PfBlocker
-
-
Your list action is set to alias only.
In this situation, you need to create rules on wan and/or lan manually.
this is part of help text on list action field:
While creating rules with this list, keep aliasname in the beggining of rule description and do not end description with 'rule'.
custom rules with 'Aliasname something rule' description will be removed by package.The rule description is usefull only for pfblocker widget, It will block ips with or without this description :)
-
Your list action is set to alias only.
In this situation, you need to create rules on wan and/or lan manually.
this is part of help text on list action field:
While creating rules with this list, keep aliasname in the beggining of rule description and do not end description with 'rule'.
custom rules with 'Aliasname something rule' description will be removed by package.Thank you very much, Marcello :P
But isn't that what I did, per the above screenshots ( did I do it wrong? :-). Or is it the problem with the rule description?
Thank you sir ;D
-
keep pfblocker_emerging_block at the beggining of wan rule description.
On screenshot you have Emerging Threads Block ip list on rule description.
-
Also, does changing "Firewall Maximum Table Entries" require a reboot?
It does not require a reboot if you do not had exceeded it.
If you are getting max entries error, clean you lists before increasing "Firewall Maximum Table Entries" value.
I'm not getting any errors, the lists are simply not downloaded and I have no idea of how to debug this further. The list in question won't download on either of my pfSense virtual machines either, with or without touching the "Firewall Maximum Table Entries" value.
I am able to load much larger lists, like iblocklist's badpeers, that contains +40k CIDR's or the level1 list containing +250k entries.
Regards,
Joona -
keep pfblocker_emerging_block at the beggining of wan rule description.
On screenshot you have Emerging Threads Block ip list on rule description.
Again thank you very much, Marcello ;D
I have changed it into what you say, but nothing happens, per the attached screenshots.
Also, I tried something else. The zedu contains the *.edu from iblocklist.com. The table contains well over 52k IP-adresses/blocks, however, I can visit all these *.edu sites (for example, harvard.edu, but I tried more sites) without any problem ???
I must be doing something stupid wrong, but I don't know what :'(
Thank you again, Marcello ;D
-
Hello everyone,
I have a quick question regarding pfBlocker: does it make sense to use the DROP list in order to avoid becoming a source of SPAM? (in case I have infected computers on my network)
I don't have a mail server behind pfSense, and I already activated the TopSpammers from pfBlocker and I disabled any outgoing connections to port 25 (SMTP).
-
I disabled any outgoing connections to port 25 (SMTP).
If you disabled tcp 25 outgoing, no need to add any list to block ips since smtp port is blocked for all.
-
When you enable the countries, it should automatically put a rule up if you tell it to block inbound/outbound.. No need to manually create a rule. All of mine auto generated..
Marcello…. you listening?
I agree and this is what I have on my older box (x86) running 2.0.3. everything works fine
I built up a new box (amd64) and just started with a clean install of 2.1
I absolutely could not get pfBlocker running correctly so I've completely rebuilt the box and made pfBlocker the first package installed. All the lists are enabled and set to "deny both" for now. The system will not autopopulate the WAN rules. I get the LAN rules but NO WAN RULES.
Any ideas?
Rick
UPDATE… Read back a few days, created a dummy rule and stop/started pfBlocker. Rules populated and its all working.
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?Rick
-
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?
If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.
There is no wan rule problem. :)
-
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?
If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.
There is no wan rule problem. :)
So, if the lights are off you don't need to turn them off… but if you put a broken bulb in the socket then you can turn them off...
Ok, I don't understand... but its working so thats what matters.Thanks,
Rick -
I believe that I have a problem with pfblocker, but I'm not entirely sure. I am running inside of ESXi 5.5 and the blocked packets counters never show anything. I have the same setup that I had when I was running on bare metal, which would show the number of blocked packets per group increasing every day.
My basic setup:
ESXi 5.5
Wan using e1000 without passthrough (Supermicro AOC-SG-i2 with Intel 82575EB chipset)
Lan using e1000, also without passthrough (Same dual-port AOC-SG-i2 card as wan, different port of course)Installed packages:
pfblocker
snort
mailreport
rrd summaryAll group lists set up in pfblocker as aliases.
Firewall rules set up to block incoming from wan using these settings:
block, wan interface, ipv4, any protocol, source alias (eg pfblockerAfrica), any destinationI have ipv6 turned off in settings>advanced>networking.
I can successfully block and pass packets by adding different firewall rules to lan rules.
I have tried the wan rules both as standard wan and as floating (to enable instant blocking on match and eliminate the need to continue processing those packets.) Neither setting shows the blocked packet number increasing at all.
