PfBlockerNG

SixXxShooTeR · Feb 11, 2015, 9:18 AM

Disabled a couple I-Block lists after reading what you wrote BB. I was getting too many outbound blocks with a couple of them that I didn't want. Any I-Block lists worth using?

It is a shame that ET's prices are so high.

I also started using some of the lists that you referenced on page 16 on this forum. Thanks for the fast responses btw! Your help is appreciated.

Tropheus · Feb 11, 2015, 12:31 PM

Has anyone done a "How to setup example" like there are with the old PFB

turker · Feb 11, 2015, 2:42 PM

Code red theme footer error. (Only in alerts tab)

hedberg · Feb 11, 2015, 6:23 PM

@BBcan177:

@mzarrugh:

Is it possible to use easy list

Not currently. That is a Domain Blocklist. pfBlockerNG is an IP Based Blocking solution. pfBNG v2.0 will have this functionality.

Sounds interesting with a domain blocklist. Could the functionality also be reversed, så it would be possible to create a domain whitelist in pfBNG 2.0?

Br,
Thomas

BBcan177 · Feb 11, 2015, 11:25 PM

@turker:

Code red theme footer error. (Only in alerts tab)

Thanks turker… I will take a look at that when I get a chance...

BBcan177 · Feb 11, 2015, 11:27 PM

@hedberg:

Sounds interesting with a domain blocklist. Could the functionality also be reversed, så it would be possible to create a domain whitelist in pfBNG 2.0?

You could whitelist Domains that you didn't want to block (Suppression).. But a reverse, not sure how that would work with Unbound.

BBcan177 · Feb 11, 2015, 11:31 PM

@Tropheus:

Has anyone done a "How to setup example" like there are with the old PFB

I will try to write one up… What kind of things would you guys want to see in a Tutorial? The basics? or just for the new features?

wcrowder · Feb 12, 2015, 1:26 AM

I think the how-to should be left up to the community. One of, or several of us could collaborate on that part. DNSBL needs attention, ie. pfBlockedrNG 2.0, I miss the daily updates. ::)

reggie14 · Feb 12, 2015, 3:07 AM

I'm noticing extremely high CPU usage on my pfSense box when I'm just sitting on my pfBlockerNG alerts page. Its attributed to one or more processes named "php-fpm: pool lighty (php-fpm)"

It seems like the longer I'm on the that page, the more of those processes I see, and the higher the CPU usage gets.

For what its worth, I'm seeing a significant number of alerts from attempts to access lots of different IPs at: 61.145.124.x and 183.61.112.x on port 80. These are originating from a Nexus 9 tablet. I can't figure out how they belong to, other than some Chinese telecon and some appear to be alibaba. Any ideas? I'm trying to decide if I should be concerned…

BBcan177 · Feb 12, 2015, 3:22 AM

Hi reggie.

I haven't noticed any significant Load from the Alerts Tab myself? Do you leave it running with Auto-Refresh and Auto-Resolve running? Which Browser are you using?

Are those Alerts coming from a Country Block? You can click any of the "!" to pull more detail about those IPs. There are several different sites listed in that Lookup page.

reggie14 · Feb 12, 2015, 4:14 AM

BBcan177 -

I'm using Chrome, without auto-refresh or auto-resolve running. As far as I can tell, the high CPU usage continues indefinitely after the initial load for the Alerts page, and there's no sign that Chrome is attempting to update that page.

The problem is significantly exacerbated if I increase the number of alerts that are configured to appear. Try bumping up the number to the last 300 deny alerts and see what happens. My pfsense box came to a crawl until I closed the browser window that had the alerts page open.

As for the IP addresses, I tried looking at the resources pfblocker identifies, but couldn't find anything particularly useful there. I did, however, just track down the source of the traffic on my end- it's where the Go Weather app on Android goes to pull down weather data.

Update 1: BTW, separate note, does the "Enable Suppression" option work yet? I want to allow the traffic I'm seeing. I think I could just add it to the firewall suppression list via an easy rule, but pfblockerng seems to be able to manage its own suppression list. The main config page says I should see "+" icons in the alerts tab, but I still don't see them after enabling that option.

Update 2: Re-reading the config page, it sounds like I can't suppress country blocks. Hmmm… I guess I should just manually create firewall rules to pass this traffic before pfblockerng blocks it. Or is pfblockerng just going to put itself ahead of that rule?

BBcan177 · Feb 12, 2015, 4:13 AM

If you select F12 - Dev Mode. and goto "Console" tab, do you see any errors? I bumped mine to 300 and do see four php-fpm processes, but they are all between 0.5-2% each (max 3% at times).

BBcan177 · Feb 12, 2015, 4:16 AM

@reggie14:

The main config page says I should see "+" icons in the alerts tab, but I still don't see them after enabling that option.

