Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.3m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      splmachine
      last edited by

      I'm also having a problem "finding" the IP's that the widget is blocking. I go Status: System logs: Firewall but I see a bunch of traffic blocked. I added some allow rules in pfblocker and I see some IP's allowed but don't know what list they are from or any way to tell they are from pfblocker.

      I grepped my syslogs and do not see anything except for stuff like this: /pkg_edit.php: [pfblocker] pfblocker_xmlrpc_sync.php is starting.  I can see the see the pfblocker lists in the widget on the dashboard counting packets and I can see the IP lists in the Diagnostics: Tables so I know it's working, but I'm not sure where to be looking for detailed info such as logs that say pfblocker and then the list name and the IP's that were blocked. Any info will help

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        For the blocklists that you created in pfBlocker, did you use "aliases"? This is the preferred way to utilize pfBlocker.

        Once the aliases are created by the pfBlocker program, you can add block or reject rules on each interface utilizing the defined aliases.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • S
          splmachine
          last edited by

          Thanks I did not realize that alias_only was the proper way to implement this.I was originally using the deny drop down. I've modified the lists to use alias_only and added the rules on the interfaces. I'm still unclear as to how to know that pfBlocker was the reason an IP was blocked (or more specifically which alias I would need to check).

          Is there a log entry that's created that say something like "pfBlocker [alias name]: log entry"and the alias name or something in the log?

          Also is it normal to have the pfBlocker widget show the lists and the "up" status but the packets field is blank? Sorry if I'm missing something obvious.

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            When you create a block or reject rule for an alias, any ip addresses that are listed in a particular alias will shows blocks/rejects in the firewall log.

            I like to have separate aliases so i can tell which list/alias is blocking/rejecting.

            The widget will show a green up arrow once a rule is associated to an alias name. The packet counter has never worked from what I can tell.

            When you look at the firewall logs it will show the block/reject by interface, Rule name, ip address etc..

            If you modify a rule, it can mismatch the alerts to the firewall logs. This hopefully will be fixed in the next release (2.2). So before making changes to rules it's a good habit to look at the firewall logs first.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • S
              splmachine
              last edited by

              I understand the block/reject rules based on an alias. That part is working as expected for the most part and there are now sites that I can't ping. In my logs I do not see any reference to pfBlocker or which alias the IP's belong to. You stated that you have separate aliases (and I do too) but I'm wondering if there is another step I'm missing.

              Basically, this isn't the case for me but this is what I'm after:

              When you look at the firewall logs it will show the block/reject by interface, Rule name, ip address etc..

              All I get is "rule <number>(match): block in <interface>: and then some protocol stuff, ttl, id, offset, and flags. Maybe something needs to be cleared or reset?</interface></number>

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                When you add the rules, make sure you click "log packets that are handled by this rule" so that they show up in the Firewall logs

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • S
                  splmachine
                  last edited by

                  Under Firewall: pfBlocker, I have the "Enable Logging" checked. Also for each pfBlocker alias (one firewall rule per alias) I also have "Log packets that are handled by this rule" checked. I had that enabled logging checked for almost every single rule previously. Would someone be able to give me a string to grep for to see if I have any reference to that in my logs? I grepped for pfBlocker (with -i) and nothing except status messages come up. That's why I wonder if I needed to reset or reconfigure something to get it to work as expected.

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    That's odd.. did you check the firewall settings tab settings? If you don't see any alerts from pfblocker in the firewall log than greping from a shell won't get you anywhere.

                    When you hover over a rule that holds a pfblocker alias, does it show a list of ip addresses? Or check to see if in the Tables menu that the aliases have addresses?

                    If you have a block or reject rule on the LAN interface for a pfBlocker list, try to ping one of those addresses and see if it generates an alert in the firewall tab.

                    Maybe a reinstall of pfBlocker or start a new thread for this issue?

                    EDIT - if you want to grep the logs, grep for "block in on". If they alerts were there, they would also have the pfBlocker alias name (rule name)

                    grep -i "block in on" /var/log/*

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • S
                      splmachine
                      last edited by

                      Yes, the alias do have a list of IPs (with the exception of 2 lists that were massive). I've removed the 2 lists that were acting up and confirmed both in the tables menu and by hovering over the aliases. I do have the LAN rules and while I cannot ping the IP's, no logs are generated from it. I have reinstalled pfBlocker before I started this thread but I'm going to wipe the settings and remove pfBlocker and then start fresh. I figured something isn't working properly since it seems everything is in order. Thanks for the pointers though.

