PfBlockerNG

doktornotor · Feb 1, 2015, 8:41 AM

pfBlockerNG needs the Maxmind database country codes otherwise most of the functions will not work.

Hmmm, yeah… and the point being? It's already there.

digdug3 · Feb 1, 2015, 9:16 AM

The point being if we added a "disable country codes" mode then you would free up the memory.
This can be a solution for low-memory devices, but then you would miss out all the benefits like reputation, country blocking etc.

Supermule · Feb 1, 2015, 9:20 AM

And what would be the point of doing that in a countryblock package?

doktornotor · Feb 1, 2015, 9:34 AM

@digdug3:

The point being if we added a "disable country codes" mode then you would free up the memory.

Cannot see anyone suggesting something similar anywhere. All that's being discussed here is moving the files to a better place.

digdug3 · Feb 1, 2015, 10:29 AM

@doktornotor:

The /var/db thing is rather unfortunate, not just b/c it's volatile but also since the directory is pretty huge. Takes over 1/3 of the default /var ramdisk.

Thats why I suggested the option to disable country blocking as a whole, only as an option…

@Supermule:

And what would be the point of doing that in a countryblock package?

pfBlockerNG is much more than just a countryblock package.
I think most of the users use pfBlockerNG as an ip-blocklist and use the countrycodes only for reputation.

Supermule · Feb 1, 2015, 10:30 AM

Well. I can tell you differently…

I use them for blocking as well since I dont want anything to do with the countries I block....and my customers dont have any business there as well.

So I dont get the traffic on my servers and I can sleep fairly safe at night :D

doktornotor · Feb 1, 2015, 11:15 AM

Meanwhile, you can use Shellcmd package and run this as shellcmd on nanobsd boxes:


/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dc

to get the blocklists back on reboot.

BBcan177 · Feb 1, 2015, 1:47 PM

I will be submitting a Pull Request for the following :

MaxMind files will be saved to the PBI folder which will make them persist after reboot. (for Nano / Ramdisk installs)
MaxMind archive files in /var/db will be purged after installation to free up some memory.
Add MaxMind "Anonymous Proxy and Satellite Providers".

I think Digdug is suggesting to have the option of not installing the MaxMind database to free up some more space. I have an option in the General tab to skip downloading future MaxMind updates, but it doesn't delete the existing installed Files. I could create a function to clear them out but I also need to re-install the files if the user Un-checks this option.

Also note that "Reputation" and the Alerts tab require the use of the GeoIP.dat and GeoIPv6.dat to function.

JasonJoel · Feb 1, 2015, 2:12 PM

@wcrowder:

See:
https://forum.pfsense.org/index.php?topic=86212.msg481358#msg481358

Make sure you read this entire thread.

In that thread it mentions 'look at the screenshot' a number of times, but I don't see a screenshot in the thread anywhere. I make the patch, it says it can be applied, but not reverted, so was going to double check settings to make sure I didn't do something stupid ion the patch definition…

doktornotor · Feb 1, 2015, 2:14 PM

1/ The screenshot shows just fine, fix your browser.
2/ You obviously cannot revert patches that have not been applied.

JasonJoel · Feb 1, 2015, 2:40 PM

Thanks. You are right, the screenshot was there. For some reason it took a LONG time to load though (I was on that page for >3 minutes before the screenshot actually appeared…).

And, yeah, I should have realized it couldn't revert.

I have it all installed, configured, and working now. Thanks all for the guidance.

Thanks!

reggie14 · Feb 1, 2015, 7:49 PM

@marcelloc:

The pull request needs to be merged by pfsense team before you can use it without any hacks.

Mostly out of curiosity, what does this mean for where this package is in the release process? That is, does the pfsense team do some testing before they merge it? Or do they just do some sort of minimal sanity check through the code?

wcrowder · Feb 1, 2015, 8:21 PM

If I understand correctly, they do an in-depth review of the code. This being a "New" package with a large code base it can take a while. I believe it is in that process now. It is in the pfSense package repository but is waiting for this process to be completed. The "patch", I hate the word "Hack", just allows you to bypass the "compatibility check" to download the package from the pfSense repository before it has gone through this process. It is "Use at your own risk" at the moment. The review process is a good thing. We just have to be patient.

@reggie14:

@marcelloc:

The pull request needs to be merged by pfsense team before you can use it without any hacks.

Mostly out of curiosity, what does this mean for where this package is in the release process? That is, does the pfsense team do some testing before they merge it? Or do they just do some sort of minimal sanity check through the code?

BBcan177 · Feb 1, 2015, 11:01 PM

@BBcan177:

I will be submitting a Pull Request for the following :

MaxMind files will be saved to the PBI folder which will make them persist after reboot. (for Nano / Ramdisk installs)

MaxMind archive files in /var/db will be purged after installation to free up some space.

Add MaxMind "Anonymous Proxy and Satellite Providers".

https://github.com/pfsense/pfsense-packages/pull/801

fragged · Feb 2, 2015, 12:49 PM

Why do I occasionally see items on the "Permit" part of the Alerts tab when I have 0 permit rules?


Permit   -   Last 5 Alert Entries.							
Date		IF	Rule			Proto		Source			Destination		CC	List
Feb 2 14:32:59	WAN	pfB_iBlockHijacked (98)	UDP	  	119.186.197.255: 16001	192.168.YY.X: 64284	CN	No Match

When I search my firewall log for the source, nothing pops up. I have logging enabled for all my pass/block/deny rules.

swinn · Feb 2, 2015, 12:57 PM

When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time. When disabled, the sync happens instantaneous. Using the old pfBlocker package, it works normally as well. I have eight IPv4 lists configured for deny inbound. I have the top 20 configured to be an alias which has a rule to block inbound on port 25. Then I have several countries configured for deny inbound. Inbound is set for my WAN. There is no blocking of outbound.

Is anyone else experiencing this?

doktornotor · Feb 2, 2015, 1:02 PM

@fragged:

When I search my firewall log for the source, nothing pops up.

This is not logged to general firewall logs unless configured so (Global Enable Logging).

@swinn:

When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time.
Is anyone else experiencing this?

No. Stop blocking your NTP servers.

fragged · Feb 2, 2015, 1:07 PM

@doktornotor:

@fragged:

When I search my firewall log for the source, nothing pops up.

This is not logged to general firewall logs unless configured so (Global Enable Logging).

Is also enabled.

BBcan177 · Feb 2, 2015, 1:45 PM

@swinn:

When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time

MaxMind Country Database is accurate now! :) The old package had two years old Country Data.
I assume that the NTP server is in one of those Countries that you selected.

Look at the "Alerts" Tab, and find the IP that is being blocked. Then create a new "Permit Outbound" alias. You can add the IP to the Custom Text Box at the bottom of this new Alias. This is the recommended method to overcome blocking when "Country Blocking" is occuring.

For all other False Positives, use the Suppression method instead.

BBcan177 · Feb 2, 2015, 1:39 PM

@fragged:

Why do I occasionally see items on the "Permit" part of the Alerts tab when I have 0 permit rules?
When I search my firewall log for the source, nothing pops up. I have logging enabled for all my pass/block/deny rules.

I haven't seen this before. But let me know if its repeating…