PfBlocker
-
First of all, pfBlocker is a great package, cheers to the authors! However, it would be very useful (some users already highlighted this) to have more options for "Update frequency". Specifically I would like to see one very short and one longer frequency, like "Every 10 Minutes" and "Once a week". Could you add this?
And just out of curiosity, how is this updating handled, I don't see any crontab entry for pfBlocker?
Any comments on this?
Also, I would like to ask you if there is any way to manually update the list? Thanks!
When you enable pfBlocker, it creates a cron entry
0 * * * * root /usr/local/bin/php /usr/local/www/pfblocker.php cron
The way pfBlocker works is it looks to see if there is an existing file in the:
/usr/local/pkg/pfblocker (folder) for the Blocklist. If its there, it will reload the existing file. If its not there, it will download the file from the URL you entered for the Blocklist. When the CRON job runs, if the list is scheduled to be updated, that file is deleted so that it will download a new file.
So the only way to do that is to manually delete the Blocklist file in that folder. Unfortunately, the file is named after the MD5 hash of the URL making it a little difficult to see which file belongs to which Blocklist.
You could try running this command from the shell to determine what the md5 Hash is and than seeing if a file exists with that hash.txt and delete it. Than you can click "Save" in pfBlocker which should re-download the new file.
md5 -s 'http://www.spamhaus.org/drop/drop.txt'
MD5 ("http://www.spamhaus.org/drop/drop.txt") = d2278c81b67d798693429e4feb04a83a
http://www.freebsd.org/cgi/man.cgi?query=md5&sektion=1
-
The Country Database in pfBlocker hasn't been updated for over 2 years now. The data is obsolete.
I've been recently looking at this and found we have 2 issues.
One is the out of date IP ranges, which you know about.
The other is a few ISO country codes probably need to be updated.I know they are working on a new service (most likely for paid members) that will provide updates for the Country Lists.
I guess it's been a couple of years since CountryIPBlocks went to pay-for-play.
Back then, marcelloc and I both reached out to the CIPB guy and tried to work out a compromise that would allow pfBlocker to keep updating from CIPB.
CIPB's compromise was that each pfBlocker user would pay CIPB for it's repackaged public data.
That didn't seem like much of a compromise so here we are.Anyhoo:
I've found a source of current country IP data yesterday and wrote a short Bash script to push it into pfBlocker.
It looks good but while cross-checking the data I found pfBlocker has a couple of outdated country (ISO 3166-1 alpha-2) codes.Also - I still want to find+vet a couple more data sources.
I'll post what I come up with and we'll see what everyone thinks.Thanks
-
I've found a source of current country IP data yesterday and wrote a short Bash script to push it into pfBlocker.
It looks good but while cross-checking the data I found pfBlocker has a couple of outdated country (ISO 3166-1 alpha-2) codes.Also - I still want to find+vet a couple more data sources.
I'll post what I come up with and we'll see what everyone thinks.Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.
I have also release a script to utilize country Blocking:
https://forum.pfsense.org/index.php?topic=78062.15Would be interested to see what you have come up with.
Maybe you can PM me a copy? Would also be interested in helping getting it off the ground.
-
Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.
That was the site that had a .CSV file of IPs in ranges, right?
I think I saw somewhere in the thread that pfBlocker will work with ranges - something I didn't know.However, I prefer working w/ CIDR (I'd explain why if anyone cares) and am looking at CIDR sources right now.
I'll give another look at Maxmind GeoIP if my 'Plan A' doesn't work out.
-
Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.
That was the site that had a .CSV file of IPs in ranges, right?
I think I saw somewhere in the thread that pfBlocker will work with ranges - something I didn't know.However, I prefer working w/ CIDR (I'd explain why if anyone cares) and am looking at CIDR sources right now.
I'll give another look at Maxmind GeoIP if my 'Plan A' doesn't work out.
Here is a sample.
Its all in one file, and its not too hard to convert to CIDR and break it down in the XX Country Codes with some grep and awk commands.
"223.255.128.0","223.255.191.255","3758063616","3758079999","HK","Hong Kong"
"223.255.192.0","223.255.223.255","3758080000","3758088191","KR","Korea, Republic of"
"223.255.224.0","223.255.231.255","3758088192","3758090239","ID","Indonesia"
"223.255.232.0","223.255.235.255","3758090240","3758091263","AU","Australia"
"223.255.236.0","223.255.239.255","3758091264","3758092287","CN","China"
"223.255.240.0","223.255.243.255","3758092288","3758093311","HK","Hong Kong"
"223.255.244.0","223.255.247.255","3758093312","3758094335","IN","India"
"223.255.252.0","223.255.253.255","3758095360","3758095871","CN","China"
"223.255.254.0","223.255.254.255","3758095872","3758096127","SG","Singapore"
"223.255.255.0","223.255.255.255","3758096128","3758096383","AU","Australia" -
That was the site that had a .CSV file of IPs in ranges, right?
