Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 210 Posters 1.8m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      phil.davis
      last edited by

      That should only happen if you login to the dashboard while packages are reinstalling in the (minutes…) after the upgrade reboot.
      Once all packages have installed themselves then those files will exist. A refresh of the dashboard should clear it.

      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

      1 Reply Last reply Reply Quote 0
      • T
        tim.mcmanus
        last edited by

        @phil.davis:

        That should only happen if you login to the dashboard while packages are reinstalling in the (minutes…) after the upgrade reboot.
        Once all packages have installed themselves then those files will exist. A refresh of the dashboard should clear it.

        It's still angry.  Rebooted the firewall too because of another unrelated upgrade issue.  I'll reinstall and that more than likely should fix it.

        1 Reply Last reply Reply Quote 0
        • L
          LinuxTracker
          last edited by

          @tim.mcmanus:

          Is this package 2.2.3-friendly?  I upgrade to 2.2.3 and assume I need to reinstall the package because the widget puked code all over the Dashboard.

          I did one so far and pfBNG widget is intact.  You aren't working with BBCan177's pfBNG beta, are you?

          1 Reply Last reply Reply Quote 0
          • T
            tim.mcmanus
            last edited by

            @LinuxTracker:

            @tim.mcmanus:

            Is this package 2.2.3-friendly?  I upgrade to 2.2.3 and assume I need to reinstall the package because the widget puked code all over the Dashboard.

            I did one so far and pfBNG widget is intact.  You aren't working with BBCan177's pfBNG beta, are you?

            Yes, I am working with the beta.  My upgrade had one unrelated issue, so this could possibly be an artifact of a less-than-perfect upgrade on my end.

            1 Reply Last reply Reply Quote 0
            • M
              meruem
              last edited by

              when using "Alias Deny", the "Alerts" tab doesn't show any block logs like I think it would.

              The log seems weird.. it grows and shrinks with each update… shouldnt it just be one long list with the max rows setting? It also says this at the bottom "Found 11 Alert Entries - Insufficient Firewall Alerts found."

              The firewall log seems like it's working against the block list correctly using the alias I set up, but it is not as good because it doesnt give me any indication of in the firewall log that the block was because of the alias

              1 Reply Last reply Reply Quote 0
              • L
                LinuxTracker
                last edited by

                @tim.mcmanus:

                Yes, I am working with the beta.  My upgrade had one unrelated issue, so this could possibly be an artifact of a less-than-perfect upgrade on my end.

                Last night, I ran into the same problem with the beta of pfBNG.
                As pfSense went through it's post-upgrade package re-installations, it uninstalled pfBNG-beta but couldn't reinstall it with the package settings set to default.

                In this case I put the regular pfBNG package back in for now and my widget is behaving.

                1 Reply Last reply Reply Quote 0
                • L
                  LinuxTracker
                  last edited by

                  @meruem:

                  The log seems weird.. it grows and shrinks with each update… shouldnt it just be one long list with the max rows setting?

                  I'm not clear what you mean.
                  I think, the Alerts tab pulls it's data from Status: System logs: Firewall, because clearing the Firewall Log clears the Alerts tab.
                  Do you see any correlation between the weirdness in the Alerts tab and data displayed in Status: System logs: Firewall?

                  @meruem:

                  It also says this at the bottom "Found 11 Alert Entries - Insufficient Firewall Alerts found."

                  You'll get that if the number of displayed entries is less than the value in the Alert Settings

                  @meruem:

                  The firewall log seems like it's working against the block list correctly using the alias I set up, but it is not as good because it doesnt give me any indication of in the firewall log that the block was because of the alias

                  I often have discrepancies in the Alerts tab where I have an incorrect value in the List column - that is - the displayed list isn't in the IPv4 Alias that's noted in the Rule column (it's in a different IPv4 Alias).

                  Sometimes setting/unsetting deduplication->cron update sets that right.
                  Other time deleting the associated Firewall Rule and recreating fixes it for a while.

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @meruem,

                    Did you click the checkbox in the firewall rule to enable "logging"?

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • M
                      meruem
                      last edited by

                      Thanks for the replies. I guess my issue was that, I was seeing a ton of firewall block entries in the firewall logs and I couldnt tell if they were from the pfBlockerNG Alias or the regular firewall. I found http://i.imgur.com/gdRMDRK.png "Filter Descriptions" and i set it to "Display as Column". So now when I look at the firewall logs, it tells me if it's from the pfBlockerNG alias or "Default deny rule IPv4" (for example).

                      after clearing the logs .. the alerts tab seems to be working now, with these settings http://i.imgur.com/mOmPLLc.png

                      1 Reply Last reply Reply Quote 0
                      • W
                        wcrowder
                        last edited by

                        @tim.mcmanus:

                        @LinuxTracker:

                        @tim.mcmanus:

                        Is this package 2.2.3-friendly?  I upgrade to 2.2.3 and assume I need to reinstall the package because the widget puked code all over the Dashboard.

                        I did one so far and pfBNG widget is intact.  You aren't working with BBCan177's pfBNG beta, are you?

                        Yes, I am working with the beta.  My upgrade had one unrelated issue, so this could possibly be an artifact of a less-than-perfect upgrade on my end.

