Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 210 Posters 1.8m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • dennypageD
      dennypage
      last edited by

      The filename should be "/usr/local/www/pfblockerng/pfblockerng.php"

      @BBcan177:

      /usr/local/www/pfblockerng.php  on  Line 150  and add the missing variable.

      function pfb_update_check($header_url, $list_url, $url_format) {
                    to
            function pfb_update_check($header_url, $list_url, $url_format, $pfbfolder) {

      1 Reply Last reply Reply Quote 0
      • S
        Sn3ak
        last edited by

        Feature Request:

        Allow 1,5,15,30 min interval for Update Frequency. I realize historically this has been forced minimum 1hr to force people to be good net-citizens, but having a faster update frequency would be preferred for internal lists. I admit 1min may be excessive, but the rest are reasonable for internal use lists.

        I like to use different software/scripts to generate block lists on my machines behind the pfSense box, and have pfBlocker poll those lists. 1 hour is too long, as most attackers will give up in that time frame. Think of the SSH script kiddy or email spammer that are pounding on the machine for a short period of time. Since I may have multiple IP's forwarded to similar services (behind pfSense) it is convenient to have the list on pfSense so it's protecting all hosts, instead of the one getting pounded before the person moves on to the second or third.

        This is actually all I use pfBlocker for, along with a few friends.

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          There is a new Pull Request #808 to fix the issues reported by Fragged and jflsakfja.

          pfBNG - v1.03

          1. When Using "Force Cron" and "no updates" were found, the final process would not complete. This resulted in the active Cron task not being restored.
          2. XMLRPC Sync - Added MaxMind "Anonymous Proxy and Satellite providers"

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @Sn3ak:

            Feature Request:

            Allow 1,5,15,30 min interval for Update Frequency.

            Yes this is functionality that I want to add. I don't expect to get to it soon thou. Lots of things to do, so little time… However, I would expect to use 15,30,45 mins time frames...

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • J
              jonna99
              last edited by

              Hi!
              Thanks for the new PfblockerNG.
              Should be exellent from what I understand. However I cannot use it since the countrylists IPv4 are empty. What am I missing? :-)

              I tried to delete the package and made a reinstall but the result is the same.

              Version 1.02

              Thanks
              Jonna

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @jonna99:

                However I cannot use it since the countrylists IPv4 are empty. What am I missing? :-)

                Can you provide some more details? Screenshots etc…

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • J
                  jonna99
                  last edited by

                  Ok thank you.
                  Using clean install of pfSense-memstick-2.2-RELEASE and Pfblocker 1.02. Have been using the old Pfblocker without problems before.
                  I find nothing wrong in logs although I´m not sure where  to find everything.
                  The countrylists top-20 spammers (jpeg5) are filled but not the other ones under tab Europe eg.

                  Jonna

                  Capture2.JPG
                  Capture1.JPG
                  Capture3.JPG
                  Capture4.JPG
                  Capture5.JPG
                  Capture1.JPG_thumb
                  Capture2.JPG_thumb
                  Capture3.JPG_thumb
                  Capture4.JPG_thumb
                  Capture5.JPG_thumb

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @jonna99:

                    The countrylists top-20 spammers (jpeg5) are filled but not the other ones under tab Europe eg.

                    Thanks jonna99,

                    It seems that the Maxmind Files did not download? Thats why you see in the Continent pages

                    "Warning: Invalid Argument Supplied"

                    I can send you the command to update the MaxMind Database, but I would like to see if I can understand the circumstances that led to this issue for you? There is a log file called "geoip.log" in the Log Browser, can you PM me with those details.

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • L
                      LinuxTracker
                      last edited by

                      (Edit: 2.2-RELEASE (amd64) pfBlockerNG 1.02)

                      I found a minor bug on the Alerts tab where the displayed rule is sometimes incorrect.

                      I've seen this a few times since yesterday (2 diff machines) and it seems to be displaying the rule from the previous entry.

                      If I get several entries in from the same list in-a-row and the 1st one is wrong, the subsequent ones are wrong too.

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        Hi LinuxTracker,

                        There seems to be a big spread of time between those Alerts. Could it be that you added the Asia Continent after Spamhaus was already downloaded?

                        Do you have enable "De-duplication" checked in the General tab?

                        I would suggest to clear the Firewall Log and execute a "Force Reload", this will refresh all of the databases and then see how it goes from there.

