PfBlockerNG

doktornotor

Is anyone familiar with Block List at https://www.blocklist.de/en/index.html ? They look very interesting.

Yeah it works pretty well… Using it for mailservers.

Bummer

Hey BBScan and doktornotor,

Thanks for the input.

I like that idea of subscribing to them because of the other IPs reported to them by Fail2Ban.

Can you point me to instructions on how to prevent the duplication of IPs from several different lists? I've seen the de-duplication box to check, but surely it can't be that easy. There must be more to that.

BTW, the new pfBlockerNG looks really great. It has a lot more bells and whistles I want to play with. It's just learning the terminology and playing with them. Much of this I've never messed wtih before.

BBcan177

@Bummer:

Can you point me to instructions on how to prevent the duplication of IPs from several different lists? I've seen the de-duplication box to check, but surely it can't be that easy. There must be more to that.

Yup.. One checkbox to enable de-duplication. Then hit "Force Reload"

BTW, the new pfBlockerNG looks really great. It has a lot more bells and whistles I want to play with. It's just learning the terminology and playing with them. Much of this I've never messed wtih before.

Thanks. It was a lot of work. I hope users try to use more of the advanced features (like Reputation) to help protect their networks…

Bummer

Hey BBScan177,

Okay, now for stupid question #2…

Yup.. One checkbox to enable de-duplication. Then hit "Force Reload"

If I have the lists set to update hourly, daily, or whatever, the de-duplication remains? If that's the case, it's simple simon, too good to be true!

Yes, I've seen the back and forth on reputation. I'm still not sure what it does, I can be a little slow on things like this. But once I get it down, them I'm on it!

stuck

@marcelloc:

Check if you still have aliases and rules from pfBlocker version.
If so, remove it.

Thanks marcelloc,
I did find a firewall rule that referenced a pfBlocker version and removed it. I don't see any aliases that were used by the old pfBlocker.
This still caused the same error.

BBcan177

It's strange that there are no aliases. (url tables) listed? Are you sure you checked it properly?

Try to run this command from the shell :

pfctl -sa (and at the end of the output, do you see any pfblocker tables?)

Also try to delete all files in

/var/db/aliastables (then reboot)

panz

I just upgraded from pfSense 2.1.5 to 2.2 and pfblocker disappeared from Firewall menu; however, all my blocklists are still there, because pfblocker was setup to use aliases only.

Now:

how do I install pfblockerNG? Is pfblockerNG going to recover my config or will I have to enter the settings again? I'm asking just to be sure I'm not going to make a mess…
18 block rules are present in my WAN interface Firewall setup (1 row for each IBlockList list I'm using) do I have to manually delete them before installing pfblockerNG?

BBcan177

You will need to re-configure, as it doesn't share the same settings.

I would recommend that you create aliases with more than one list. No real need to have a rule per list.

If you want to stay with "Alias" rules, you can modify the existing rules from pfblocker, and change the "alias table" setting and change the description to :

pfb_ then the name of the aliastable
(more details in the alias settings tab)

panz

I created an Alias for each list because, with one "big" list, pfblocker crashed with pfSense's message "PF was wedged/busy and has been reset".

So, I'm going to follow this procedure:

delete any previous firewall rule created by pfblocker;
delete any Alias also created by pfblocker;
enter the setting again in the new package pfblockerNG.

BBcan177

@panz:

I created an Alias for each list because, with one "big" list, pfblocker crashed with pfSense's message "PF was wedged/busy and has been reset".

Enable "De-duplication" in the General Tab. You will see the total size of the Block lists shrink substantially.

Bummer

Hey guys,

I set up a few lists from BlockList.de and have it set to run via cron. I'm getting the errors below. What am I doing wrong?

CRON PROCESS START [ 02/21/15 13:00:00 ]
Updates Found
Updates Found
UPDATE PROCESS START

[ pfB_Africa_v4 ] exists, Reloading File

[ pfB_Africa_v6 ] exists, Reloading File

[ pfB_Top_v4 ] exists, Reloading File
[ pfB_Top_v6 ] exists, Reloading File

[ White Listed IPs_custom ] exists, Reloading File

[ http://lists.blocklist.de/lists/ssh.txt ]
** TERMINATED - Header contains Blank/International/Special or Spaces

[ SSH-BlockList_custom ] Loading Custom File
–--------------------------------------------------------
Original Masterfile Outfile [ Post Duplication count ]
–--------------------------------------------------------
952 952 952 [ Passed ]
–--------------------------------------------------------

[ http://lists.blocklist.de/lists/ssh.txt ]
** TERMINATED - Header contains Blank/International/Special or Spaces
\ Email-BlockList_custom ] exists, Reloading File

===[ Aliastables / Rules ]================================

No Changes to Firewall Rules, Skipping Filter Reload
Updating: pfB_SSHBlockList
no changes.
UPDATE PROCESS ENDED

BBcan177

Make sure you set the "Header" in the IPv4 tab for each list. The log usually has all the details to diagnose issues.

** TERMINATED - Header contains Blank/International/Special or Spaces

Also - try to use. "https" when possible.

EDIT:

You can't use "-" in the Header field…

Bummer

Okay, BBScan177,

OKay, call me stupid. Okay, very stupid. How do I set the header for each list? When making the list is says to make a unique header. I saw the area and put the same thing in the "header" area as I did for the "List Description" and "List Name". So now that I know that's not correct, what do I do?

Sorry, I feel stupid.

Thanks!

BBcan177

I usually setup an Alias for "Malicious", "Ads", "IBlock", "Mail" etc (group common lists into one alias) and for each list enter a unique name for each list/header. If the List source has multiple lists, then use a prefix like so:

blocklistde_ssh
blocklistde_spam

Bummer

I am missing something? Attached here is a partial screen cap of what I have set up.

bbacan177.png_thumb

BBcan177

Unfortunately you can't use "-" in the header name. I also added that to a previous post above.

Bummer

I"ve read so much on these posts my head spins! I try to go back and look at something that I wanted to research and can't find it.

Thank you very much for letting me know. I appreciate it.

Time to make the changes!

Bummer

Well, most of it worked! But, there is an error below. It doesn't say much for the SSH block list.

I'm sorry, I hope this isn't something stupid again. I'm very excited with the new pfBlockerNG and want to use it to it's fullest! See the attached screen cap.

pfblockerNG.png_thumb

BBcan177

Can you copy that url and test it in the browser?

Some site have rate-limiting if you download too many times. When you test it in the browser, and if you get a rate limiting error, disable that list for 24hrs and then re-enable it.

Blocklist.de also has all those categories in a single download file if you want to try that one.

Bummer

Yes, I was able to copy and paste the url in to my browser and it came up. I did the "All" as you suggested. I'll see if it updates.

What other lists are good to add? I've looked around and it can get confusing. I've seen lists from BlueTack and I-Blocklist. Are they redundant or any good?

The spammers and hackers can sure make things painful.