PfBlockerNG

McFuzz · Feb 7, 2015, 8:09 AM

Hi all,

So I got around to mimicking the setup i had in pfBlocker; I added all the lists and configured everything based on the way things used to be. However, my status widget just looks like this after a few hours:

With the old setup, I'd be able to see all the blocked packets. In pfBlocker, I had it set as deny inbound and WAN as both inbound/outbound interface…

Obviously the lists have loaded fine and firewall rules have been made as well but... what am I missing here?

Thanks!

Topper727 · Feb 7, 2015, 8:49 AM

go to the update tab and view log .. send it here

Oh and send your list links here also please so I can try and see if that is problem too

McFuzz · Feb 7, 2015, 9:19 AM

My lists actually require a subscription… but nevertheless, here they are; username and password redacted:

http://list.iblocklist.com/?list=rynxmrknfjysesjtjlxy&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=fruzekpkpzlmzozmuuhx&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=ydxerpxkpcfqjaybcssw&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=usrcshglbiilevmyfhse&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=lujdnbasfaaixitgmxpp&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=cwworuawihqvocglcoss&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=mcvxsnihddgutbjfbghy&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=czvaehmjpsnwwttrdoyl&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx

Full log can be found here:

http://pastebin.com/raw.php?i=xR3DD8Br

I just noticed this interesting tidbit in the log:


===[  Aliastables / Rules  ]================================

No Changes to Firewall Rules, Skipping Filter Reload 

 Updating: pfB_TopSpammers 
1 table created.312 addresses added.
 Updating: pfB_Ads 
no IP address found for /32pfctl: cannot load /var/db/aliastables/pfB_Ads.txt: No error: 0
 Updating: pfB_Hijacked 
1 table created.536 addresses added.
 Updating: pfB_DROP 
1 table created.651 addresses added.
 Updating: pfB_BOGON 
no IP address found for /8pfctl: cannot load /var/db/aliastables/pfB_BOGON.txt: No error: 0
 Updating: pfB_BadPeers 
1 table created.48783 addresses added.
 Updating: pfB_Spider 
1 table created.859 addresses added.
 Updating: pfB_CruzitWebAttacks 
1 table created.4251 addresses added.
===[ FINAL Processing ]=============================================

Is the above an issue at all?

Thanks!

Topper727 · Feb 7, 2015, 9:23 AM

I seen failed download in the beginning of your log. You can fix that by putting type of url in list to gz_2

and I had similar issue that was fixed by reinstalling the package

force a reload before doing that though

McFuzz · Feb 7, 2015, 9:43 AM

I changed them to gz_2 and forced an update; I'll give it some time and see what happens. Thanks!

Topper727 · Feb 7, 2015, 9:44 AM

Hit the thanks button for me please. Hope that works for you

McFuzz · Feb 7, 2015, 10:00 AM

Just out of curiosity - there shouldn't be anything related to configuration other than the lists that could affect the behavior, could there?

For what its worth - this is how mine is configured:

doktornotor · Feb 7, 2015, 10:02 AM

@McFuzz:

For what its worth - this is how mine is configured:

On an unrelated note: WAN is not an outbound interface.

Topper727 · Feb 7, 2015, 10:03 AM

@McFuzz:

Just out of curiosity - there shouldn't be anything related to configuration other than the lists that could affect the behavior, could there?

For what its worth - this is how mine is configured:

Except the LAN should be the outbound normally

Looks ok to me, maybe tomorrow about 11pm EST I can help with teamviewer if you don't have right by then

McFuzz · Feb 7, 2015, 10:17 AM

Whoops - I must have accidentally toggled it. Fixed right now; will monitor.

BBcan177 · Feb 7, 2015, 1:48 PM

Hi McFuzz,

These are IBlock lists. And they are in a range format. You need to select "gz" format. There is a chart below the URL entry section to indicate what each "Format" is for.

I think the issue is with the "Ads" list. I will be doing some debugging today but try to toggle that list "off" and change all IBlock to "gz" then run a "Force Reload".

If you see a "-" in the widget there are issues with pfctl and it's not going to block anything.

BBcan177 · Feb 7, 2015, 1:57 PM

I would also recommend removing the Bogon list and using pfSense built-in Bogon settings in the "Advanced Tab" of the GUI.

mzarrugh · Feb 7, 2015, 3:16 PM

Is it possible to use easy list (https://easylist-downloads.adblockplus.org/easylist.txt) to block ads? I tried putting it in IPv4 Format: Text, List action Deny Inbound, but it doesn't seem to work. Also, When I do Force update it says Download FAIL.

BBcan177 · Feb 7, 2015, 4:10 PM

@McFuzz:

Obviously the lists have loaded fine and firewall rules have been made as well but… what am I missing here?

Hi McFuzz,

Seems the issue is with IBlock posting the following IP for Blocking

# List distributed by iblocklist.com

doclix.com:0.0.0.0-0.0.0.0

I have code to remove "0.0.0.0", but as this was in a range format, it was being converted to "0.0.0.0**/32**", so the existing code was removing the "0.0.0.0" but leaving behind "/32". This would cause pfctl to not load properly.

I see that IBlock has removed that entry in their Ads List. It should never have been there in the first place. >:(

I will post a fix to resolve this potential Issue.

You can manually delete the old Ads Files.

rm /var/db/pfblockerng/original/Ads*.*

then Re-enable the "Ads" List and then run a "Force Reload".

BBcan177 · Feb 7, 2015, 4:12 PM

@mzarrugh:

Is it possible to use easy list

Not currently. That is a Domain Blocklist. pfBlockerNG is an IP Based Blocking solution. pfBNG v2.0 will have this functionality.

samham · Feb 7, 2015, 4:22 PM

I have configured iBlock list under IPv4 to block in both directions I see the logs showing blocking however no updates for the widget, please see attached

BBcan177 · Feb 7, 2015, 4:26 PM

@samham:

I have configured iBlock list under IPv4 to block in both directions I see the logs showing blocking however no updates for the widget, please see attached

When you look at the System Logs: Firewall Logs in the GUI. Do these alerts have pfB_ in the Rule Column?

samham · Feb 7, 2015, 4:32 PM

no I don't but i see the IP being blocked in both the pfblockerNG:Alerts and the Firewall Log

BBcan177 · Feb 7, 2015, 4:43 PM

Clear the Firewall Log and start fresh. When you make Rule Changes, they can go out of Sync.

BBcan177 · Feb 7, 2015, 4:51 PM

@samham:

how do you show Rule column under system:firewall log?

System Logs: Settings:

Filter Descriptions and select "Display as Column"

Also make sure the logs are in reverse. First Checkbox at the top of the Settings page.