• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG

Scheduled Pinned Locked Moved pfBlockerNG
1.2k Posts 211 Posters 1.9m Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • L
    LinuxTracker
    last edited by May 28, 2015, 2:09 AM

    My Alerts -> Auto-Resolve quit auto-resolving a bit back.
    It's a small thing among pfBlockerNG greatness, yet I miss it.

    IPs are still resolving in the Firewall logs when I click !. That seems a good sign.

    What I tried:
    I've reviewed pfBlockerNG settings and don't see anything amiss.
    I've tried adjusting interfaces and other options in the DNS resolver
    I've tried telling pfSense to only use the DNS servers listed in General
    I've reinstalled pfBlocker package.

    What I have:
    pfSense 2.2.2 x64 running on a Dell quad core Xeon w/ 4GB RAM
    Lots of lists in pfBlockerNG, some really large.
    Also running Snort, Squid3+Squidguard

    Any thoughts anyone?
    Appreciated.

    1 Reply Last reply Reply Quote 0
    • D
      digdug3
      last edited by May 28, 2015, 11:54 AM

      How long is your alert list?

      1 Reply Last reply Reply Quote 0
      • L
        LinuxTracker
        last edited by May 28, 2015, 12:02 PM

        @digdug3:

        How long is your alert list?

        Dang. You've hit on it.

        I had tried with different deny sizes - between 30 and 100 but I always left the Match at 30.
        After your reply I set match to 0 and deny to 30 and it works again.

        Thanks dude!

        1 Reply Last reply Reply Quote 0
        • B
          BBcan177 Moderator
          last edited by May 29, 2015, 3:41 AM May 28, 2015, 5:39 PM

          pfBlockerNG v1.09 Release Notes:

          • Several under-the-hood code changes.

          • Added a 'Cron Interval' setting in the 'General' Tab. Previously Cron would run each hour.

          • Added function to check if the Cron task has changed, and only update if required (reduce config backups)

          • The 'Update Tab' uses the new Cron Interval setting to show the Next Cron task and Time remaining.

          • Improved the logging to the pfblockerng.log (Reduce empty lines and some other tweaks)

          • The parsing of IPs on downloads has been adjusted to remove the '/32' CIDRs (and leave just the IP address).  Also parse for Ranges before parsing for CIDR or Single IP addresses.
            Next release will move away from a Regex Style function to a faster, more efficient string functions.

          • Input Validation has been added to the IPv4/6 Tabs. Unfortunately, if there is an error, it doesn't save the last inputted settings, and you will need to re-enter all of the input data.

          • GUI changes to combine like-fields together. ie - 'General' Tab, Inbound Ports options, and the Continent pages now have the IPv4/6 Tables side-by-side.

          • Added ability to move Aliases in the IPv4/6 Tabs. 'Click+hold' and move the Alias to any line position required.

          • Widget has been overhauled to make it more efficient. Added 'Wrench Icon' which will allow for some customization's.

          • Widget now allows pivoting from the Packet Count column to the Alerts Tab, and it will load the approproate filters to show the associated Alerts. Please note that if the the pfSense Firewall Log has been cleared, old Alerts will not show in the 'Alerts Tab'.

          Also added an 'Advanced' Inbound Firewall Rules Settings':

          This will allow you to create pfSense 'Port' and 'Destination' Aliases which can be used with the Auto-Rules created by pfBlockerNG.

          Since pfSense is a stateful firewall by design, a 'Deny Inbound' or 'Deny Both' will create an Inbound rule in the WAN Firewall Rules tab. Previously it will log Alerts for Packets that are already being blocked by the pfSense Default implicit Deny rule.

          This new feature will allow fine-tuning of the Inbound Rules to Alert only on the Open Ports that you have configured in these new settings. If you require a more complicated rule, please continue to use the 'Alias Type' Rules instead.

          Here is a screenshot, showing some Port and Destination Aliases.
          NOTE: Please DO NOT use "pfB_" or 'pfb_' in the start of the Alias name!!

          For the IP aliases, please use the "IP Network Type" alias.

          Screenshot showing the Adv. Inbound Settings using the pfSense Aliases created above:

          Screenshot showing the Auto-Created Firewall rules using the pfSense Aliases:

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • C
            cauthier
            last edited by Jun 2, 2015, 12:48 PM

            I have a local blocklist that I add to several times a day. It is stored in /var/db/pfblockerng/MyBlocklist.txt
            I have set it to update every hour, however, the cron job fails to update:

            **Remote timestamp: Mon, 01 Jun 2015 19:03:19 GMT
              Local  timestamp: Mon, 01 Jun 2015 19:03:19 GMT
              Remote file unchanged. Download Terminated

            No Updates required.
              CRON  PROCESS  ENDED
              UPDATE PROCESS ENDED**

            What am I missing? It is obviously comparing timestamps… I edited the original file this morning.
            Is it looking at a different file?