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        If the blacklists are large, it can take a little longer to view the list as you hover over the rule. They are most likely working correctly.

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • S
                          st4t1c
                          last edited by

                          I'm using pfblocker with a simple configuration and it might be the culprit for some wierd behavior i get in my network…

                          Configuration:

                          Inbound Interfaces: WAN
                          Inbound deny action: Block

                          Outbound Interfaces: LAN
                          Outbound deny action: Reject

                          Every list & country blocked is with "deny inbound".

                          Is the setting for the outbound interfaces needed if all the actual lists and countries are deny inbound only?...

                          i suspect pfblocked is blocking some valid outgoing traffic for a specific lan service (some outgoing sendmail) but i cant find anything in the logs.

                          This behavior only gets fixed after i restart the whole firewall, and works fine for about 10-15 days.After that, no outgoing mails are possible, till i restart the machine. Everything else seems to be working fine, only connections to the specific mail relay server.

                          Please give me some insight on what i should be looking for to fix the problem permanently.

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            The Country Codes is not being supported any longer and should not be used as it is Out of Date this functionality should be removed from the package. Hopefully pfBlocker will be getting a face lift in pfSense v 2.2.?

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • W
                              w1ll1am
                              last edited by

                              Hello,

                              So I just installed pfBlocker and I am trying to find some good ad blocking lists. My comparison list(s) are from AdAway on Android which pulls from the below sites.

                              http://hosts-file.net/.%5Cad_servers.txt
                              http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts$showintro=0&mimetype=plaintext
                              http://winhelp2002.mvps.org/hosts.txt

                              The test site I am using to check the ad blocking is http://extreme.outervision.com/psucalculatorlite.jsp

                              When using AdAway on Android I don't get any ads along the sides/top of the above site. I tried using the Bluetrack ad list from here http://list.iblocklist.com/?list=dgxtneitpuvgqqcpfulq&fileformat=p2p&archiveformat=gz but I still get ads on the site.

                              Can pfblocker use a list of URLs or does it only do IP address? If it only does IP address I guess that is fine, I have made a bash script that will pull the lists from the AdAway sites and convert the URLs into IP address. My only issue with the script I have is I don't know of a way to convert all of the IP addresses into a smaller list of CDIR networks so I have just made each IP into its own network by adding a /32 which I am sure is an awful idea. So if anyone knows how to convert a huge amount of IP addresses into CDIR notation or if there is a way to use URLs with pfblocker can you please let me know. Thanks.

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                Hi w1ll1am,

                                These lists are all URL and can't be used by pfBlocker.

                                pfBlocker only accepts the following formats:

                                Note:
                                Compressed lists must be in gz format.
                                Downloaded or local file must have only one network per line and could follows PeerBlock syntax or this below:
                                Network ranges: 172.16.1.0-172.16.1.255
                                IP Address: 172.16.1.10
                                CIDR: 172.16.1.0/24

                                pfBlocker already can accept the IBlock lists without any conversion (as they are in a range format already), but the following will also convert the file which you could link pfBlocker to a local txt file.

                                The following will download and convert that file to a range acceptable by pfBlocker.

                                fetch -v -o infile.gz -T 20 ?list=dgxtneitpuvgqqcpfulq&fileformat=p2p&archiveformat=gz
                                gunzip infile.gz

                                cat infile | cut -d':' -f2

                                I posted several lists here:

                                https://forum.pfsense.org/index.php?topic=73353.msg402927#msg402927

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • W
                                  w1ll1am
                                  last edited by

                                  Thanks BBcan17. Those lists look good I will use some of them. I managed to get my script to work with the AdAway lists.

                                  I have posted it on paste bin http://pastebin.com/xJYz9qgW
                                  I have also posted the cleaned up list of URLs from those three sites http://pastebin.com/vFbA20CG which will make the script much quicker if you pass it into the script at run time, it will only update newly added sites. Which you could then add the new IP address to the IP list for those URLs as of 5/23 http://pastebin.com/f3kUW3ar

                                  There are about 10000 IP address and they seem to be blocking a ton of traffic

                                  I have not tested it a lot but I have noticed some sites that are blocked that shouldn't be like unix.stackexchange.com ( already removed from the pastebin IP list )

                                  please excuse my poor bash code.