Here is a sample.
Its all in one file, and its not too hard to convert to CIDR and break it down in the XX Country Codes with some grep and awk commands.
"223.255.128.0","223.255.191.255","3758063616","3758079999","HK","Hong Kong"
"223.255.192.0","223.255.223.255","3758080000","3758088191","KR","Korea, Republic of"
"223.255.224.0","223.255.231.255","3758088192","3758090239","ID","Indonesia"
"223.255.232.0","223.255.235.255","3758090240","3758091263","AU","Australia"
"223.255.236.0","223.255.239.255","3758091264","3758092287","CN","China"Your data source seems more trustworthy than what I've found.
I'll PM you the script to d/l+extract the country IPs into .txt files as soon as I puzzle it out.
-
Hi, does anybody know what triggers the reset of the pfBlocker's dashboard packet count? It would be much more useful if it only cleared when I clear the counter. Right now it just seems to clear the packet count randomly.
Thanks,
Kevin -
anything that reloads your rules/filter will do it. look for check_reload_status: Syncing firewall in your system log
-
HI, for those who want to test an updated country list from a new source before I try to update it on package install, follow these steps on console
cd /usr/local/pkg /usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Africa_cidr.txt /usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Asia_cidr.txt /usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Europe_cidr.txt /usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/North_America_cidr.txt /usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Oceania_cidr.txt /usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/South_America_cidr.txt php /usr/local/www/pfblocker.php ucAfter this, access pfblocker gui and save config again.
You can check applied networks/cidrs on diagnostics -> tables
-
HI, for those who want to test an updated country list from a new source before I try to update it on package install, follow these steps on console
Hi Marcello,
This updates correctly. What is the source of the Country code files if you don't mind sharing?
Thanks.
-
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
ipblocklist
HOLD - cidr
dashboard HUD
Remove IPFW Flush
Complete - ensure /usr/local/pkg/pf/ .sh is removed
Complete - whitelists on reboot
Complete - logging doesn't stay enabled when you click save/update
Complete - remove unique -u to just unique
Complete - remove warning from GUI
Complete - add lvl1 by default
Complete - change description to use the phrase peerblock
Complete - remove "ipfw -f flush" commands from php and uninstall process.
Complete - setenv PACKAGESITE "ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8-stable/Latest/" before pkg_add -r "package"
Complete - pkg_add -r p5-NET-CIDR p5-Net-CIDR-0.14 CURRENT
Complete - pkg_add -r perl perl-5.10.1_1 TO perl-5.12.4_2
Complete - don't uninstall perl and p5-cidr-net at uninstallcountryblock
Complete - ensure /usr/local/pkg/pf/ .sh is removed
Complete - update CIDR.php file
Complete - Remove Email
Remove IPFW Flushstrikeback
auto start
auto settings (root user)ideas:
hybrid ipblockist and countryblock. Tab seperate the roles. one package - one stop shop. Name: Layer3 Shield or Layer3 Filter or Security
iplocklist and countryblock redirection on outbound if going to blocked ip's!!!This note is dated 2010!
-
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
This note is dated 2010!
If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker. :)
-
Can't imagine anyone would be intested in that. ;)
Oh wait…. -
Can't imagine anyone would be intested in that. ;)
Oh wait….rofl
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
This note is dated 2010!
If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker. :)
Please share. :-D I would love to see this package get a facelift and some TLC. Besides Snort this is one of the must have packages imo.
-
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
This note is dated 2010!
/gasp!
-
They say a Picture is worth a 1000 words, so I will post 4 pics.
I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.
Any programming help would also be appreciated to help expedite the process…. ;)
Link to the pfBlocker (General Tab)
http://imgur.com/h0708WPLink to the pfBlocker (Reputation Tab)
http://imgur.com/9AGK95VLink to the pfBlocker (LISTS Tab)
http://imgur.com/4Wgq4skLink to the pfBlokcer (LOG Tab)
http://imgur.com/SNQ85RT -
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Which Blocklist is that large? Can you post the url? or is this an "Alias" that has multiple Lists within?
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Which Blocklist is that large? Can you post the url? or is this an "Alias" that has multiple Lists within?
I have an I-BlockList paid account; it allows me to build a custom list which is a "compilation" of other available lists. I called this list "torrent", as it is composed by BlueTack Level-1, etc.
Their system generates a custom URL. Then I can use this URL to feed, for example, PeerBlock. The Windows program loads this list flawlessly. I expected that pfBlocker would handle the same list with no problems.
-
I have an I-BlockList paid account
Some of the IBlock lists are not formatted the Same. I know the IBlock Adstrack and the IBlock Prime list have some incompatible characters that will cause pfBlocker to fail.
Try to remove one list at a time to determine which one is failing.