            Any help is appreciated

            Chris

            1 Reply Last reply Reply Quote 0
            • C
              cauthier
              last edited by Jun 2, 2015, 5:42 PM

              Problem solved by BBcan177 with a minor edit to the following file:

              /usr/local/www/pfblockerng/pfblockerng.php

              Line 192

              if (file_exists($local_file)) {
                    // Determine if URL is Remote or Local
                    if ($host['host'] == "127.0.0.1" || $host['host'] == $pfb['iplocal'] || empty($host['host'])) {
                      $remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));
                    } else {

              Original:
              $remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));

              NEW:
              $remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($list_url));

              Thanks!

              To be very clear, change the variable $local_file to $list_url

              1 Reply Last reply Reply Quote 0
              • P
                pfcode
                last edited by Jun 3, 2015, 4:50 AM Jun 3, 2015, 4:30 AM

                Hi,

                iptodomain.com (198.50.147.11) was blocked by the pfBlockerNG (ToastedSpam 198.50.128.0/17), so I clicked the Suppression Icon (+) from the Alerts tab, to add the IP to the pfBlockerNGSuppress Alias automatically(198.50.147.11/32, not manually),  the 'Enable Suppression' in the General tab is ticked, the rule order is 'pfSense Pass|pfB_Pass|pfB_Block', I did a force update, but pfBlockerNG still block it (the reason was the same: ToastedSpam 198.50.128.0/17), I checked all the setting, and found that nowhere in the pfBlobckerNG settings is using this Alias, other than the 'Enable Suppression' is ticked.  What am I missing?  Why I can't access the URL where its ip is in the pfBlockerNGSuppress alias?

                BTW, when doing an force update/force cron, I didn't see the pgBlockerNGSuppress shown in the Log View screen, also I made the change posted by cauthier on Page 47

                Release: pfSense 2.4.3(amd64)
                M/B: Supermicro A1SRi-2558F
                HDD: Intel X25-M 160G
                RAM: 2x8Gb Kingston ECC ValueRAM
                AP: Netgear R7000 (XWRT), Unifi AC Pro

                1 Reply Last reply Reply Quote 0
                • B
                  BBcan177 Moderator
                  last edited by Jun 3, 2015, 5:19 AM

                  Hi pfcode,

                  You cannot suppress an IP that is in a /17 CIDR… Suppression is only for IPs that are either /32 or /24... Hover-over the Suppression (+) icon, or the List column, and it will give you further instructions...

                  Basically, you will need to create a new alias ie : "Whitelist" and set the list to "Permit Outbound", then add any IPs that you want to allow outbound in the Custom Box at the bottom of the Alias.

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • P
                    power_matz
                    last edited by Jun 3, 2015, 10:47 AM

                    Hi,

                    after reading this thread I installed the current version yetserday on my 2.2 system.
                    After doing some config everything was doing fine.

                    I just was wondering that the CPU is all the time at 50% or above. Reduction of the frequency is not happening like before.
                    On the machine SNORT is / was running and the CPU was at 300 MHz most of the time, now the CPU ist at least at 1000MHz.
                    Any idea what is so consuming?

                    After running over night this morning the pfsense box wasn't reachable any more. Wether via GUI nor via ssh terminal.
                    I had to reboot / switch off and on again.

                    The box was running very stable since months.

                    Any idea? Are there some known issues? Are any logs required? I don't know if there were written.

                    Matthias

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by Jun 3, 2015, 10:51 AM

                      Certainly not pfBlockerNG. Beyond the cron jobs running every X hours, this only creates aliases and firewall rules.

                      Check the CPU usage with something like top and start your own thread in proper forum section.

                      1 Reply Last reply Reply Quote 0
                      • T
                        tim.mcmanus
                        last edited by Jun 6, 2015, 3:39 AM

                        I'm too lazy to look through 48 pages of discussion to find the link where I can donate to the developer's beer fund for this project?

                        I want to give back to the coders in the form of foamy suds where I can.

                        1 Reply Last reply Reply Quote 0
                        • R
                          rodymcamp
                          last edited by Jun 7, 2015, 7:53 AM

                          I had this Happen when i first started adding block lists, I have just upgraded my pfsense over time from way back and there was some temp memory issue that was filling up and causing a crash, I did a clean install and now Everything works great. I really did not get to much into it, I had been wanting to do a clean install for a while and this was just a good excuse.

                          @power_matz:

                          Hi,

                          after reading this thread I installed the current version yetserday on my 2.2 system.
                          After doing some config everything was doing fine.

