• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG

pfBlockerNG
210
1.2k
1.8m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • V
    varazir
    last edited by Mar 21, 2015, 8:46 PM

    I heard there was host blocking option on it's way?

    1 Reply Last reply Reply Quote 0
    • ?
      A Former User
      last edited by Mar 22, 2015, 11:48 PM

      I just wanted to drop a thank you for a great package. Runs excellent with all the bells running. Error log is empty.
      Thanks again guys. BBcan177 nice job. Your work is appreciated. ;D

      ps: just finished reading this post in its entirety and what did you guys "NOT" cover. The post is a manual in its own right. Your patience shows. ::)

      1 Reply Last reply Reply Quote 0
      • B
        BBcan177 Moderator
        last edited by Mar 24, 2015, 4:47 PM Mar 24, 2015, 4:41 PM

        Here is another Threat Source for pfBlockerNG :

        This feed is provided by :  bambenekconsulting.com

        These lists cover the following type of Threats:

        • Banjori

        • Bebloh/URLZone

        • Cryptolocker

        • Cryptowall

        • Dyre

        • Geodo

        • Hesperbot

        • Matsnu

        • Necurs

        • P2P GOZ

        • PT GOZ / New GOZ

        • Pushdo

        • Qakbot

        • Ramnit

        • Symmi

        • Tinba / TinyBanker

        Here is a list of all the Feeds available:  All Feeds

        I would recommend using the two main IP lists which encompass all of the individual Lists:

        c2 IP Feed                Master Feed of known, active and non-sinkholed C&Cs IP addresses.

        c2 All Indicator Feed  Master Feed of known, active and non-sinkholed C&Cs indicators

        Use the "html" Format to download these Lists. Download frequency of atleast once per day.

        ** Please read their License and please donate to the charity they run called the "Tumaini Foundation".

        If you see Alerts to any of these Lists, please take additional measures to clean up any infections as these IPs are very malicious. So please put these lists into its own Alias.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • P
          panz
          last edited by Mar 25, 2015, 12:24 PM

          «You don't have permission to access /feeds/c2-ipmasterlist.txt on this server.»

          pfSense 2.3.2-RELEASE-p1 (amd64)
          motherboard: MSI C847MS-E33 Micro ATX (with Intel Celeron CPU 847 @ 1.10 GHz) ~ PSU: Corsair VS350 ~ RAM: Kingston KVR1333D3E9S 4096 MB 240-pin DIMM DDR3 SDRAM 1.5 volt ~ NIC: Intel EXPI9301CTBLK (LAN) ~ NIC: D-Link DFE-528TX (CAM) ~ Hard Disk: Western Digital WD10JFCX Red ~ Case: Cooler Master HAF XB ~ power consumption: 21 Watts.

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by Mar 25, 2015, 12:56 PM

            Hmm, apparently people hammered the poor guys. :D

            1 Reply Last reply Reply Quote 0
            • B
              BBcan177 Moderator
              last edited by Mar 25, 2015, 3:36 PM

              It seems to be fixed now. Post back if you continue to have any issues.

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • B
                BBcan177 Moderator
                last edited by Mar 25, 2015, 6:17 PM

                If your interested to read up on Bambenek Consultings work:

                "The New Scourge of Ransomware: A Study of CryptoLocker and Its Friends"

                Published on Mar 19, 2015
                    By Lance James and John Bambenek
                    https://www.youtube.com/watch?v=X994Rdt-36o

                Meat of the video starts at around the 9-10min mark.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • T
                  taryezveb
                  last edited by Mar 25, 2015, 10:59 PM

                  @BBcan177:

                  Here is another Threat Source for pfBlockerNG :

                  This feed is provided by :  bambenekconsulting.com

                  These lists cover the following type of Threats:

                  • Banjori

                  • Bebloh/URLZone

                  • Cryptolocker

                  • Cryptowall

                  • Dyre

                  • Geodo

                  • Hesperbot

                  • Matsnu

                  • Necurs

                  • P2P GOZ

                  • PT GOZ / New GOZ

                  • Pushdo

                  • Qakbot

                  • Ramnit

                  • Symmi

                  • Tinba / TinyBanker

                  Here is a list of all the Feeds available:  All Feeds

                  I would recommend using the two main IP lists which encompass all of the individual Lists:

                  c2 IP Feed                Master Feed of known, active and non-sinkholed C&Cs IP addresses.

                  c2 All Indicator Feed  Master Feed of known, active and non-sinkholed C&Cs indicators

                  Use the "html" Format to download these Lists. Download frequency of atleast once per day.