In the General tab, enable the checkbox for "Suppression". The "+" icon will not appear for Country Blocks. (Hover over the Lists column and the "+" icon when you see it for more details)

To overcome Country Blocks, you need to create a Whitelist Alias and set it to Permit Outbound.

reggie14 · Feb 12, 2015, 4:17 AM

@BBcan177:

If you select F12 - Dev Mode. and goto "Console" tab, do you see any errors? I bumped mine to 300 and do see four php-fpm processes, but they are all between 0.5-2% each (max 3% at times).

Sorry, I'm not sure what you mean. Do you mean I need to SSH into the pfsense box to enable dev mode, and then I'll see a console tab on the webGUI?

BBcan177 · Feb 12, 2015, 4:20 AM

@reggie14:

@BBcan177:

If you select F12 - Dev Mode. and goto "Console" tab, do you see any errors? I bumped mine to 300 and do see four php-fpm processes, but they are all between 0.5-2% each (max 3% at times).

Sorry, I'm not sure what you mean. Do you mean I need to SSH into the pfsense box to enable dev mode, and then I'll see a console tab on the webGUI?

The Chrome Browser (All browsers actually) have a Dev mode to help in Debugging. Click F12, when in Chrome and it will show more details that can help diagnose the issue.

reggie14 · Feb 12, 2015, 4:35 AM

@BBcan177:

To overcome Country Blocks, you need to create a Whitelist Alias and set it to Permit Outbound.

I'm not sure I know how to do this…

If I understand how pfblockerng works, I need to do this within pfblockerng- as any regular firewall rule will appear after the pfblockerng rules.

So, I'd have to create a IPv4 Alias/list. However, it appears that to populate that list I would have to create a local file on the pfsense box that lists the IPs and networks I want to allow. There's no way just to list the IPs directly from the web interface. Is that right?

Update: Nevermind. The custom list feature can obviously be used to do that much more easily. I knew there must be a better way.

reggie14 · Feb 12, 2015, 4:30 AM

@BBcan177:

The Chrome Browser (All browsers actually) have a Dev mode to help in Debugging. Click F12, when in Chrome and it will show more details that can help diagnose the issue.

Oh, that is what you meant. It never occurred to me that the browser might be able to provide meaningful diagnostic data on this issue. It was a good idea, though. I do see some errors:


https://pfsense.<redacted>/pfblockerng/javascript/domTT/domLib.js Failed to load resource: the server responded with a status of 404 (Not Found)
https://pfsense.<redacted>/pfblockerng/javascript/domTT/domTT.js Failed to load resource: the server responded with a status of 404 (Not Found)
https://pfsense.<redacted>/pfblockerng/javascript/domTT/behaviour.js Failed to load resource: the server responded with a status of 404 (Not Found)
https://pfsense.<redacted>/pfblockerng/javascript/domTT/fadomatic.js Failed to load resource: the server responded with a status of 404 (Not Found)</redacted></redacted></redacted></redacted>

BBcan177 · Feb 12, 2015, 4:33 AM

@reggie14:

@BBcan177:

To overcome Country Blocks, you need to create a Whitelist Alias and set it to Permit Outbound.

I'm not sure I know how to do this…

If I understand how pfblockerng works, I need to do this within pfblockerng- as any regular firewall rule will appear after the pfblockerng rules.

So, I'd have to create a IPv4 Alias/list. However, it appears that to populate that list I would have to create a local file on the pfsense box that lists the IPs and networks I want to allow. There's no way just to list the IPs directly from the web interface. Is that right?

Create a new Alias "Whitelist", You can enter IPs in the "Custom Box" below where the URLs are entered. Enter one IP per line (You can put a #comment beside each IP to Document for future Reference).

Set the "List Action" as "Permit Outbound".

Update Frequency doesn't really matter in this instance. You can enable/Disable logging of this Alias as you require. When you make any changes, Click the "Update Custom List" Checkbox at the very bottom of the Alias, and then Save.

Click "Force Update" to reload this Alias.

Ensure that the appropriate "Rules Order" is selected in the "General Tab" to allow the Permits to be placed before the Block Rules.

BBcan177 · Feb 12, 2015, 4:36 AM

I've seen that error before. Not sure if its related… But I do really hate JS :)
Let me look into it and will get back to you. Just drop the Deny count to something more manageable (<50)

reggie14 · Feb 12, 2015, 4:41 AM

BBcan177- Indeed- thanks for the clear instructions. I should have figured that out myself much faster. I knew there must be a better way, but the custom list heading didn't sound right until I actually read the instructions/examples around it.

Dropping the alert count helps, although sometimes even then I have awfully high CPU usage. Luckily, I don't really need to use it most of the time. I can view the firewall logs page without running into this problem.

I really appreciate the troubleshooting help!