Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 210 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      darrenkdean
      last edited by

      @BBcan177:

      @darrenkdean:

      ** TERMINATED - Header contains Blank/International/Special or Spaces

      In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.

      Thank you for the help.  I have updated the Alias with these instructions but still receive the same error.  The Header field is blank for each of the lists.  Does something needed to be added to the Header field to make it work?

      Best-

      1 Reply Last reply Reply Quote 0
      • C
        Cino
        last edited by

        @darrenkdean:

        @BBcan177:

        @darrenkdean:

        ** TERMINATED - Header contains Blank/International/Special or Spaces

        In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.

        Thank you for the help.  I have updated the Alias with these instructions but still receive the same error.  The Header field is blank for each of the lists.  Does something needed to be added to the Header field to make it work?

        Best-

        ** TERMINATED - Header contains Blank/International/Special or Spaces

        Enter a name for the header like: sigma-anti-infringement, sigma-webexploit, sigma-dshield

        
        'Header' : The 'Header' Field must be Unique, it will name the List File and it will be referenced in the pfBlockerNG Widget. Use a Unique Prefix per 'Alias Category' followed by a unique descriptor for each List.
        
        
        1 Reply Last reply Reply Quote 0
        • T
          Topper727
          last edited by

          Ok just to let everyone know that I tried his lists and found that same error. There is something wrong with fetching of list.  I can download gz lists if I use browser to get it.  It looks legit inside

          Example from file
          1.0.128.0/17
          1.0.192.0/18
          1.1.128.0/17
          1.2.128.0/17
          1.9.0.0/16
          1.20.128.0/17
          1.27.1.231/32
          1.27.100.88/32
          1.34.0.0/16
          1.36.71.108/32
          1.36.79.146/32
          1.48.0.0/16
          1.50.0.0/16
          1.54.224.0/20
          1.56.44.42/32
          1.56.122.145/32
          1.56.145.114/32

          I do not get his Header problem he sees but I get

          [ Sigantiinfringement ] Downloading New File

          [ pfB_sigmaprojects Sigantiinfringement ] Download FAIL [ 02/06/15 22:00:47 ]

          [ Sigwebexploit ] Downloading New File

          [ pfB_sigmaprojects Sigwebexploit ] Download FAIL [ 02/06/15 22:00:48 ]

          [ Sigdshield ] Downloading New File

          [ pfB_sigmaprojects Sigdshield ] Download FAIL [ 02/06/15 22:00:49 ]

          I took the link and had Free Download manager try to get it and that worked.  FDM got the file no problem.

          ![screencapture-192-168-1-1-pkg_edit-php (1).png](/public/imported_attachments/1/screencapture-192-168-1-1-pkg_edit-php (1).png)
          ![sigma list.png](/public/imported_attachments/1/sigma list.png)
          ![screencapture-192-168-1-1-pkg_edit-php (1).png_thumb](/public/imported_attachments/1/screencapture-192-168-1-1-pkg_edit-php (1).png_thumb)
          ![sigma list.png_thumb](/public/imported_attachments/1/sigma list.png_thumb)

          Dell 2950 g3 server
          Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
          Current: 2000 MHz, Max: 2667 MHz
          8 CPUs: 2 package(s) x 4 core(s)
          8152 MiB and 600meg 10k drive
          Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            If the lists are gz format and in CIDR format, you need to select "gz_2".

            However, these are not the best lists to use. It's best to use lists from the original provider.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • T
              Topper727
              last edited by

              BBcan you the man.  That fixes them thanks.  GZ_2 format.  Maybe next update it can be smarter and know what to choose :p

              Dell 2950 g3 server
              Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
              Current: 2000 MHz, Max: 2667 MHz
              8 CPUs: 2 package(s) x 4 core(s)
              8152 MiB and 600meg 10k drive
              Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

              1 Reply Last reply Reply Quote 0
              • M
                McFuzz
                last edited by

                Hi all,

                So I got around to mimicking the setup i had in pfBlocker; I added all the lists and configured everything based on the way things used to be. However, my status widget just looks like this after a few hours:

                With the old setup, I'd be able to see all the blocked packets. In pfBlocker, I had it set as deny inbound and WAN as both inbound/outbound interface…

                Obviously the lists have loaded fine and firewall rules have been made as well but... what am I missing here?

                Thanks!

                1 Reply Last reply Reply Quote 0
                • T
                  Topper727
                  last edited by

                  go to the update tab and view log .. send it here

                  Oh and send your list links here also please so I can try and see if that is problem too

                  Dell 2950 g3 server
                  Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
                  Current: 2000 MHz, Max: 2667 MHz
                  8 CPUs: 2 package(s) x 4 core(s)
                  8152 MiB and 600meg 10k drive
                  Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

                  1 Reply Last reply Reply Quote 0
                  • M
                    McFuzz
                    last edited by

                    My lists actually require a subscription… but nevertheless, here they are; username and password redacted:

                    http://list.iblocklist.com/?list=rynxmrknfjysesjtjlxy&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=fruzekpkpzlmzozmuuhx&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=ydxerpxkpcfqjaybcssw&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=usrcshglbiilevmyfhse&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=lujdnbasfaaixitgmxpp&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=cwworuawihqvocglcoss&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=mcvxsnihddgutbjfbghy&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
                    http://list.iblocklist.com/?list=czvaehmjpsnwwttrdoyl&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx

                    Full log can be found here:

                    http://pastebin.com/raw.php?i=xR3DD8Br

                    I just noticed this interesting tidbit in the log:

                    
                    ===[  Aliastables / Rules  ]================================
                    
                    No Changes to Firewall Rules, Skipping Filter Reload 
                    
                     Updating: pfB_TopSpammers 
                    1 table created.312 addresses added.
                     Updating: pfB_Ads 
                    no IP address found for /32pfctl: cannot load /var/db/aliastables/pfB_Ads.txt: No error: 0
                     Updating: pfB_Hijacked 
                    1 table created.536 addresses added.
                     Updating: pfB_DROP 
                    1 table created.651 addresses added.
                     Updating: pfB_BOGON 
                    no IP address found for /8pfctl: cannot load /var/db/aliastables/pfB_BOGON.txt: No error: 0
                     Updating: pfB_BadPeers 
                    1 table created.48783 addresses added.
                     Updating: pfB_Spider 
                    1 table created.859 addresses added.
                     Updating: pfB_CruzitWebAttacks 
                    1 table created.4251 addresses added.
                    ===[ FINAL Processing ]=============================================
                    
                    

                    Is the above an issue at all?

                    Thanks!

                    1 Reply Last reply Reply Quote 0
                    • T
                      Topper727
                      last edited by

                      I seen failed download in the beginning of your log. You can fix that by putting type of url in list to gz_2

                      and I had similar issue that was fixed by reinstalling the package

                      force a reload before doing that though

                      Dell 2950 g3 server
                      Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
                      Current: 2000 MHz, Max: 2667 MHz
                      8 CPUs: 2 package(s) x 4 core(s)
                      8152 MiB and 600meg 10k drive
                      Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

                      1 Reply Last reply Reply Quote 0
                      • M
                        McFuzz
                        last edited by

                        I changed them to gz_2 and forced an update; I'll give it some time and see what happens. Thanks!

                        1 Reply Last reply Reply Quote 0
                        • T
                          Topper727
                          last edited by

                          Hit the thanks button for me please.  Hope that works for you

                          Dell 2950 g3 server
                          Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
                          Current: 2000 MHz, Max: 2667 MHz
                          8 CPUs: 2 package(s) x 4 core(s)
                          8152 MiB and 600meg 10k drive
                          Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

                          1 Reply Last reply Reply Quote 0
                          • M
                            McFuzz
                            last edited by

                            Just out of curiosity - there shouldn't be anything related to configuration other than the lists that could affect the behavior, could there?

                            For what its worth - this is how mine is configured:

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              @McFuzz:

                              For what its worth - this is how mine is configured:

                              On an unrelated note: WAN is not an outbound interface.

                              1 Reply Last reply Reply Quote 0
                              • T
                                Topper727
                                last edited by

                                @McFuzz:

                                Just out of curiosity - there shouldn't be anything related to configuration other than the lists that could affect the behavior, could there?

                                For what its worth - this is how mine is configured:

                                Except the LAN should be the outbound normally

                                Looks ok to me, maybe tomorrow about 11pm EST I can help with teamviewer if you don't have right by then

                                Dell 2950 g3 server
                                Intel(R) Xeon(R) CPU E5430 @ 2.66GHz
                                Current: 2000 MHz, Max: 2667 MHz
                                8 CPUs: 2 package(s) x 4 core(s)
                                8152 MiB and 600meg 10k drive
                                Pfsense 2.4 .. Hoping to get the phpvirtualbox going again.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  McFuzz
                                  last edited by

                                  Whoops - I must have accidentally toggled it. Fixed right now; will monitor.

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    Hi McFuzz,

                                    These are IBlock lists. And they are in a range format. You need to select "gz" format. There is a chart below the URL entry section to indicate what each "Format" is for.

                                    I think the issue is with the "Ads" list. I will be doing some debugging today but try to toggle that list "off" and change all IBlock to "gz" then run a "Force Reload".

                                    If you see a "-" in the widget there are issues with pfctl and it's not going to block anything.

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      I would also recommend removing the Bogon list and using pfSense built-in Bogon settings in the "Advanced Tab" of the GUI.

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        mzarrugh
                                        last edited by

                                        Is it possible to use easy list (https://easylist-downloads.adblockplus.org/easylist.txt) to block ads? I tried putting it in IPv4 Format: Text, List action Deny Inbound, but it doesn't seem to work. Also, When I do Force update it says Download FAIL.

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          @McFuzz:

                                          Obviously the lists have loaded fine and firewall rules have been made as well but… what am I missing here?

                                          Hi McFuzz,

                                          Seems the issue is with IBlock posting the following IP for Blocking

                                          # List distributed by iblocklist.com

                                          doclix.com:0.0.0.0-0.0.0.0

                                          I have code to remove "0.0.0.0", but as this was in a range format, it was being converted to "0.0.0.0**/32**", so the existing code was removing the "0.0.0.0" but leaving behind  "/32". This would cause pfctl to not load properly.

                                          I see that IBlock has removed that entry in their Ads List. It should never have been there in the first place.  >:(

                                          I will post a fix to resolve this potential Issue.

                                          You can manually delete the old Ads Files.

                                          rm /var/db/pfblockerng/original/Ads*.* 
                                          

                                          then Re-enable the "Ads" List and then run a "Force Reload".

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            @mzarrugh:

                                            Is it possible to use easy list

                                            Not currently. That is a Domain Blocklist. pfBlockerNG is an IP Based Blocking solution. pfBNG v2.0 will have this functionality.

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.