                  ** Please read their License and please donate to the charity they run called the "Tumaini Foundation".

                  If you see Alerts to any of these Lists, please take additional measures to clean up any infections as these IPs are very malicious. So please put these lists into its own Alias.

                  Thanks for this and your work on pfBlockerNG; a welcomed upgrade to
                  pfBlocker.

                  Just started using pflockerNG and have a suggestion. When clicking on
                  the 'Cancel' button instead of reloading the page, it should take you
                  back to the previous page. For example, when editing/adding an
                  alias/list would take you back to the main alias/list page.

                  Maybe others like the current function. Just seems that when canceling
                  should go to the previous page, a reload does not convey that whatever
                  was done was canceled.

                  Thank You

                  1 Reply Last reply Reply Quote 0
                  • C
                    ConfusedUser
                    last edited by Mar 25, 2015, 11:51 PM

                    Hi All,

                    The filter function for the alerts doesn't seem to be working properly (pfSense 2.2.1, pfBlockerNG 1.06).
                    For example right now when I have a look at my alerts only within the last 2 hours I have 5 entries with destination port 25.
                    In the total list (500 entries, around 2 days) there are around 100 entries with destination port 25.

                    When I set a filter for destination port = 25 it displays only three items (out of the approximate 100) and when I change the filter to ^25$ then only one entry (the most recent one) is displayed.
                    Any idea what I can try to be able to correctly filter by destination port?

                    1 Reply Last reply Reply Quote 0
                    • B
                      BBcan177 Moderator
                      last edited by Mar 25, 2015, 11:59 PM

                      @taryezveb:

                      When clicking on the 'Cancel' button instead of reloading the page, it should take you
                      back to the previous page.

                      In my setup, this is what it does, so not sure why it doesn't do that for you? The code for this is in pfSense base code, (pkg_edit.php). What theme are you using?

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • B
                        BBcan177 Moderator
                        last edited by Mar 26, 2015, 12:02 AM

                        @ConfusedUser:

                        When I set a filter for destination port = 25 it displays only three items (out of the approximate 100) and when I change the filter to ^25$ then only one entry (the most recent one) is displayed.
                        Any idea what I can try to be able to correctly filter by destination port?

                        Hi ConfuesedUser, what did you input in the "Deny Entries" in the Alert Settings at the top of the Alerts Page? It will only report this number of Alerts (With/without Filtering). My tests show everything to be ok with all of the Filtering options?

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • T
                          taryezveb
                          last edited by Mar 26, 2015, 12:39 AM

                          @BBcan177:

                          In my setup, this is what it does, so not sure why it doesn't do that
                          for you? The code for this is in pfSense base code, (pkg_edit.php). What
                          theme are you using?

                          Using the pfsense_ng theme, reverted to the pfsense theme. Still get the
                          same in chromium and firefox; after logging out closing the window and
                          opening a new window and logging back in. In case that would make a
                          difference.

                          Thank You

                          1 Reply Last reply Reply Quote 0
                          • C
                            ConfusedUser
                            last edited by Mar 26, 2015, 8:38 AM

                            @BBcan177:

                            @ConfusedUser:

                            When I set a filter for destination port = 25 it displays only three items (out of the approximate 100) and when I change the filter to ^25$ then only one entry (the most recent one) is displayed.
                            Any idea what I can try to be able to correctly filter by destination port?

                            Hi ConfuesedUser, what did you input in the "Deny Entries" in the Alert Settings at the top of the Alerts Page? It will only report this number of Alerts (With/without Filtering). My tests show everything to be ok with all of the Filtering options?

                            Hi BBcan177,

                            I attached three screenshots that probably are more helpful than me writing a lot stuff.

                            not_filtered.jpg: As the name says. I was limiting to 50 deny and using Firefox search it found 12 matches (see at the bottom). 7 entries with destination port 50 are visible without scrolling down. Since it is an internal mail server (port forward) it is showing a private IP as destination.

                            filtered_1.jpg: Adding a destination port filter of '25' already reduced the amount of entries to 3.

                            filtered_2.jpg: Adding a destination port filter of '^25$' (like suggested on the page) reduced the amount of entries to 1 (so basically 11 are missing).

                            Not part of those screenshots:
                            When I change the number of deny entries to 500 there are in total 102 entries with 192.168.50.10:25. Applying the '^25$' filter as described above still shows only one entry.

                            not_filtered.jpg
                            not_filtered.jpg_thumb
                            filtered_1.jpg
                            filtered_1.jpg_thumb
                            filtered_2.jpg
                            filtered_2.jpg_thumb

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by Mar 26, 2015, 8:47 AM

                              Until this bug is fixed, debugging similar issues is a pure waste of time.

