PfBlocker
-
Can't imagine anyone would be intested in that. ;)
Oh wait….rofl
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
This note is dated 2010!
If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker. :)
Please share. :-D I would love to see this package get a facelift and some TLC. Besides Snort this is one of the must have packages imo.
-
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
This note is dated 2010!
/gasp!
-
They say a Picture is worth a 1000 words, so I will post 4 pics.
I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.
Any programming help would also be appreciated to help expedite the process…. ;)
Link to the pfBlocker (General Tab)
http://imgur.com/h0708WPLink to the pfBlocker (Reputation Tab)
http://imgur.com/9AGK95VLink to the pfBlocker (LISTS Tab)
http://imgur.com/4Wgq4skLink to the pfBlokcer (LOG Tab)
http://imgur.com/SNQ85RT -
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Which Blocklist is that large? Can you post the url? or is this an "Alias" that has multiple Lists within?
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Which Blocklist is that large? Can you post the url? or is this an "Alias" that has multiple Lists within?
I have an I-BlockList paid account; it allows me to build a custom list which is a "compilation" of other available lists. I called this list "torrent", as it is composed by BlueTack Level-1, etc.
Their system generates a custom URL. Then I can use this URL to feed, for example, PeerBlock. The Windows program loads this list flawlessly. I expected that pfBlocker would handle the same list with no problems.
-
I have an I-BlockList paid account
Some of the IBlock lists are not formatted the Same. I know the IBlock Adstrack and the IBlock Prime list have some incompatible characters that will cause pfBlocker to fail.
Try to remove one list at a time to determine which one is failing.
-
I have an I-BlockList paid account
Some of the IBlock lists are not formatted the Same. I know the IBlock Adstrack and the IBlock Prime list have some incompatible characters that will cause pfBlocker to fail.
Try to remove one list at a time to determine which one is failing.
If I load the same lists - one for each row in the pfBlocker pfSense GUI - the package doesn't give the error and works properly. But this is a very tedious and error prone method.
-
If I load the same lists - one for each row in the pfBlocker pfSense GUI - the package doesn't give the error and works properly. But this is a very tedious and error prone method.
Then the issue is with the total size of the Single List. Can you break it down into 2-3 smaller Main Lists?
-
If I load the same lists - one for each row in the pfBlocker pfSense GUI - the package doesn't give the error and works properly. But this is a very tedious and error prone method.
Then the issue is with the total size of the Single List. Can you break it down into 2-3 smaller Main Lists?
The great advantage of one "big" list is that I can change its "composition" without worrying to change the "recipe" in every program that uses that list (pfBlocker, PeerBlock, qBittorrent, etc.). I think that a "professional" tool like pfSense (and it's packages, like pfBlocker) should be able to deal with a list that even the last simple Windows program can handle…
-
If your into torrents as heavy as you sound… These lists will not save you from the dreaded mail from your ISP or University. What they will help you with, and you will need it, if your into torrents this heavy; is help keep your computer clean and not become a BOT, which it probably already is... :o You need to look into paying for a VPN service or something like that. There are several sites that deal with this, of course you will have to pay a little bit. Life is not free.
Good news is I can block most, if not all, torrent traffic coming out from, or into my home network using pfBlocker and Suricata... 8), I don't get those letters... LOL...
If I load the same lists - one for each row in the pfBlocker pfSense GUI - the package doesn't give the error and works properly. But this is a very tedious and error prone method.
Then the issue is with the total size of the Single List. Can you break it down into 2-3 smaller Main Lists?
The great advantage of one "big" list is that I can change its "composition" without worrying to change the "recipe" in every program that uses that list (pfBlocker, PeerBlock, qBittorrent, etc.). I think that a "professional" tool like pfSense (and it's packages, like pfBlocker) should be able to deal with a list that even the last simple Windows program can handle…
-
If your into torrents as heavy as you sound… These lists will not save you from the dreaded mail from your ISP or University. What they will help you with, and you will need it, if your into torrents this heavy; is help keep your computer clean and not become a BOT, which it probably already is... :o You need to look into paying for a VPN service or something like that. There are several sites that deal with this, of course you will have to pay a little bit. Life is not free
I forgot to mention that I'm using AirVPN and the event(s) that I want to filter out are generated by the AirVPN server (aka the Exit Node) :)
-
Try System->Advanced-> <firewall nat="">and increase entry [Firewall Maximum Table Entries] to something like 3,000,000.
If your into torrents as heavy as you sound… These lists will not save you from the dreaded mail from your ISP or University. What they will help you with, and you will need it, if your into torrents this heavy; is help keep your computer clean and not become a BOT, which it probably already is... :o You need to look into paying for a VPN service or something like that. There are several sites that deal with this, of course you will have to pay a little bit. Life is not free
I forgot to mention that I'm using AirVPN and the event(s) that I want to filter out are generated by the AirVPN server (aka the Exit Node) :)</firewall>
-
Try System->Advanced-> <firewall nat="">and increase entry [Firewall Maximum Table Entries] to something like 3,000,000.</firewall>
It's already at 12,000,000 :)
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Are you pasting it on pfbloker gui or linking it to a url?
-
They say a Picture is worth a 1000 words, so I will post 4 pics.
I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.
Looks great.
I've created a php to update lists based on .sh that LinuxTracker sent to me in pm.
I'm not sure if it will be usefull on package as a lot of requests to ip source site may get it from free to paid like first source used on pfblocker. -
They say a Picture is worth a 1000 words, so I will post 4 pics.
I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.
Looks great.
I've created a php to update lists based on .sh that LinuxTracker sent to me in pm.
I'm not sure if it will be usefull on package as a lot of requests to ip source site may get it from free to paid like first source used on pfblocker.I think the Maxmind GeoIP database is more Stable. I also don't expect them to close the Country Code Lists. They have a paid subscription for Cities and Streets, but the Country Listings have been free for a long time now.
The Data is provided in a Range format.
Would like me to send you a copy of my pfBlocker Beta for review?
-
Would like me to send you a copy of my pfBlocker Beta for review?
Sure. I'll send you the update code for lists I've used to update.
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Are you pasting it on pfbloker gui or linking it to a url?
I've setup an I-BlockList account. They have an option to create a custom blocklist: you choose which lists you'd like to merge and they provide you an URL to download a .gz package, containing a .txt file with all the lists you choose, merged.
In pfBlocker I'm pasting this URL into the GUI interface and then I select the "create alias".
Before creating this "big list" you have the option to select the format: p2p, dat, CIDR and the compression: gz or zip.
-
I think the Maxmind GeoIP database is more Stable. I also don't expect them to close the Country Code Lists. They have a paid subscription for Cities and Streets, but the Country Listings have been free for a long time now.
The Data is provided in a Range format.I'm with BBcan177. The Maxmind GeoIP lists are a much better long-term solution than the list I was using.
I wrote a script to d/l -> unzip -> extract the Maxmind IP ranges into their respective country files (ie: /usr/local/pkg/pfblocker/US.txt) but couldn't figure out how to convert range to CIDR.
(I tried these scripts https://forum.pfsense.org/index.php?topic=73244.msg400025#msg400025 but couldn't get them working.)However, if someone is already hosting the Maxmind data in CIDR format - that'd be a lot simpler update method, than the script I wrote.
Edit: My script, if anyone is interested (missing range to CIDR conversion)
https://gist.github.com/LinuxTracker/8332e0d620ab5f6df1dc
