are not added and the enable pfBlocker checkbox gets unchecked, and the widget looks as shown in this post. BUG.

chpalmer

Backing up libraries…
Removing package...
Removing pfBlocker components...
Tabs items... done.
Menu items... done.
Loading package instructions...

I just updated to 2.1 release on my box here. Getting stuck at this while trying to reload pfblocker. Help!

Thanks! :)

BenKenobe

Anyone else running pfblocker that's updated to 2.1 had issues with lists not updating / populating - all my list URL's are valid, reduced update time to 1 hour but the IP's aren't getting read / or the aliases populated.

As a result the alias is not 'created' and raises rule alerts for unreachable alias's.

Tried uninstalling and re-installing it didn't help - deleted the lists and re-added and that didn't help either …

Also getting a notice that Wan gateway is unknown not using it - which is utter tosh because it is both present and connected - this may or may not be related to pfBlocker

UPDATE : Typing the above prompted a grey cell - I went to check my 'routing' tables and when 2.1 was installed (2.0.3 update) the interfaces got renamed but the routing gateways did not - OPT1 did to OPT1_PPPOE but not WAN which in the system was now WAN_PPPOE ... only in the routing table it wasn't it was still 'WAN' ...

Sorting this sorted pfBlocker ...

chpalmer

@chpalmer:

Backing up libraries…
Removing package...
Removing pfBlocker components...
Tabs items... done.
Menu items... done.
Loading package instructions...

I just updated to 2.1 release on my box here. Getting stuck at this while trying to reload pfblocker. Help!

Thanks! :)

found it.

https://forum.pfsense.org/index.php/topic,66571.msg363755.html#msg363755

fragged

@justsomeguy6575:

@justsomeguy6575:

I can't get pfblocker to load this list doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt

Has anyone used this list before?

Any ideas on this list? Also pfsense says it detected a crash and this is the info it contains:

Crash report begins. Anonymous machine information:

i386
8.3-RELEASE-p8
FreeBSD 8.3-RELEASE-p8 #1: Tue Jun 11 06:34:27 EDT 2013 root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262

Filename: /var/crash/minfree
2048

Still getting the same as the quoted user and I haven't seen anyone respond to his post yet.

I'm running 2.1-RELEASE at the moment on my firewall and tested the same on 2 virtualbox VM's. Only difference from 2.1-BETA/RC being that php errors now get suppressed.

The list has ~9000 lines in it. I have tried to increase "Firewall Maximum Table Entries" to 999999999, but the list still wont load. Is the php process running out of memory or whats going on?

Also, does changing "Firewall Maximum Table Entries" require a reboot?

marcelloc

@fragged:

Also, does changing "Firewall Maximum Table Entries" require a reboot?

It does not require a reboot if you do not had exceeded it.

If you are getting max entries error, clean you lists before increasing "Firewall Maximum Table Entries" value.

Mr. Jingles

Good afternoon ;D

I have pfblocker installed and running for months, but I never see any blocking going on at all. The tables do contain IP-adresses, I checked. What might be the cause of this if I may politely ask?

Thank you in advance for your help :-)

00001.jpg_thumb

kilthro

do you have any rules enabled? Its not showing anything most likely due to that.

Mr. Jingles

Thank you very much for your reply, Kilthro ;D

Yes, I think ( :o) I have. I have created screenshots as an example for one alias. Would you say I did something wrong (this is not to be ruled out, given it is me who is doing things :P)?

;D

Thank you for your help,

Bye,

marcelloc

Your list action is set to alias only.

In this situation, you need to create rules on wan and/or lan manually.

this is part of help text on list action field:

While creating rules with this list, keep aliasname in the beggining of rule description and do not end description with 'rule'.
custom rules with 'Aliasname something rule' description will be removed by package.

The rule description is usefull only for pfblocker widget, It will block ips with or without this description :)

Mr. Jingles

@marcelloc:

Your list action is set to alias only.

In this situation, you need to create rules on wan and/or lan manually.

this is part of help text on list action field:

While creating rules with this list, keep aliasname in the beggining of rule description and do not end description with 'rule'.
custom rules with 'Aliasname something rule' description will be removed by package.

Thank you very much, Marcello :P

But isn't that what I did, per the above screenshots ( did I do it wrong? :-). Or is it the problem with the rule description?

Thank you sir ;D

marcelloc

keep pfblocker_emerging_block at the beggining of wan rule description.

On screenshot you have Emerging Threads Block ip list on rule description.

fragged

@marcelloc:

@fragged:

Also, does changing "Firewall Maximum Table Entries" require a reboot?

It does not require a reboot if you do not had exceeded it.

If you are getting max entries error, clean you lists before increasing "Firewall Maximum Table Entries" value.

I'm not getting any errors, the lists are simply not downloaded and I have no idea of how to debug this further. The list in question won't download on either of my pfSense virtual machines either, with or without touching the "Firewall Maximum Table Entries" value.

I am able to load much larger lists, like iblocklist's badpeers, that contains +40k CIDR's or the level1 list containing +250k entries.

Regards,
Joona

Mr. Jingles

@marcelloc:

keep pfblocker_emerging_block at the beggining of wan rule description.

On screenshot you have Emerging Threads Block ip list on rule description.

Again thank you very much, Marcello ;D

I have changed it into what you say, but nothing happens, per the attached screenshots.

Also, I tried something else. The zedu contains the *.edu from iblocklist.com. The table contains well over 52k IP-adresses/blocks, however, I can visit all these *.edu sites (for example, harvard.edu, but I tried more sites) without any problem ???

I must be doing something stupid wrong, but I don't know what :'(

Thank you again, Marcello ;D

IceCub

Hello everyone,

I have a quick question regarding pfBlocker: does it make sense to use the DROP list in order to avoid becoming a source of SPAM? (in case I have infected computers on my network)

I don't have a mail server behind pfSense, and I already activated the TopSpammers from pfBlocker and I disabled any outgoing connections to port 25 (SMTP).

marcelloc

@IceCub:

I disabled any outgoing connections to port 25 (SMTP).

If you disabled tcp 25 outgoing, no need to add any list to block ips since smtp port is blocked for all.

Ramosel

@kilthro:

When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..

Marcello…. you listening?

I agree and this is what I have on my older box (x86) running 2.0.3. everything works fine

I built up a new box (amd64) and just started with a clean install of 2.1

I absolutely could not get pfBlocker running correctly so I've completely rebuilt the box and made pfBlocker the first package installed. All the lists are enabled and set to "deny both" for now. The system will not autopopulate the WAN rules. I get the LAN rules but NO WAN RULES.

Any ideas?

Rick

UPDATE… Read back a few days, created a dummy rule and stop/started pfBlocker. Rules populated and its all working.
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?

Rick

marcelloc

@Ramosel:

So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?

If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.

There is no wan rule problem. :)