PfBlockerNG
-
I will be submitting a Pull Request for the following :
-
MaxMind files will be saved to the PBI folder which will make them persist after reboot. (for Nano / Ramdisk installs)
-
MaxMind archive files in /var/db will be purged after installation to free up some space.
-
Add MaxMind "Anonymous Proxy and Satellite Providers".
https://github.com/pfsense/pfsense-packages/pull/801
-
-
Why do I occasionally see items on the "Permit" part of the Alerts tab when I have 0 permit rules?
Permit - Last 5 Alert Entries. Date IF Rule Proto Source Destination CC List Feb 2 14:32:59 WAN pfB_iBlockHijacked (98) UDP 119.186.197.255: 16001 192.168.YY.X: 64284 CN No MatchWhen I search my firewall log for the source, nothing pops up. I have logging enabled for all my pass/block/deny rules.
-
When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time. When disabled, the sync happens instantaneous. Using the old pfBlocker package, it works normally as well. I have eight IPv4 lists configured for deny inbound. I have the top 20 configured to be an alias which has a rule to block inbound on port 25. Then I have several countries configured for deny inbound. Inbound is set for my WAN. There is no blocking of outbound.
Is anyone else experiencing this?
-
When I search my firewall log for the source, nothing pops up.
This is not logged to general firewall logs unless configured so (Global Enable Logging).
When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time.
Is anyone else experiencing this?No. Stop blocking your NTP servers.
-
When I search my firewall log for the source, nothing pops up.
This is not logged to general firewall logs unless configured so (Global Enable Logging).
Is also enabled.
-
When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time
MaxMind Country Database is accurate now! :) The old package had two years old Country Data.
I assume that the NTP server is in one of those Countries that you selected.Look at the "Alerts" Tab, and find the IP that is being blocked. Then create a new "Permit Outbound" alias. You can add the IP to the Custom Text Box at the bottom of this new Alias. This is the recommended method to overcome blocking when "Country Blocking" is occuring.
For all other False Positives, use the Suppression method instead.
-
Why do I occasionally see items on the "Permit" part of the Alerts tab when I have 0 permit rules?
When I search my firewall log for the source, nothing pops up. I have logging enabled for all my pass/block/deny rules.I haven't seen this before. But let me know if its repeating…
-
Look at the "Alerts" Tab, and find the IP that is being blocked. Then create a new "Permit Outbound" alias. You can add the IP to the Custom Text Box at the bottom of this new Alias. This is the recommended method to overcome blocking when "Country Blocking" is occuring.
If you are using any of those *.pool.ntp.org things or whatever similar for NTP, you really need some alias with FQDNs for those, otherwise you'll be hunting IPs for quite some time.
-
A couple of notes about my upgrade 1.0 -> 1.01 upgrade. (Xeon amd64 4GB RAM)
My /var/db/aliastables/ were all wiped out.
I followed the steps given by BBcan177 to set it right again -> https://forum.pfsense.org/index.php?topic=86212.msg484133#msg484133also - A curiosity
The Maxmind AnonProxy A1 list in pfBlockerNG seems more accurate than the one on Maxmind's website.Example: This IP 63.141.198.54 is A1 (and is in pfBlockerNG).
re: http://www.ip-tracker.org/locator/ip-lookup.php?ip=63.141.198.54
re: https://www.iptomaps.com/country_block/12245but it isn't on Maxmind's web-list of A1 IPs
https://www.maxmind.com/en/anonymous_proxiesJust an oddity and a welcome one at that.
-
The pull request is merged. Package is available on list.
-
-
A curiosity
The Maxmind AnonProxy A1 list in pfBlockerNG seems more accurate than the one on Maxmind's website.Example: This IP 63.141.198.54 is A1 (and is in pfBlockerNG)
but it isn't on Maxmind's web-list of A1 IPs
https://www.maxmind.com/en/anonymous_proxiesI think as this is a "Free" service, that they don't update the Web Site so frequently. The Database is updated the First Tuesday of each month, but I have noticed that it can change before that time.
I checked the Maxmind Database file and it is listed there.
GeoIPCountryWhois.csv:"63.141.198.0","63.141.199.255","1066255872","1066256383","A1","Anonymous Proxy"
-
The pull request is merged. Package is available on list.
Yes this pic is worth repeating as I am buying the next Round! Just don't expect me to be in any position to fix any bugs tomorrow! ;D
I have hammered at this package with my troop of loyal Beta Testers (just over 25 of them)… A really big Thanks to those Guys for really helping put the package thru real world testing. Any bugs you guys do find, let me know and I"m sure we can get them resolved. You Beta Testers are the Salt of the Earth kinda guys... Just what Open Source is all about. Hope you guys like the package. Its been fun!
-
great news!!! thank you BBcan177 and everyone else who worked on this great package.
-
pfBlockerNG v1.0 – Official Release
Thanks to wbennett77 for allowing me to commandeer his First post in this thread …
https://forum.pfsense.org/index.php?topic=86212.msg472670#msg472670 -
Noticed pfBlockerng is not showing up in the Dashboard services status Widgets. Not sure how to reload it after modification.
Thanks
-
It's not a running service, no business in there.
-
Noticed pfBlockerng is not showing up in the Dashboard services status Widget.
pfBlockerNG does not have a service as doktornotor indicated. So it will not show in the services menu. But when pfBlockerNG is enabled, you will see at the top left corner of the pfBNG widget, a similar Service Status Icon showing that pfBNG is "Enabled"
-
It seems I can't avoid blocks from showing up in system logs->firewall, even with "Global Enable Logging" unchecked. Is it just me?
-
You have individual settings per each block list.
