PfBlocker
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Are you pasting it on pfbloker gui or linking it to a url?
-
They say a Picture is worth a 1000 words, so I will post 4 pics.
I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.
Looks great.
I've created a php to update lists based on .sh that LinuxTracker sent to me in pm.
I'm not sure if it will be usefull on package as a lot of requests to ip source site may get it from free to paid like first source used on pfblocker. -
They say a Picture is worth a 1000 words, so I will post 4 pics.
I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.
Looks great.
I've created a php to update lists based on .sh that LinuxTracker sent to me in pm.
I'm not sure if it will be usefull on package as a lot of requests to ip source site may get it from free to paid like first source used on pfblocker.I think the Maxmind GeoIP database is more Stable. I also don't expect them to close the Country Code Lists. They have a paid subscription for Cities and Streets, but the Country Listings have been free for a long time now.
The Data is provided in a Range format.
Would like me to send you a copy of my pfBlocker Beta for review?
-
Would like me to send you a copy of my pfBlocker Beta for review?
Sure. I'll send you the update code for lists I've used to update.
-
I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.
Are you pasting it on pfbloker gui or linking it to a url?
I've setup an I-BlockList account. They have an option to create a custom blocklist: you choose which lists you'd like to merge and they provide you an URL to download a .gz package, containing a .txt file with all the lists you choose, merged.
In pfBlocker I'm pasting this URL into the GUI interface and then I select the "create alias".
Before creating this "big list" you have the option to select the format: p2p, dat, CIDR and the compression: gz or zip.
-
I think the Maxmind GeoIP database is more Stable. I also don't expect them to close the Country Code Lists. They have a paid subscription for Cities and Streets, but the Country Listings have been free for a long time now.
The Data is provided in a Range format.I'm with BBcan177. The Maxmind GeoIP lists are a much better long-term solution than the list I was using.
I wrote a script to d/l -> unzip -> extract the Maxmind IP ranges into their respective country files (ie: /usr/local/pkg/pfblocker/US.txt) but couldn't figure out how to convert range to CIDR.
(I tried these scripts https://forum.pfsense.org/index.php?topic=73244.msg400025#msg400025 but couldn't get them working.)However, if someone is already hosting the Maxmind data in CIDR format - that'd be a lot simpler update method, than the script I wrote.
Edit: My script, if anyone is interested (missing range to CIDR conversion)
https://gist.github.com/LinuxTracker/8332e0d620ab5f6df1dc -
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
This note is dated 2010!
If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker. :)
I want! :)
-
Is it possible we can host our own lists centrally so we dont rely on any outsiders?
-
Is it possible we can host our own lists centrally so we dont rely on any outsiders?
You can use localfiles with pfBlocker currently. Instead of a URL link just enter the path to the local file.
-
Is it possible we can host our own lists centrally so we dont rely on any outsiders?
You can use localfiles with pfBlocker currently. Instead of a URL link just enter the path to the local file.
What do you mean by "local" file? Do I have to upload the file to pfSense?
This is the error I'm getting when pasting a link to an I-BlockList which is of 10,565,669 bytes; it contains a .txt file of 710,772 lines
Fatal error: Allowed memory size of 262144000 bytes exhausted (tried to allocate 4980644 bytes) in /usr/local/pkg/pfblocker.inc on line 268 -
I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.
This note is dated 2010!
If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker. :)
Will this Beta be released as a new package or as an update to the existing pfBlocker?
-
Fatal error: Allowed memory size of 262144000 bytes exhausted (tried to allocate 4980644 bytes) in /usr/local/pkg/pfblocker.inc on line 268System: Advanced: Firewall and NAT:Firewall Maximum Table Entries -> Set this to at least 400000.
I have several huge lists and mine is 900000. -
Fatal error: Allowed memory size of 262144000 bytes exhausted (tried to allocate 4980644 bytes) in /usr/local/pkg/pfblocker.inc on line 268System: Advanced: Firewall and NAT:Firewall Maximum Table Entries -> Set this to at least 400000.
I have several huge lists and mine is 900000.They are all at 12000000 :(
-
Fatal error: Allowed memory size of 262144000 bytes exhausted (tried to allocate 4980644 bytes) in /usr/local/pkg/pfblocker.inc on line 268System: Advanced: Firewall and NAT:Firewall Maximum Table Entries -> Set this to at least 400000.
I have several huge lists and mine is 900000.They are all at 12000000 :(
Yea, I saw that and was just coming back to edit my post.
The other time I got that I had a list with bad data. I had to delete all my custom lists in /usr/local/pkg, then re-introduce them one at a time.
-
Fatal error: Allowed memory size of 262144000 bytes exhausted (tried to allocate 4980644 bytes) in /usr/local/pkg/pfblocker.inc on line 268System: Advanced: Firewall and NAT:Firewall Maximum Table Entries -> Set this to at least 400000.
I have several huge lists and mine is 900000.They are all at 12000000 :(
Yea, I saw that and was just coming back to edit my post.
The other time I got that I had a list with bad data. I had to delete all my custom lists in /usr/local/pkg, then re-introduce them one at a time.
Which files have I to delete? I'd like to be sure not to make a mess…
-
Is it possible we can host our own lists centrally so we dont rely on any outsiders?
You can use localfiles with pfBlocker currently. Instead of a URL link just enter the path to the local file.
I use a mix of local files, Dropbox, hosting on a local IIS server but as often as not I'll push to pfSense using the pscp utility.
-
The other time I got that I had a list with bad data. I had to delete all my custom lists in /usr/local/pkg, then re-introduce them one at a time.
Which files have I to delete? I'd like to be sure not to make a mess…
Correction: /usr/local/pkg/pfblocker directory.
The custom files have names like a8a234f32e30a362cbebb7c0606b5f01.txtAnything else you delete in there can be put back by reinstalling the pfblocker package.
-
What do you mean by "local" file? Do I have to upload the file to pfSense?
This is the error I'm getting when pasting a link to an I-BlockList which is of 10,565,669 bytes; it contains a .txt file of 710,772 lines
Fatal error: Allowed memory size of 262144000 bytes exhausted (tried to allocate 4980644 bytes) in /usr/local/pkg/pfblocker.inc on line 268Hi Panz,
The file can be local to pfsense, or a link to a local file server that pfSense has access to.
The memory is due to PHP failing on such a large list. I still don't recommend one large list as its hard to see why an IP is being Blocked. You should break down the One List into Main Categories and apply smaller Lists.
Line 268 is where the pfBlocker code is trying to convert IP Ranges to CIDRs and is crashing due to running out of memory.
262 # Network range 192.168.0.0-192.168.0.254 263 if (preg_match("/(\d+\.\d+\.\d+\.\d+)-(\d+\.\d+\.\d+\.\d+)/",$line,$matches)){ 264 $a_cidr = ip_range_to_subnet_array($matches[1],$matches[2]); 265 if (is_array($a_cidr)) { 266 foreach ($a_cidr as $cidr) { 267 ${$alias}.= $cidr."\n"; 268 $new_file.= $cidr."\n"; 269 } 270 } 271 } -
Which files have I to delete? I'd like to be sure not to make a mess…
Take a look at this link where I described a method to find out which file belongs to which URL list.
https://forum.pfsense.org/index.php?topic=42543.msg436698#msg436698
-
Which files have I to delete? I'd like to be sure not to make a mess…
Take a look at this link where I described a method to find out which file belongs to which URL list.
https://forum.pfsense.org/index.php?topic=42543.msg436698#msg436698
This doesn't work, because I can't get an "md5 -s" of a list that changes every day (or more often) and compare it to an older version. Am I missing something?