This may be related or not, but my Snort shows several alerts but no blocked IPs. I am using the settings as listed by jflsakfja in this post -> http://forum.pfsense.org/index.php/topic,64674.msg356959.html#msg356959 I would almost immediately get two blocked in snort, one had to do with ipv6 encapsulation and I can't recall what the other one was… some potential corporate policy violation that would always show up in the first two blocked violations.
As I was just going over my setup again in ESXi to see if I had any more relevant information to share, I may have stumbled on the problem. The wan vswitch/vm port group did not have promiscuous mode set. I have changed that and will see if that fixes it. If not, does anybody have any ideas of other things to check?
-
So, is this an issue with pfBlocker or do we need to make Chris and Jim aware of the WAN rules problem?
If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.
There is no wan rule problem. :)
So, if the lights are off you don't need to turn them off… but if you put a broken bulb in the socket then you can turn them off...
Ok, I don't understand... but its working so thats what matters.Thanks,
RickSo if you dont have any rules enabled in pfsense on the wan interface (as in opening ports ) it is always blocking all traffic by default so pf blocker isnt going to add any extra protection. The only benefit there is to add a lan rule to block outbound traffic… ( I do this as well with adds and sites known to be malicious etc )...
If you have rules (ports open etc) then pfblocker comes in very handy in blocking traffic on those ports/rules. For example mail server.. Keeps alot of spam out or for websites alot of unnecessary traffic. I dont have people in certain countries now trying to run scripts all day long on my web servers or ftp....
-
OH, sorry if my post seemed off course…. I do understand how the pfBlocker works and works well once it's all configured.
I still think there is some sort of anomaly if you install pfBlocker on a clean slate.
I created a dummy rule (as suggested in an earlier post) and disabled it before I ever saved it. So, is it really a rule or just a place holder? A tickler to open the door for the rules to populate? I'm not complaining but rather trying to see if there is something in the system that could be "fixed/tweaked" so that future users don't encounter this issue.Having been a systems analyst for too many years, old ways die hard.
Rick
-
If you do not have any rule on wan, you do not need deny rules from pblocker as you are already blocking all inbound traffic.
Maybe I add this info on next package update.
-
Hello Marcello,
is it possible to activate a list for a specific service?
I will explain it better…
I need to block connections to my email server so only to port 25 from PCs that usually are infected by Trojans.
I am currently using PFBlocker but it blocks all the traffic I can't specify a port.
If would be possible to specify a destination IP and/or port would be great.
Thanks in advance,
Marco
P.S. I guess you'll answer me to create an alias and use it in my custom rule but If you could add it straight in the
list wizard I guess would be perfect anyway:) -
is it possible to activate a list for a specific service?
P.S. I guess you'll answer me to create an alias and use it in my custom rule but If you could add it straight in the
list wizard I guess would be perfect anyway:)for now, only via alias and custom rules :)
-
Hello marcelloc & tommyboy180, thanks for pfBlocker. There used to be a Windows iblocklist manager over a decade ago(!) ; )
I was testing the pfBlocker package and I went only so far as almost adding a custom iBlocklist. Unfortunately the maximum list update interval is 24 hours (only). iBlocklist has recently begun restricting update interval themselves. Besides, shouldn't we make fair use of free resources like iblocklist and more…
-
Thanks so much for this package. It really saves us from a lot of spam!!
That being said, who would I report issues to. Until yesterday we were able to send email to an Hurricane Electric subscriber. Now the ip is being blocked. After adding the individual IP address for the smtp server into the "Lists" section/tab and selecting allow outbound, now we are able to communicate once again.
All that to say, which forum moderate the ipblocker list to have that range re-identified. I have us as an allowed range, but for some reason, at least, this one range is being id as not us.
Thanks
Daniel
-
Marcello or anyone with a good idea,
I am pulling my hair out over one new (to me) LIST.http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt
I've created, combined, deleted and used dozens of lists, both gz and txt, and had no issues. I can get THIS list built in pfBlocker but it never populates in rules, alias or in the dashboard widget. I've looked around the logs and not seen anything (good chance I'm looking in the wrong place). I know its a big list but some of yours are sizeable too. Per a discussion around snort on another thread I even bumped up my "Firewall Max Tables" and "Firewall Max Tables Entries". I'm running a 64bit copy of 2.1 with 4G memory that is only about 24% used.
I've made it a standalone rule, I've tried it in "deny" and "alias only" modes; neither way works. I've included it in another list under a single alias. Random selection of IPs from this list never make it into the tables. I've not had any problems with any other lists. I can get to THIS list from any browser behind the router/UTM so access through the network doesn't seem to be an issue. Any ideas? Am I missing something?
TIA,
Rick -
Bump!
OK, so I've tried other avenues and just can't get this list to build correctly. It shows in the list of "Lists" but just doesn't seem to go beyond that. I've killed off every other "added" list and started new with this one. All others build accordingly, this one just does nothing.
