PfBlocker

Mr. Jingles

I am running into a problem, BB :-\

Remove "#" from line 471 ( countrycode ) , and save/exit the script.

From the "Shell" run [ [b]./pfiprep killdb ]

This should download the Maxmind Country Code .zip file and automatically extract the .csv country Code Database.

It will create a file called "countrycode" which is a list of all the countries.

On First Install, the script will exit and ask you to edit the "countrycode" file.

Put a "#" infront of the countries to whitelist.

The file is created, but nothing is in it (zero bytes). The script issued this:


  [2.1.4-RELEASE][root@112]/home/badips(9): ./pfiprep killdb

**** UPDATE PROCESS START -  Sat Jul 26 17:13:39 CEST 2014  ****

 Deleting pfIP Rep Databases.

Databases have been Deleted!

find: /home/badips/countrycodes: No such file or directory
rm: /home/badips/cc_csv.lock: No such file or directory
find: /home/badips/GeoIPCountryWhois.csv: No such file or directory
rm: /home/badips/cc_csv.lock: No such file or directory
looking up geolite.maxmind.com
connecting to geolite.maxmind.com:443
SSL connection established using RC4-SHA
Certificate subject: /serialNumber=dfgdighiofgiodfiogdiofgdjkfq4Js/C=US/O=*.maxmind.com/OU=GT53364002/OU=See www.rap112sl.com/resources/cps (c)11/OU=Domain Control Validated - Rap112SL(R)/CN=*.maxmind.com
Certificate issuer: /C=US/O=GeoTrust, Inc./CN=Rap112SL CA
requesting https://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip
remote size / mtime: 1444832 / 1404267648

/home/badips/GeoIPCountryCSV.zip              100% of 1410 kB  164 kBps

unzip:  cannot find or open /home/badipsGeoIPCountryCSV.zip, /home/badipsGeoIPCountryCSV.zip.zip or /home/badipsGeoIPCountryCSV.zip.ZIP. 

cut: /home/badips/GeoIPCountryWhois.csv: No such file or directory

Please edit [ /home/badips/countrycodes ] and comment # the countries to  SAFELIST  before proceeding with CC Blocking

[2.1.4-RELEASE][root@112]/home/badips(10):

(I scrambled that serial number there since I don't know if it should be pasted here).

What should I do?

Thank you ;D

BBcan177

Hi Hollander, Looks like I missed a "/",

In pfiprepman, Line 416

** $pathunzip -o $userfolder$infile**

change it to:

$pathunzip -o $userfolder/$infile

Sorry about that.

kenshirothefist

@kenshirothefist:

First of all, pfBlocker is a great package, cheers to the authors! However, it would be very useful (some users already highlighted this) to have more options for "Update frequency". Specifically I would like to see one very short and one longer frequency, like "Every 10 Minutes" and "Once a week". Could you add this?

And just out of curiosity, how is this updating handled, I don't see any crontab entry for pfBlocker?

Any comments on this?

Also, I would like to ask you if there is any way to manually update the list? Thanks!

BBcan177

@kenshirothefist:

@kenshirothefist:

First of all, pfBlocker is a great package, cheers to the authors! However, it would be very useful (some users already highlighted this) to have more options for "Update frequency". Specifically I would like to see one very short and one longer frequency, like "Every 10 Minutes" and "Once a week". Could you add this?

And just out of curiosity, how is this updating handled, I don't see any crontab entry for pfBlocker?

Any comments on this?

Also, I would like to ask you if there is any way to manually update the list? Thanks!

When you enable pfBlocker, it creates a cron entry

0 * * * * root /usr/local/bin/php /usr/local/www/pfblocker.php cron

The way pfBlocker works is it looks to see if there is an existing file in the:

/usr/local/pkg/pfblocker (folder) for the Blocklist. If its there, it will reload the existing file. If its not there, it will download the file from the URL you entered for the Blocklist. When the CRON job runs, if the list is scheduled to be updated, that file is deleted so that it will download a new file.

So the only way to do that is to manually delete the Blocklist file in that folder. Unfortunately, the file is named after the MD5 hash of the URL making it a little difficult to see which file belongs to which Blocklist.

