PfBlockerNG
-
great news!!! thank you BBcan177 and everyone else who worked on this great package.
-
pfBlockerNG v1.0 – Official Release
Thanks to wbennett77 for allowing me to commandeer his First post in this thread …
https://forum.pfsense.org/index.php?topic=86212.msg472670#msg472670 -
Noticed pfBlockerng is not showing up in the Dashboard services status Widgets. Not sure how to reload it after modification.
Thanks
-
It's not a running service, no business in there.
-
Noticed pfBlockerng is not showing up in the Dashboard services status Widget.
pfBlockerNG does not have a service as doktornotor indicated. So it will not show in the services menu. But when pfBlockerNG is enabled, you will see at the top left corner of the pfBNG widget, a similar Service Status Icon showing that pfBNG is "Enabled"
-
It seems I can't avoid blocks from showing up in system logs->firewall, even with "Global Enable Logging" unchecked. Is it just me?
-
You have individual settings per each block list.
-
;) you're the man…. thank you.
-
Just did a very smooth reinstall/upgrade to 1.01. Thanks BBcan177 for an amazing package and thanks for all the support.
Cheers!
-
Not seeing any aliases being created after selecting various country blocks. Nor do I see them on the dashboard widget. Its empty.
-
Did you enable pfBlockerNG in the General tab? Did you force an update?
Not seeing any aliases being created after selecting various country blocks. Nor do I see them on the dashboard widget. Its empty.
-
Yup..
EDIT: A reboot fixed it.
Quick question…..
Do u enable the floating rules options on the general tab?
-
After seeing some users installation of pfBNG, I would like to suggest the following:
-
Enable "Keep Settings" in the General Tab. On any re-install you will lose all settings without it.
-
With the new "Alerts" Tab, you don't need to break-out each List into a single Alias. You can create an "Alias" Category, say IBlock and put most of the IBlock lists into one Alias. You can create another Alias for "Mail Servers" etc.. The Alerts tab will tell you which list was responsible for the Blocked event.
-
If you create an "Alias Permit/Deny/Match/Native", name the Alias pfb_ All lowercase. The widget is designed to pick this Prefix in the Rules so that it can be displayed with the other Auto rules that are prefixed pfB_. For any Alias only type list, never use pfB_ as a prefix. The package will remove it at each Cron event.
-
Match can be used if you want to Monitor a group of IPs, this will just log the activity without Blocking. These Match rules will populate in the Floating Tab. You can use a URL or post IPs in the "Custom Box" provided in each Alias.
-
"Alias Native" are lists that do not undergo any De-Duplication/Reputation, this can be used for Lists like the IBlock Anti-Infringement or when you want to Block Facebook for example.
-
With the new "html" format, you can Deny, Permit or Match sites like Twitter, Facebook for example. You can use Hurricane Electric to pull the IPs that are part of these networks. You would also need to create a list for IPv6 if you use that in your network. Again use the "Alias Native" for these types of lists if you want to Block them. For Permit or Match, you can use the Auto-Type Rule Settings.
http://bgp.he.net/search?search%5Bsearch%5D=twitter&commit=Search
http://bgp.he.net/search?search%5Bsearch%5D=facebook&commit=Search
http://bgp.he.net/search?search%5Bsearch%5D=spotify&commit=Search
http://bgp.he.net/search?search%5Bsearch%5D=dropbox&commit=Search- And as always no one reads the tech notes on each setting. So I advise you to read each one to familiarize yourself with each function.
-
-
And what List Action did you select?
-
Did you enable pfBlockerNG in the General tab? Did you force an update
@Asterix:Not seeing any aliases being created after selecting various country blocks. Nor do I see them on the dashboard widget. Its empty.
Follow the pfblockerng.log. It will tell you error events that can help diagnose…
Two points to check
- Each alias needs to have a defined : List Action
- Ensure that you have a "header name" for each List/URL
-
I edited my previous post as a reboot fixed it.
Wanted to check if u enable the floating rules options on the general tab?
-
I edited my previous post as a reboot fixed it.
Wanted to check if u enable the floating rules options on the general tab?
The choice is there to run Rules on each interface or to set them in the "Floating Tab"… The Choice is yours to make... There are threads that give some more advice on that...
So yes, if you want to enable "Floating Rules" select the option in the General Tab.
https://forum.pfsense.org/index.php?topic=78062.0
-
woot, it's official!
-
After seeing some users installation of pfBNG, I would like to suggest the following:
-
Enable "Keep Settings" in the General Tab. On any re-install you will lose all settings without it.