                          I just was wondering that the CPU is all the time at 50% or above. Reduction of the frequency is not happening like before.
                          On the machine SNORT is / was running and the CPU was at 300 MHz most of the time, now the CPU ist at least at 1000MHz.
                          Any idea what is so consuming?

                          After running over night this morning the pfsense box wasn't reachable any more. Wether via GUI nor via ssh terminal.
                          I had to reboot / switch off and on again.

                          The box was running very stable since months.

                          Any idea? Are there some known issues? Are any logs required? I don't know if there were written.

                          Matthias

                          1 Reply Last reply Reply Quote 0
                          • P
                            power_matz
                            last edited by Jun 9, 2015, 2:41 PM

                            Thanks for the information. After a restart the system now runs like before.
                            Maybe its a good thing to restart after adding all the rules.

                            Matthias

                            1 Reply Last reply Reply Quote 0
                            • L
                              LinuxTracker
                              last edited by Jun 11, 2015, 3:27 AM

                              @tim.mcmanus:

                              I'm too lazy to look through 48 pages of discussion to find the link where I can donate to the developer's beer fund for this project?

                              I want to give back to the coders in the form of foamy suds where I can.

                              I just went though the same thing.
                              I have a 2nd issue that I waned to donate w/o logging into Paypal.

                              Short answer is I put this url in my browser and successfully donated my pittance.

                              https://paypal.com/xclick/business=BBCan177@gmail.com
                              

                              (email addres is one from the pfBlockerNG->General tab)

                              1 Reply Last reply Reply Quote 0
                              • M
                                Mr. Jingles
                                last edited by Jun 21, 2015, 9:05 AM

                                Hi BB  :-*

                                1. The errors we were emailing about appear gone now (?). I had two lists disabled for a week, enabled them yesterday and I think I don't see any errors anymore ( ??? ).
                                2. I have this weird thing with the dashboard widget: if I add it, it shows up twice. If I remove one of them (the x in the right corner) both are gone. I've attached a screenshot. Latest pfBlockerNG 1.0.9, pfSense 2.2.1.

                                Would you have any idea?

                                Bye  ;D

                                pfblockerNG_double_widget.jpg
                                pfblockerNG_double_widget.jpg_thumb

                                6 and a half billion people know that they are stupid, agressive, lower life forms.

                                1 Reply Last reply Reply Quote 0
                                • C
                                  cyberbot
                                  last edited by Jun 23, 2015, 7:22 PM

                                  after reading this thread . i've installed the latest version on 2.2.2 pfsense 64 bit
                                  after i enable the the pfblockerng the internet stops working.
                                  i am in europe and deny both inbound and outbond of other countries. but somehow after i enable the package my internet stops working. but i can vpn to the box.
                                  any suggestions what i am doing wrong ?

                                  1 Reply Last reply Reply Quote 0
                                  • L
                                    LinuxTracker
                                    last edited by Jun 23, 2015, 9:15 PM

                                    @cyberbot:

                                    after i enable the the pfblockerng the internet stops working.
                                    i am in europe and deny both inbound and outbond of other countries. but somehow after i enable the package my internet stops working. but i can vpn to the box.
                                    any suggestions what i am doing wrong ?

                                    When the Internet stops working, can you ping domains? Can you ping external IPs?

                                    Can you give a screenshot of your LAN rules?

                                    Also make sure your country isn't one in the Top 20 countries tab.

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      tim.mcmanus
                                      last edited by Jun 26, 2015, 12:50 AM

                                      Is this package 2.2.3-friendly?  I upgrade to 2.2.3 and assume I need to reinstall the package because the widget puked code all over the Dashboard.

                                      ![Screen Shot 2015-06-25 at 8.48.24 PM.png](/public/imported_attachments/1/Screen Shot 2015-06-25 at 8.48.24 PM.png)
                                      ![Screen Shot 2015-06-25 at 8.48.24 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-06-25 at 8.48.24 PM.png_thumb)

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        phil.davis
                                        last edited by Jun 26, 2015, 2:13 AM

                                        That should only happen if you login to the dashboard while packages are reinstalling in the (minutes…) after the upgrade reboot.
                                        Once all packages have installed themselves then those files will exist. A refresh of the dashboard should clear it.

                                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          tim.mcmanus
                                          last edited by Jun 26, 2015, 2:25 AM

                                          @phil.davis:

                                          That should only happen if you login to the dashboard while packages are reinstalling in the (minutes…) after the upgrade reboot.
                                          Once all packages have installed themselves then those files will exist. A refresh of the dashboard should clear it.

                                          It's still angry.  Rebooted the firewall too because of another unrelated upgrade issue.  I'll reinstall and that more than likely should fix it.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received