You could try running this command from the shell to determine what the md5 Hash is and than seeing if a file exists with that hash.txt and delete it. Than you can click "Save" in pfBlocker which should re-download the new file.

md5 -s 'http://www.spamhaus.org/drop/drop.txt'

MD5 ("http://www.spamhaus.org/drop/drop.txt") = d2278c81b67d798693429e4feb04a83a

http://www.freebsd.org/cgi/man.cgi?query=md5&sektion=1

LinuxTracker

@BBcan177:

The Country Database in pfBlocker hasn't been updated for over 2 years now. The data is obsolete.

I've been recently looking at this and found we have 2 issues.
One is the out of date IP ranges, which you know about.
The other is a few ISO country codes probably need to be updated.

@BBcan177:

I know they are working on a new service (most likely for paid members) that will provide updates for the Country Lists.

I guess it's been a couple of years since CountryIPBlocks went to pay-for-play.

Back then, marcelloc and I both reached out to the CIPB guy and tried to work out a compromise that would allow pfBlocker to keep updating from CIPB.

CIPB's compromise was that each pfBlocker user would pay CIPB for it's repackaged public data.
That didn't seem like much of a compromise so here we are.

Anyhoo:
I've found a source of current country IP data yesterday and wrote a short Bash script to push it into pfBlocker.
It looks good but while cross-checking the data I found pfBlocker has a couple of outdated country (ISO 3166-1 alpha-2) codes.

Also - I still want to find+vet a couple more data sources.
I'll post what I come up with and we'll see what everyone thinks.

Thanks

BBcan177

@LinuxTracker:

I've found a source of current country IP data yesterday and wrote a short Bash script to push it into pfBlocker.
It looks good but while cross-checking the data I found pfBlocker has a couple of outdated country (ISO 3166-1 alpha-2) codes.

Also - I still want to find+vet a couple more data sources.
I'll post what I come up with and we'll see what everyone thinks.

Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.

I have also release a script to utilize country Blocking:
https://forum.pfsense.org/index.php?topic=78062.15

Would be interested to see what you have come up with.

Maybe you can PM me a copy? Would also be interested in helping getting it off the ground.

LinuxTracker

@BBcan177:

Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.

That was the site that had a .CSV file of IPs in ranges, right?
I think I saw somewhere in the thread that pfBlocker will work with ranges - something I didn't know.

However, I prefer working w/ CIDR (I'd explain why if anyone cares) and am looking at CIDR sources right now.

I'll give another look at Maxmind GeoIP if my 'Plan A' doesn't work out.

BBcan177

@LinuxTracker:

@BBcan177:

Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.

That was the site that had a .CSV file of IPs in ranges, right?
I think I saw somewhere in the thread that pfBlocker will work with ranges - something I didn't know.

However, I prefer working w/ CIDR (I'd explain why if anyone cares) and am looking at CIDR sources right now.

I'll give another look at Maxmind GeoIP if my 'Plan A' doesn't work out.

Here is a sample.

Its all in one file, and its not too hard to convert to CIDR and break it down in the XX Country Codes with some grep and awk commands.

"223.255.128.0","223.255.191.255","3758063616","3758079999","HK","Hong Kong"
"223.255.192.0","223.255.223.255","3758080000","3758088191","KR","Korea, Republic of"
"223.255.224.0","223.255.231.255","3758088192","3758090239","ID","Indonesia"
"223.255.232.0","223.255.235.255","3758090240","3758091263","AU","Australia"
"223.255.236.0","223.255.239.255","3758091264","3758092287","CN","China"
"223.255.240.0","223.255.243.255","3758092288","3758093311","HK","Hong Kong"
"223.255.244.0","223.255.247.255","3758093312","3758094335","IN","India"
"223.255.252.0","223.255.253.255","3758095360","3758095871","CN","China"
"223.255.254.0","223.255.254.255","3758095872","3758096127","SG","Singapore"
"223.255.255.0","223.255.255.255","3758096128","3758096383","AU","Australia"

LinuxTracker

@BBcan177:

@LinuxTracker:

That was the site that had a .CSV file of IPs in ranges, right?