-
With the new "Alerts" Tab, you don't need to break-out each List into a single Alias. You can create an "Alias" Category, say IBlock and put most of the IBlock lists into one Alias. You can create another Alias for "Mail Servers" etc.. The Alerts tab will tell you which list was responsible for the Blocked event.
-
And as always no one reads the tech notes on each setting. So I advise you to read each one to familiarize yourself with each function.
Like This:
-
-
Wanted to check if u enable the floating rules options on the general tab?
Depends on how you want your system setup. I have it enabled using rule order pfSense Pass/Match | pgB_Pass/Match | pfB_Block/Reject..
-
My lists were all showing 0 entries after update… But after the last CRON they are all showing again. Weird as I force updated many times and it didn't populate. Not sure what happened, but ignore this post. :)
-
Can you run the following command followed by a "Force Update"
/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dc
-
I ran that and force updated. After last update have 70K+ entries, same as right before I did it.
I also tried adding/removing a few countries and the count changes. So seems like everything is working great. Not sure what happened right after upgrade, but it is behaving now. AWESOME addition to pfSense.
-
I hate to ask stupid questions on here, but i'm going to anyway. Feel free to point out my inadequacies, as I'm sure the answer is obvious and I'm just being obtuse…
If I need to unblock/pass a specific IP address that is currently being blocked in a country block list - is that possible?
For instance, I had Poland blocked in the Top 20 list. However, GOG.COM's game down loader is via Poland so I need to let it through.
Obviously I can unblock Poland, but would rather just let the GOG IP address through.
-
If I need to unblock/pass a specific IP address that is currently being blocked in a country block list - is that possible?
Follow the instructions in this link to create a "Permit outbound" alias.
https://forum.pfsense.org/index.php?topic=86212.msg484689#msg484689
-
Very nice job on the package but…in the alert tab we need small country flags for the CC colum. Its not a real NG package w/o little flags :)
Cheers.
F.
-
Very nice job on the package but…in the alert tab we need small country flags for the CC colum. Its not a real NG package w/o little flags :)
:) I thought about it.. I was going to borrow the flags from the ntopng package but with so many countries, I think it's impractical for most users to reference all those Flags. While I agree it would look nice, I think Geography is not the intended topic. I may add it and let the user decide which they prefer. However, I am focusing my efforts on the next version which will have Unbound DNSBL integration. :)
Thanks for the overall positive feedback!
-
ROFL!
Very nice job on the package but…in the alert tab we need small country flags for the CC colum. Its not a real NG package w/o little flags :)
-
I think you just need one flag for CN. That's where most of the unwanted junk traffic comes from. :P
(I know about project getting pissed off bug reports about "You ignoramus don't know this state does not exist any more?! We have split from those nasty theyspeakotherdialect criminals whopping two years ago and you dare to not have noticed yet?! What an insult to our huge 500K headcount nation! And/or - this flag is not used any more, it was used by $badguy regime, you are insulting our brand new "democracy". Flags can become a slippery slope very quickly…)
-
Many thanks to all those that made this happen ;D
A recent upgrade to vDISASTER-1.0, has forced me to start over from scratch. Working bit by bit on preparing a system for the blueprint guides doesn't seem like a lot of work when you do it bit by bit. Starting over made me realize what a lot of people have been complaining about: complexity.
Just about when the suricata part of the blueprints was finished (I deliberately delayed the IP lists, since I knew the package was coming), the package was made available. Great, perfect opportunity to test it I thought.
Installed the package, went to configure it…my jaw dropped! BBcan177 told me it was good, but unfortunately due to a LOT of work coming my way, wasn't able to help out test it, but I never thought it would be THIS good!
It basically takes configuring a system according to the blueprints from a process that takes 2 days (you do double check everything, right?) to a few hours. Biggest help is the auto-creation of floating rules using the lists. Bonus thing is, the way the package handles the lists, you don't even have to create the dozen (or so) floating rules suggested. Just one rule containing the alias, which in turn contains the lists. pfBlockerNG then handles the "ok, so what list is this IP on?" part in its alerts tab. Perfect!
So far it makes a perfect addition to the blueprint guides (and the new guide, which will be a LOT simpler, yes I'm typing it up bit by bit, preparing it for other authors to contribute too).
Only downside I find to it, is that sync doesn't want to sync, but that's another story, for another day. First I need to add the dozens of lists back, then figure out why it's not working. I understand that a much needed break is in order for the devs, so for the time being, I'm not going to bother with it ;DProblem solved: There is an input validation that messes up my special passwords (I'm special, didn't you know?). Using alphanumeric ones solves it. Thanks to BBcan177 for keeping me company while troubleshooting this. -
Any problem wizh iblocklist?
