Pfblocker packets (hits) counter has gone up since 2.2 update (multiplier added)

BBcan177

As pfblockerng is away ahead, I'll test it and probably remove pfblocker from 2.2 package list.

The issue with the widget for the pfBlocker code in 2.2, is the pfctl Label format has an extra CSV column:

This is the existing line ( works for 2.1.5 and below ) :

if (preg_match("/USER_RULE: (\w+).*\s+\d+\s+(\d+)\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+/",$line,$matches))

For 2.2, it needs to use the following line:

if (preg_match("/USER_RULE: (\w+).*\s+\d+\s+(\d+)\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+/", $line, $matches))

LinuxTracker

For 2.2, it needs to use the following line:

if (preg_match("/USER_RULE: (\w+).*\s+\d+\s+(\d+)\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+\s+\d+/", $line, $matches))

I edited /usr/local/www/widgets/widgets/pfBlocker.widget.php and replaced the code with BBcan177s and my packet counts seem more reasonable.

Thanks BB!

BBcan177

Is that last bracket supposed to be there? If so, where does it close?

I modified my original post above. I have that in an if/else statement to use the correct line depending on 2.1.5 / 2.2 version of pfSense.

marcelloc

Merge to pfSense may take longer then package commit.

Util it gets merged, isn't better to send a fix to the package?

BBcan177

Here is the Pull Request to provide a temporary fix for the IBlock Range to CIDR issue:

https://github.com/pfsense/pfsense-packages/pull/796

marcelloc

Great. I'll send a pull request to get pfblocker working on 2.2 util ng is released.

JohnPFsense

BBcan177s solution works great.
Turns out editing the php file from pfsense was very easy.

I started my post as just an observation. Never expected a fix in less than 24 hrs. Amazing 8)

John

marcelloc

Never expected a fix in less than 24 hrs. Amazing 8)

Community helping community :)

BBcan177

@JohnPFsense:

Never expected a fix in less than 24 hrs. Amazing 8)

Community helping community :)

Actually less than 3 Hrs! 8)

garthk

Any idea if/when the PFBlocker package will be available or should I switch to the new beta?

Thanx,
Garth

Cino

pfBlocker has been removed, and replaced by pfBlockerNG for 2.2. It's in the package system if you want to install it