-
I"ve checked every log I can find but don't see any errors relating to this. Does anyone know exactly where an error would post if it is being logged?
-
could there be a corrupt marker somewhere that I need to kill? where would that be?
Thanks for any help or ideas?
Rick
Edit: had the time today so on the advice of two others I completely removed pfBlocker. Removed its files/directories. Reinstalled the whole package. Rebuilt all the lists I wanted under the lists tab… some txt, some gz. Every list rebuilt fine except this @#$$&#^ Russian Business Networks list. Unless someone has an idea, I'm going to throw in the towel on this one and just go with the RBN rules under SNORT. Marcello? Tommyboy?
Add: Does anyone have a confirmed instance of this list actually working?? -
-
I for one can't get the mentioned list to work. I've posted a php error related to the list on this thread when pfSense 2.1 was still in beta and it was showing the php error that occurs with said list.
-
Hi, got exactly the same problem, since a long ago, tried everything but this list http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt never loaded. This morning found this list http://rules.emergingthreats.net/blockrules/rbn-ips.txt that loads flawlessy. In my opinion it is quite the same listing. Try it.
-
I just made a URL Table Alias with http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt on a 2.1-RELEASE Alix nanoBSD. The table loads into pf with 9252 entries. Used it as source in a block rule on WAN and it works. So the list itself is not bad. And you can easily use it anyway without pfBlocker, just using the ordinary URL Table Alias and Firewall Rules features of pfSense.
-
I just made a URL Table Alias with http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt on a 2.1-RELEASE Alix nanoBSD. The table loads into pf with 9252 entries. Used it as source in a block rule on WAN and it works. So the list itself is not bad. And you can easily use it anyway without pfBlocker, just using the ordinary URL Table Alias and Firewall Rules features of pfSense.
Probably a stupid question (you are used to that coming from me by now ;D) but what actually is the added value of pfBlocker, given that obviously you can do the same that does without it, given your comment.
-
I can run this to see what happens getting the files:
$url_list1 = file("http://rules.emergingthreats.net/blockrules/rbn-ips.txt"); var_dump(count($url_list1)); $url_list2 = file("http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt"); var_dump(count($url_list2));
and I get:
int(9194) Warning: file(http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt): failed to open stream: HTTP request failed! HTTP/1.1 403 Forbidden in /usr/local/www/exec.php(246) : eval()'d code on line 7 int(1)
rbn-ips.txt is fetched OK by PHP into an array of 9194 entries.
RussianBusinessNetworkIPs.txt does not come, something blocking it from being read with PHP file()Additional info: If I change pfblocker.inc sync_package_pfblocker() to use the function download_file() from pfsense-utils.inc, downloading it first to a local file then letting the rest of the code parse a local copy, then it works. So the code in /etc/inc/pfsense-utils.inc:download_file() is able to download the list OK, getting 9251 entries.
Maybe pfblocker should use download_file() rather than PHP file()?
(That would need testing against a bunch of things people are using - some other list download might break???) -
Hi, got exactly the same problem, since a long ago, tried everything but this list http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt never loaded. This morning found this list http://rules.emergingthreats.net/blockrules/rbn-ips.txt that loads flawlessy. In my opinion it is quite the same listing. Try it.
Thanks! had no problem getting this one to load either. Looking at the site, at least this one seems more current as well. It's just a couple weeks old, not 2 years. I had brought the offend file local so I randomly picked about 30 addresses and they were in both so I'll hope the slightly lower line item count is because of newer data.
Rick
-
using pfblocker for the list management allows you to enter all the lists in a single alias. This is not possible for the regular aliases (url + url table). It's either many small lists, or one huge list, with those.
I'll start using http://rules.emergingthreats.net/blockrules/rbn-ips.txt since it causes fewer problems with people. Thanks for the info. Expect the update to come with the next blueprint update.
EDIT: Just checked and http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/emerging-rbn-malvertisers.txt should be http://rules.emergingthreats.net/blockrules/rbn-malvertisers-ips.txt, so it's 2 upcoming updates to the blueprint.
As far as I can remember those 2 were chosen because of lack of the rules.emergingthreats.net lists. -
@jflsakfja:
using pfblocker for the list management allows you to enter all the lists in a single alias. This is not possible for the regular aliases (url + url table). It's either many small lists, or one huge list, with those.
I'll start using http://rules.emergingthreats.net/blockrules/rbn-ips.txt since it causes fewer problems with people. Thanks for the info. Expect the update to come with the next blueprint update.
EDIT: Just checked and http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/emerging-rbn-malvertisers.txt should be http://rules.emergingthreats.net/blockrules/rbn-malvertisers-ips.txt, so it's 2 upcoming updates to the blueprint.