After i add list, can t download any list from this site. I have gz and cidr format. Any help?
-
Have you clicked the "Force Cron" button on the Update tab? Is there anything in the Logs / Log Files / Error.log?
-
What a nice surprise to see an update for pfblocker. I didnt expect i to to come for a couple of weeks. Totally awsome.
Everything works great. I see some really clever things in the new NG package. Lots of shiny new options.One minor thing. The header field was a little strange. Im used to a header meaning something to ignore as actual input. So my immediate intuition was to input something like a # because my lists did not load right and the force update said:
** TERMINATED - Header contains Blank/International/Special or SpacesBut I found in the forum that its a header like a description. So maybe a little description for header would be helpfull.
Congratulations BBcan177 for your achievement
-
I am having a problem getting the lists from i-blocklist.com to work on this. What format should I select on the i-blocklist website and what format on the new pfblockerng? Anyone gotten this to work?Nevermind. Everything I need to know is there. I just looked over it. Sorry about that all.
-
In v1.01 I have found a bug that doesn't allow cron to Update the Lists as per the Frequency setting in the Alias. While adding the "Anonymous Proxy and Satellite Providers" to the code, I added a new function that is in my Dev version of pfBNG but I unfortunately missed to add a variable. You can see in the Widget, the last Updated Timestamp of the Aliases.
I have posted a Pull Request to fix this issue. It also includes some other improvments.
So until its merged, you can follow any ONE of these steps to fix this issue:
Apply this patch using system patches OR Manually edit this File and add the part in blue.
/usr/local/www/pfblockerng/pfblockerng.php on Line 150 and add the missing variable.
function pfb_update_check($header_url, $list_url, $url_format) {
to
function pfb_update_check($header_url, $list_url, $url_format, $pfbfolder) {--- /usr/local/www/pfblockerng/pfblockerng.php +++ /usr/local/www/pfblockerng/pfblockerng.php @@ -147,7 +147,7 @@ if ($uname['machine'] == "amd64") ini_set('memory_limit', '256M'); -function pfb_update_check($header_url, $list_url, $url_format) { +function pfb_update_check($header_url, $list_url, $url_format, $pfbfolder) { global $pfb; $pfb['cron_update'] = FALSE;
After applying this patch or manually editing the file, running "Force Cron" will update the files but only if the Alias Frequency Setting is within the current Hour or wait for the next Cron event to update the files as required.
Sorry about the trouble!
-
One minor thing. The header field was a little strange. Im used to a header meaning something to ignore as actual input. So my immediate intuition was to input something like a # because my lists did not load right and the force update said:
** TERMINATED - Header contains Blank/International/Special or SpacesBut I found in the forum that its a header like a description. So maybe a little description for header would be helpfull.
I was going to name it "filename" but I think it can also be misleading (users might think to enter the URL filename there)
There is a description of what a Header should be just above the URL settings in each alias. Suggestions are always welcome! :)
-
Seems like the Force Cron button deletes the cron job:
0 * * * * root /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php cron >> /var/log/pfblockerng/pfblockerng.log 2>&1
Happens with and without that change to line 150 of pfblockerng.php. Can anyone else confirm this or have I managed to totally mess up my installation? :)
-
Seems like the Force Cron button deletes the cron job:
When you select any of the "Force" Icons, the first step is to remove any Cron tasks that are defined. This prevents a collision with a Cron task that could be called while the Manual task is still in process.
Once the "Force" (Update, Cron or Reload) are completed, it will add the Cron task back to the Cron Manager.
-
Seems like the Force Cron button deletes the cron job:
When you select any of the "Force" Icons, the first step is to remove any Cron tasks that are defined. This prevents a collision with a Cron task that could be called while the Manual task is still in process.
Once the "Force" (Update, Cron or Reload) are completed, it will add the Cron task back to the Cron Manager.
Ok, so the problem then is that the page never stops loading even than the log part shows the job finished.
-
Ok, so the problem then is that the page never stops loading even than the log part shows the job finished.
ok. That is a small bug… The Window is still spinning as its waiting for a string
"UPDATE PROCESS ENDED"
but in Force Cron, it never sees that String... I will add a fix for that. But the task did complete when it outputs "CRON PROCESS ENDED". You can move away from the Tab or click "End View"
EDIT: Yup.. It won't add the Cron Task back as it didn't complete the function.
Click "Save" in the "General Tab" and it will be added.