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • F
                          fsansfil
                          last edited by

                          Make sure you dont have a rule like this on WAN

                          WEB-CLIENT csv file download request"; flow:to_server,established; content:"GET"; nocase; http_method; content:".csv"; nocase; http_uri;

                          Had one active and it prevented the download of maxmind country list in my first install…

                          F.

                          1 Reply Last reply Reply Quote 0
                          • L
                            LinuxTracker
                            last edited by

                            Sidebar: Doing a spotcheck, I found a popular SSL cert reseller is on a widely used blocklist.

                            As of this writing, the website for StartSSL is on SpamHaus's Don't Route Or Peer blocklist http://www.spamhaus.org/drop/.

                            www.startssl.com = 192.116.242.20 https://www.whatsmydns.net/#A/www.startssl.com

                            192.112.112.0/20 blocked by http://www.spamhaus.org/drop/drop.txt

                            Edit: I should clarify that this isn't an issue with pfBlockerNG.
                            It's just a reminder that reputable lists get conflicting data and there's no replacement for monitoring logs.

                            and yes, I'm aware of Spamhause's heavy handed history.

                            1 Reply Last reply Reply Quote 0
                            • L
                              LinuxTracker
                              last edited by

                              @BBcan177:

                              Hi LinuxTracker,

                              There seems to be a big spread of time between those Alerts. Could it be that you added the Asia Continent after Spamhaus was already downloaded?

                              Do you have enable "De-duplication" checked in the General tab?

                              I would suggest to clear the Firewall Log and execute a "Force Reload", this will refresh all of the databases and then see how it goes from there.

                              I had some better examples where they all seemed to happen in a short time but I didn't screenshot them.

                              I'll follow up on your recommendations and post back if I see it happening again.

                              Thanks!

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                I recommend to everyone to enable "De-Duplication".

                                Scenario -

                                1. Country/Continents are Downloaded first. (No De-dup is needed as MaxMind reports Ranges per Country, so no overlap.)

                                2. As each subsequent Alias/List is downloaded, it will not add any IPs that are already being blocked by an existing Continent List.

                                When changes are made like "De-Dup or Reputation, or the removal of a Continent/Country or any Lists", I recommend that a "Force Reload" is executed. This will refresh the Database to the current settings.

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • A
                                  asterix
                                  last edited by

                                  NA country list is blocking my HE ipv6 tunnel. Tried suppression and changing order. Also tried de-selecting North America from the NA list. I have kept all countries to deny inbound.

                                  Only way it works is by disabling NA country list entirely. Suggestions??

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    jonna99
                                    last edited by

                                    Hi BBcan177

                                    Here is the logfile you asked for.

                                    Thanks
                                    Jonna

                                    geoip.log.txt

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      firewalluser
                                      last edited by

                                      So I've downloaded pfblockerNG but cant find a tab to block the United States or North America which is only in response to the US announcing yesterday they will keep all non-US traffic for 5 years. I value my privacy so I'd rather not have anything to do with US sites after this announcement which will probably make surfing interesting to say the least.

                                      So considering the number of CIDR's for the the US, would it be best to add them to Aliases and block via a firewall rule or use pfblockerng.

                                      Do have to say it looks comprehensive which is good and certainly an improvement over earlier attempts to block IP's en mass.

                                      Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

                                      Asch Conformity, mainly the blind leading the blind.

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        doktornotor Banned
                                        last edited by

                                        @firewalluser:

                                        So I've downloaded pfblockerNG but cant find a tab to block the United States or North America

                                        Eeeeh?!

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          SkyNET
                                          last edited by

                                          As a side note.., and a question..

                                          Upgrading from version 1.01 to version 1.02 removed all my newly added pfBlockerNG rules from version 1.01.
                                          Had to create them all again after the package update. Seeing that update 1.03 is available.. Will this also remove all my current pfBlockerNG rules?
                                          Lots of manual labor..

                                          Anyway the new package is great!

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            doktornotor Banned
                                            last edited by

                                            @SkyNET:

                                            Upgrading from version 1.01 to version 1.02 removed all my newly added pfBlockerNG rules from version 1.01.
                                            Had to create them all again after the package update. Seeing that update 1.03 is available.. Will this also remove all my current pfBlockerNG rules?
                                            Lots of manual labor..

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.