As far as I can remember those 2 were chosen because of lack of the rules.emergingthreats.net lists.Don't know your name so I'll just use the first two initials and say thanks JF!! (significant if you're a Phillip Dick fan… and how can you follow BOHP and not be a Dick fan)
One request; If possible and not too much hassle, could you somehow highlight the changes from your last blueprint?
I must say, since switching over to your method and using the rules to do pfblocker's work, even with more rules active under SNORT, system is much faster AND using much less memory. Which, made it possible to commit more memory to Squid which helps even more!
Thanks,
Rick -
I'm interested in the country-blocking abilities of pfBlocker.
I've got assets that are 99.99% of the time only accessed from within my country. So, I've added a rule with my country as the block list, then inverted the match so any traffic from OUTSIDE the country is dropped. Seems to work well enough, but can someone comment as to:
-
Where does pfBlocker gets its IPs from?
-
How often does pfBlocker update its IP list?
-
What is the likelihood that an IP range will be assigned to a country but won't be picked up by pfBlocker?
-
-
I'm interested in the country-blocking abilities of pfBlocker.
I've got assets that are 99.99% of the time only accessed from within my country. So, I've added a rule with my country as the block list, then inverted the match so any traffic from OUTSIDE the country is dropped. Seems to work well enough, but can someone comment as to:
-
Where does pfBlocker gets its IPs from?
-
How often does pfBlocker update its IP list?
-
What is the likelihood that an IP range will be assigned to a country but won't be picked up by pfBlocker?
1/ Here - The lists are 2 years old. ::)
2/ Never, the lists have gone commercial quite some time ago.
3/ Pretty high, given the above.All the country-based stuff should have been removed altogether from the package quite some time ago, useless.
-
-
I agree or the lists should be updated.
-
That is most unfortunate. I don't suppose anyone knows if an up-to-date country list is provided somewhere?
-
That is most unfortunate. I don't suppose anyone knows if an up-to-date country list is provided somewhere?
You can add the Country Block lists from IBlock Lists.
https://www.iblocklist.com/lists.php?category=country
I haven't tested it, but they are listed there.
-
Good afternoon,
Great thread so far, thanks for all your great detective work. :)
Im running pfs at a minimum with pfBlocker and system patches. I'm using nested alias lists: two url aliases, Evil_Lists_1 and 2, each containing 3-5 localhost list urls. All pfBlocker lists are set to "alias only" as I prefer to create my own rules (this also seems to be a better way according to others as well). I then created two WAN rules for each list, one to block inbound traffic and another to reject outbound traffic, and also two LAN rules for each interface rejecting outbound traffic for each list. They seem to be blocking properly as far as I can tell and the correct CIDR numbers are showing in the widget at all times but the lists are always shown as down in the widget. I have tried renaming my rule descriptions based on what Marcello and others have recommended in earlier posts ("lead with pfblocker* and dont end with rule") in varying ways but it still wont show as up in the widget.
Not a serious problem but I like the widget and I want it to work. Any suggestions?
Also, would I be better off having a rule for each original pfBlocker alias? I prefer steamlined rules and less of them, is there any benefit to individual rules other than the widget working?
Thanks again for an informative thread.
-
-
Not a serious problem but I like the widget and I want it to work. Any suggestions?
Try deleting the underscores from your alias descriptions, e.g., use 'pfBlockerEvilList' rather than 'pfBlockerEvil_List'. The widget doesn't seem to like spaces or special characters.
-
Semi-fix, I added the prefix "pfBlockerBadList1" and "pfBlockerBadList2" to the beginning of the respecive WAN rule for each and now both "pfBlockerBadList1" and "pfBlockerBadList2" show up in the widget and are recognized as being up; while this does not solve the original widget problem it does let me know at a glance that my lists are functioning; and as a nice additional benefit the packets that are blocked by the respective individual nested aliases within the two lists are still recorded correctly under the original widget list names. Sweet! :D
Here is a pictorial example of the lists:
(The blocked packets are not showing now beacause I restarted, but will show up under the individual list names, not BadList1/2, I like this.)
-
All issues we found has already been fixed.
The last thing to code is lists update frequency.
can you add the option to update weekly? it only allows up to daily right now ..which is awesome.. but sometimes iblocklist.com denies updating that frequently. at least it does on peerblock 1.2+ …
???
-
All issues we found has already been fixed.
The last thing to code is lists update frequency.
can you add the option to update weekly? it only allows up to daily right now ..which is awesome.. but sometimes iblocklist.com denies updating that frequently. at least it does on peerblock 1.2+ …
???
Isn't this done in a cron job? I think you can just set the cron job wday from a number 0-6 to set the day (somebody correct me if I am wrong).