PfBlockerNG
-
BB do you recommend enabling Floating Rules or have the auto-rules generated in the WAN/LAN interfaces? I dont currently have Floating Rules enabled. I also don't have an interface selected for Inbound Interfaces since I'll only be rejecting on my Outbound Interface.
-
There is a thread all about this topic of floating vs Std Interfaces. Its not difficult to flip back and forth. With Floating they will match quicker.
https://forum.pfsense.org/index.php?topic=78062.0
-
what bewilders me is that the process shows absolutely no load in top.
So while you guys have been drinking Beer and relaxing….
I wrote some code that Compresses the contents of /var/db/aliastables at reboot, and can restore this file on Bootup... Just need some testers ;D and the Devs to approve it of course.
Thank you! I had a feeling there was a whole lot of nothing going on. I would be happy to test code related to this.
I am also happy to test. I have 32 and 64 bit nanoBSD systems that I can test with. PM me about any code…
-
I wrote some code that Compresses the contents of /var/db/aliastables at reboot, and can restore this file on Bootup… Just need some testers ;D and the Devs to approve it of course.
It that available in your unofficial repo ATM?
-
'Header' : The 'Header' Field must be Unique, it will name the List File and it will be referenced in the pfBlockerNG Widget. Use a Unique Prefix per 'Alias Category' followed by a unique descriptor for each List.
What is an 'Alias Category'? Is it just an alias where the corresponding lists are used?
For example, I have 2 aliases, one for VPN and another for SSH, they are not identical. Both aliases have some country lists in common (ex.: /usr/pbi/pfblockerng-i386/share/GeoIP/GB_v4.txt). Can I use the header like Country_UK in both aliases? -
Can I use the header like Country_UK in both aliases?
Yes. Thats the purpose of a pfSense Alias. So it can be used easily in the Firewall Rules.
I would suggest naming it "CC_GB4" and "CC_GB6" For example.
-
BBcan177, thanks a lot!
Already cleaning up my configs. -
You can add any number of Countries to a single Alias but they all have to be IPv4 or IPv6 depending on which Tab you created them in IPv4 or IPv6 Tabs. Set it to update once per week.
/usr/pbi/pfblockerng-amd64/share/GeoIP/US_v4.txt
Just a note - this apparently fails for IPv6 (Download FAIL/Local File Failure)
-
Yes I have a fix for IPv6 Regex. Should have it posted today or tomorrow…
PM me if you need to get it sooner.
-
-
PM me if you need to get it sooner.
Noooo, definitely not urgent. Was just testing. :)
Was kinda leading you to test it ;D I did say I really Hate Regex! Right!
You could edit pfblockerng.inc and replace the following (Starting at Line 1166)
$pattern1 = '([A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}'; $pattern2 = '[A-Fa-f0-9]{1,4}::([A-Fa-f0-9]{1,4}:){0,5}[A-Fa-f0-9]{1,4}'; $pattern3 = '([A-Fa-f0-9]{1,4}:){2}:([A-Fa-f0-9]{1,4}:){0,4}[A-Fa-f0-9]{1,4}'; $pattern4 = '([A-Fa-f0-9]{1,4}:){3}:([A-Fa-f0-9]{1,4}:){0,3}[A-Fa-f0-9]{1,4}'; $pattern5 = '([A-Fa-f0-9]{1,4}:){4}:([A-Fa-f0-9]{1,4}:){0,2}[A-Fa-f0-9]{1,4}'; $pattern6 = '([A-Fa-f0-9]{1,4}:){5}:([A-Fa-f0-9]{1,4}:){0,1}[A-Fa-f0-9]{1,4}'; $pattern7 = '([A-Fa-f0-9]{1,4}:){6}:[A-Fa-f0-9]{1,4}'; $pattern8 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern9 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}:[A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern10 = '[A-Fa-f0-9]{1,4}::\/[0-9]{2}'; $pfb['ipv6'] = "/^($pattern1)$|^($pattern2)$|^($pattern3)$|^($pattern4)$|^($pattern5)$|^($pattern6)$|^($pattern7)$|^($pattern8)$|^($pattern9)$|^($pattern10)$/"; -
edit pfblockerng.inc and replace the following (Starting at Line 1166)
$pattern1 = '([A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}'; $pattern2 = '[A-Fa-f0-9]{1,4}::([A-Fa-f0-9]{1,4}:){0,5}[A-Fa-f0-9]{1,4}'; $pattern3 = '([A-Fa-f0-9]{1,4}:){2}:([A-Fa-f0-9]{1,4}:){0,4}[A-Fa-f0-9]{1,4}'; $pattern4 = '([A-Fa-f0-9]{1,4}:){3}:([A-Fa-f0-9]{1,4}:){0,3}[A-Fa-f0-9]{1,4}'; $pattern5 = '([A-Fa-f0-9]{1,4}:){4}:([A-Fa-f0-9]{1,4}:){0,2}[A-Fa-f0-9]{1,4}'; $pattern6 = '([A-Fa-f0-9]{1,4}:){5}:([A-Fa-f0-9]{1,4}:){0,1}[A-Fa-f0-9]{1,4}'; $pattern7 = '([A-Fa-f0-9]{1,4}:){6}:[A-Fa-f0-9]{1,4}'; $pattern8 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern9 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}:[A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern10 = '[A-Fa-f0-9]{1,4}::\/[0-9]{2}'; $pfb['ipv6'] = "/^($pattern1)$|^($pattern2)$|^($pattern3)$|^($pattern4)$|^($pattern5)$|^($pattern6)$|^($pattern7)$|^($pattern8)$|^($pattern9)$|^($pattern10)$/";That works. 8)
-
Hi McFuzz,
These are IBlock lists. And they are in a range format. You need to select "gz" format. There is a chart below the URL entry section to indicate what each "Format" is for.
I think the issue is with the "Ads" list. I will be doing some debugging today but try to toggle that list "off" and change all IBlock to "gz" then run a "Force Reload".
If you see a "-" in the widget there are issues with pfctl and it's not going to block anything.
Howdy,
I actually changed it to gz_2 and it apparently works fine now; gz caused me to have the dashes (-). I'll disable ads and see if all others work with gz. I'll check out the BOGON settings :)
-
Wonder if there is a problem with the lists.. I had that happen and I disabled with help from BBcan the bad apples.. Found out there is a 0.0.0.0 address in bad ones and that was a bug that he is fixing now.
-
deviantart is working now. Malwarebytes still saying unable to access server when updating. Only packets being blocked are from level1 and ads and tracker list.
-
try
https://www.iblocklist.com/lists.php
[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=anti-infringement ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=webexploit ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=dshield ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=drop ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=zeus ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=china ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=forumspam ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=pedophiles ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=northkorea ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=russia ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=atma ]
.[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spammers ]
. -
Found out there is a 0.0.0.0 address in bad ones
Whoever puts 0.0.0.0 in a blocklist should not maintain one in the first place… WTF! :o >:(
-
Agree.. but BBcan had code to remove it but now he has a file that I gave him from a list that he can test and debug that part of the code. So in future if more of those 0.0.0.0 show up they will be ignored. Hence the list should work
-
By the way - another interesting thing I've noticed between pfBlocker and pfBlockerNG is that with pfBlocker, it'd block A LOT of packets, but with pfBlockerNG - barely so:
What gives..?
-
Suggestion if not already done. Put the block to block both for each list.
And I get a lot of blocks from it. Go surf around some bad sites and watch the numbers grow.