                                  ![Screenshot - 05232014 - 11:10:29 AM.png](/public/imported_attachments/1/Screenshot - 05232014 - 11:10:29 AM.png)
                                  ![Screenshot - 05232014 - 11:10:29 AM.png_thumb](/public/imported_attachments/1/Screenshot - 05232014 - 11:10:29 AM.png_thumb)

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    Hi w1ll1am,

                                    Spammers must die! There is also a website called "Phishtank" that has Phishing URL's posted also.

                                    I think you might get some false positives with this method. As some of these hosts are actually hosted by Big ISP's.

                                    These URLs would be better suited for DNS lookup blocking methods (hosts file). Need to find a way to weed out the false positives.

                                    I would like to have this accomplished on my MS Active Directory DNS server so that it can handle all of the workstations it manages and filter out DNS requests to these URLS. It would be a good addition to the DNS Forwarder/BIND etc packages in pfSense also.

                                    I pulled some of the hosts from the first link and ran a Dig command. It shows as Yahoo.

                                    [1]
                                    dig +short ypn-js.overture.com
                                    us.srv.ysm.yahoodns.net.
                                    98.139.225.108

                                    [2]
                                    dig +short 13.ptp22.com
                                    50.62.128.39

                                    IPVOID shows it being Registered by GoDaddy.
                                    http://www.ipvoid.com/scan/50.62.128.39/

                                    [3]
                                    dig +short admeld.com

                                    Google

                                    173.194.43.97
                                    173.194.43.103
                                    173.194.43.98
                                    173.194.43.105
                                    173.194.43.110
                                    173.194.43.101
                                    173.194.43.99
                                    173.194.43.100
                                    173.194.43.102
                                    173.194.43.96
                                    173.194.43.104

                                    http://kb.bothunter.net/ipInfo/nowait.php?IP=173.194.43.97

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      Mr. Jingles
                                      last edited by

                                      @phil.davis:

                                      I just made a URL Table Alias with http://doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt on a 2.1-RELEASE Alix nanoBSD. The table loads into pf with 9252 entries. Used it as source in a block rule on WAN and it works. So the list itself is not bad. And you can easily use it anyway without pfBlocker, just using the ordinary URL Table Alias and Firewall Rules features of pfSense.

                                      I still have this list in my firewall rules. But to date it still has the 9252 IP's so I assume it has never been updated since last year. As I am working on the new thread of JFL (https://forum.pfsense.org/index.php?topic=78062.0), I was wondering, are all instructions in this thread obsolete (so I should also delete this large IP-list?)

                                      6 and a half billion people know that they are stupid, agressive, lower life forms.

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kevin067
                                        last edited by

                                        I have been using pfblocker for over a year now. I consider pfBlocker and Snort combo an essential part of a firewall. PFBlocker successfully removes entire countries such as China removing about 80% of the intrusions and Snort takes care of the rest, and handles exotic things such as detecting port scanning. Ever since, I have had zero problems with real intrusions into my network.

                                        After making intense use of it to also handle my whitelists and blacklists (because it likes to re-order the rules otherwise) I find it convenient that shows me in the dashboard the status and blocks with labels in the firewall log.

                                        I wish though that I could selectively set the logging flag because if I choose logging for black lists, I end up getting the blocked country also.

                                        I do not want to use an alias or to create these rules manually in the rules because I want pfblocker to manage them so I can see this in the dashboard. And it re-orders the rules if it doesn't manage them itself. Also when I have problems I can mass disable all the block rules from pfblocker so I can diagnose who is generating the false positive.

                                        Very simple change I hope.
                                        Thanks,
                                        Kevin

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          MarkVLK
                                          last edited by

                                          I have logging enabled in pfBlocker but I never see anything in the system logs even when I see that the pfBlocker widget has blocked some packets. Any idea what I may need to change to remedy this problem?

                                          Also, is there any way to have it persist the stats, e.g. how many packets it blocks? Looks like every time the firewall filter gets reloaded, the pfBlocker widget goes back to showing all 0's for the number of packets it has blocked.

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            Cino
                                            last edited by

                                            logging means that the blocks/rejects will show up in your firewall log, not your system log. If you click on the red/yellow X, it should tell you which rule was triggered.

                                            persist stats would be great but the system grabs the stats directly from the rules in realtime. That is why is why they reset to 0 when your rules are reloaded.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.