                              1 Reply Last reply Reply Quote 0
                              • B
                                BBcan177 Moderator
                                last edited by Mar 26, 2015, 2:50 PM

                                Hi ConfuesedUser,

                                If you look at your pfSense Firewall log do you have IGMP alerts (If so, create a Firewall rule to drop those packets until the Devs fix that issue)? If you filter port 25 in the Firewall log do they show ok?

                                I can't reproduce this error on my boxes. Maybe try to clear the Firewall log and start with a Fresh Log and see if that fixes it? Report back how it goes. Can you filter other Settings in the Alerts Page? or is this issue limited to the "Dest Port" Filter field?

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by Mar 26, 2015, 3:18 PM

                                  @BBcan177:

                                  If you look at your pfSense Firewall log do you have IGMP alerts (If so, create a Firewall rule to drop those packets until the Devs fix that issue)?

                                  This sadly seems impossible. Best you can do is hiding them from the GUI by reverting the patch that made them show. But they will still get logged and screw things like this.

                                  1 Reply Last reply Reply Quote 0
                                  • H
                                    ha11oga11o
                                    last edited by Mar 26, 2015, 6:43 PM

                                    Hello all,

                                    i sorted all to work fine except pflocker. Can someone please see this printscreens and tell me what caused this? Seems theres no alerts for me at all. Nothing.

                                    Many thnx.


                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      ConfusedUser
                                      last edited by Mar 26, 2015, 8:17 PM Mar 26, 2015, 8:05 PM

                                      @BBcan177:

                                      Hi ConfuesedUser,

                                      If you look at your pfSense Firewall log do you have IGMP alerts (If so, create a Firewall rule to drop those packets until the Devs fix that issue)? If you filter port 25 in the Firewall log do they show ok?

                                      I can't reproduce this error on my boxes. Maybe try to clear the Firewall log and start with a Fresh Log and see if that fixes it? Report back how it goes. Can you filter other Settings in the Alerts Page? or is this issue limited to the "Dest Port" Filter field?

                                      Hi BBCan177,

                                      To answer your questions:

                                      • There are no IGMP alerts in the logs

                                      • In the firewall logs all shows up correctly / as expected when filtering for dest. port 25

                                      • oh dear, I was reading end executing your questions in order, so I cleared the firewall logs now which makes it pointless to filter for other settings now in the alerts

                                      I will let the logs fill a bit and I will test the filters again tomorrow.
                                      Btw, my log file size limit is at 20MB. Could the big size be causing issues?

                                      Many thanks for your help!

                                      One more question:
                                      To be able to see the country for firewall logs is a great feature. Would it be possible to add a check box to allow querying all rules in the alerts tab? Currently it is hard-coded to filter for "pfB_".
                                      I think it would be pretty cool to be able to see all logs listed with the country.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        jeffhammett
                                        last edited by Mar 26, 2015, 9:15 PM

                                        I have a couple questions regarding my setup of pfBlockerNG

                                        I setup pfBlockerNG to block inbound connections from nearly all countries and then set up some IPv4 lists (Emerging Threats, iBlocklist, etc.) in match inbound mode to monitor. I have the same/similar IPv4 lists setup to match and log outbound connections (preceded with OB in the name)

                                        I checked after 24 hours and had approximately 100 matches on the IPv4 lists. I then switched them to Deny inbound. After another 24 hours I checked and I have very few blocks on the IPv4 lists. I do have a lot of blocks on the country lists. Is it possible that there is overlap between the country blocks and IPv4 list blocks and so the block statistics are only counting a block per the country blocking and not the list?

                                        Also, the number of blocked connections I'm seeing on the pfBlockerNG widget don't match what is showing up in the alerts. I have the country blocking set to not log, but all others are set to log. Here is what I am seeing on the widget, and below that is what I am seeing on the pfBlockerNG alerts.

                                        Shouldn't I be seeing 8 blocked connections in the alert and 15 matched connections?

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          BBcan177 Moderator
                                          last edited by Mar 26, 2015, 9:26 PM Mar 26, 2015, 9:18 PM

                                          Hello ha11oga11o,

                                          There is an issue as you have all "-" in the Widget Packet Counts.

                                          Please reset all files with the following steps from the General Tab:

                                          1. Uncheck "Keep Settings"
                                          2. Disable "pfBlockerNG"
                                          3. Click "Save"

                                          After it completes, reverse the steps above. Then run a "Force Update" The widget Packet Counts should start with "0's".

                                          NOTE -  Please don't select Countries in the 'TOP' alias, and then select the same Countries in the other Continent Tabs.

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          569 out of 1196
                                          • First post
                                            569/1196
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.