Here is a sample.
Its all in one file, and its not too hard to convert to CIDR and break it down in the XX Country Codes with some grep and awk commands.
"223.255.128.0","223.255.191.255","3758063616","3758079999","HK","Hong Kong"
"223.255.192.0","223.255.223.255","3758080000","3758088191","KR","Korea, Republic of"
"223.255.224.0","223.255.231.255","3758088192","3758090239","ID","Indonesia"
"223.255.232.0","223.255.235.255","3758090240","3758091263","AU","Australia"
"223.255.236.0","223.255.239.255","3758091264","3758092287","CN","China"

Your data source seems more trustworthy than what I've found.

I'll PM you the script to d/l+extract the country IPs into .txt files as soon as I puzzle it out.

kevin067

Hi, does anybody know what triggers the reset of the pfBlocker's dashboard packet count? It would be much more useful if it only cleared when I clear the counter. Right now it just seems to clear the packet count randomly.

Thanks,
Kevin

Cino

anything that reloads your rules/filter will do it. look for check_reload_status: Syncing firewall in your system log

marcelloc

HI, for those who want to test an updated country list from a new source before I try to update it on package install, follow these steps on console


cd /usr/local/pkg
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Africa_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Asia_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Europe_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/North_America_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Oceania_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/South_America_cidr.txt
php /usr/local/www/pfblocker.php uc

After this, access pfblocker gui and save config again.

You can check applied networks/cidrs on diagnostics -> tables

BBcan177

@marcelloc:

HI, for those who want to test an updated country list from a new source before I try to update it on package install, follow these steps on console

Hi Marcello,

This updates correctly. What is the source of the Country code files if you don't mind sharing?

Thanks.

tommyboy180

I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

ipblocklist
HOLD - cidr
dashboard HUD
Remove IPFW Flush
Complete - ensure /usr/local/pkg/pf/ .sh is removed
Complete - whitelists on reboot
Complete - logging doesn't stay enabled when you click save/update
Complete - remove unique -u to just unique
Complete - remove warning from GUI
Complete - add lvl1 by default
Complete - change description to use the phrase peerblock
Complete - remove "ipfw -f flush" commands from php and uninstall process.
Complete - setenv PACKAGESITE "ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8-stable/Latest/" before pkg_add -r "package"
Complete - pkg_add -r p5-NET-CIDR p5-Net-CIDR-0.14 CURRENT
Complete - pkg_add -r perl perl-5.10.1_1 TO perl-5.12.4_2
Complete - don't uninstall perl and p5-cidr-net at uninstall

countryblock
Complete - ensure /usr/local/pkg/pf/ .sh is removed
Complete - update CIDR.php file
Complete - Remove Email
Remove IPFW Flush

strikeback
auto start
auto settings (root user)

ideas:
hybrid ipblockist and countryblock. Tab seperate the roles. one package - one stop shop. Name: Layer3 Shield or Layer3 Filter or Security
iplocklist and countryblock redirection on outbound if going to blocked ip's!!!

This note is dated 2010!

BBcan177

@tommyboy180:

I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

This note is dated 2010!

If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker. :)

stephenw10

Can't imagine anyone would be intested in that. ;)
Oh wait….

kilthro

@stephenw10:

Can't imagine anyone would be intested in that. ;)
Oh wait….

rofl

@BBcan177:

@tommyboy180:

I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

This note is dated 2010!

If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker. :)

Please share. :-D I would love to see this package get a facelift and some TLC. Besides Snort this is one of the must have packages imo.

kilthro

@tommyboy180:

I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

This note is dated 2010!

/gasp!

BBcan177

They say a Picture is worth a 1000 words, so I will post 4 pics.

I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.

Any programming help would also be appreciated to help expedite the process…. ;)

Link to the pfBlocker (General Tab)
http://imgur.com/h0708WP

Link to the pfBlocker (Reputation Tab)
http://imgur.com/9AGK95V

Link to the pfBlocker (LISTS Tab)
http://imgur.com/4Wgq4sk

Link to the pfBlokcer (LOG Tab)
http://imgur.com/SNQ85RT

panz

I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.