                        I am also, if you are working with beta's you must expect this occasionally. Usually I do a "Forced Reload" after every update. If that doesn't work out correctly. I simply turn off pfBlockerNG_Dev clicking of the "Enable/Disable" and "Keep Settings" check boxes. Wait a few minutes, turn them back on, and then simply "Force Reload". Fixes 100% of the problems… :)

                        1 Reply Last reply Reply Quote 0
                        • ?
                          A Former User
                          last edited by

                          I have a couple questions:

                          Can PFBlockerNG work with lists in p2p.gz format? I didn't see it listed in the IPv4/IPv6 tabs.

                          Also can PFBlockerNG use snort lists for IP blocking?

                          Thanks.

                          1 Reply Last reply Reply Quote 0
                          • C
                            cyberbot
                            last edited by

                            Thank you for the package much appreciate it .
                            after applying the settings on the pfBlockerNG my internet stops working,
                            i've followed this video for the setup but after i enable pfBlockerNG the internet stops working

                            https://www.youtube.com/watch?v=vgM5JRo575U
                            
                            1 Reply Last reply Reply Quote 0
                            • M
                              Mr. Jingles
                              last edited by

                              @cyberbot:

                              Thank you for the package much appreciate it .
                              after applying the settings on the pfBlockerNG my internet stops working,
                              i've followed this video for the setup but after i enable pfBlockerNG the internet stops working

                              https://www.youtube.com/watch?v=vgM5JRo575U
                              

                              I scrolled through that vid but, and sorry to sound like I do ( ;D ) but that is the usual useless non-tuto, of which you can find a zillion; they never even show it works. They'd better of going out walking the dog than wasting their - and all the other populants of this earth - time.

                              That aside: do you have any floating rules generated in the firewall? What do your firewall logs show you?

                              Your much better of reading this (yes, long, I know  :-[ ) thread, where BB has added tons of information.

                              If you don't want to waste so much time reading this thread, remember this: BB wasted his time answering in this thread  ;D

                              6 and a half billion people know that they are stupid, agressive, lower life forms.

                              1 Reply Last reply Reply Quote 0
                              • M
                                Mr. Jingles
                                last edited by

                                **To all, just a kind informational note:

                                rumor has it BB is currently quite busy with extremely important stuff, so expect some delays in him answering here.**

                                6 and a half billion people know that they are stupid, agressive, lower life forms.

                                1 Reply Last reply Reply Quote 0
                                • J
                                  Jamerson
                                  last edited by

                                  i am having the same issue can't get the internet working after the pfblockerNG is enabled.
                                  Firewall rules from the LAN are allowed to everything,
                                  from the WAN is as usually allowing the OPENVPN.

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    cyberbot
                                    last edited by

                                    @Mr.:

                                    @cyberbot:

                                    Thank you for the package much appreciate it .
                                    after applying the settings on the pfBlockerNG my internet stops working,
                                    i've followed this video for the setup but after i enable pfBlockerNG the internet stops working

                                    https://www.youtube.com/watch?v=vgM5JRo575U
                                    

                                    I scrolled through that vid but, and sorry to sound like I do ( ;D ) but that is the usual useless non-tuto, of which you can find a zillion; they never even show it works. They'd better of going out walking the dog than wasting their - and all the other populants of this earth - time.

                                    That aside: do you have any floating rules generated in the firewall? What do your firewall logs show you?

                                    Your much better of reading this (yes, long, I know  :-[ ) thread, where BB has added tons of information.

                                    If you don't want to waste so much time reading this thread, remember this: BB wasted his time answering in this thread  ;D
                                    [/quote]

                                    thank you for your answer.
                                    there is no particular firewall rules to block the internet. everything works fine untill the pfblocker is activated and stops things working.

                                    1 Reply Last reply Reply Quote 0
                                    • F
                                      f34rinc
                                      last edited by

                                      @shadowset:

                                      I have a couple questions:

                                      Can PFBlockerNG work with lists in p2p.gz format? I didn't see it listed in the IPv4/IPv6 tabs.

                                      Also can PFBlockerNG use snort lists for IP blocking?

                                      Thanks.

                                      Can you link me to the .gz list in question?

                                      Yes pfBlockerNG can use snort's IP lists

                                      @Jamerson:

                                      i am having the same issue can't get the internet working after the pfblockerNG is enabled.
                                      Firewall rules from the LAN are allowed to everything,
                                      from the WAN is as usually allowing the OPENVPN.

                                      Do you have OpenVPN Interface selected from the General tab in pfBlockerNG ?

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        Jamerson
                                        last edited by

                                        @f34rinc:

                                        @shadowset:

                                        I have a couple questions:

                                        Can PFBlockerNG work with lists in p2p.gz format? I didn't see it listed in the IPv4/IPv6 tabs.

                                        Also can PFBlockerNG use snort lists for IP blocking?

                                        Thanks.

                                        Can you link me to the .gz list in question?

                                        Yes pfBlockerNG can use snort's IP lists

                                        @Jamerson:

                                        i am having the same issue can't get the internet working after the pfblockerNG is enabled.
                                        Firewall rules from the LAN are allowed to everything,
                                        from the WAN is as usually allowing the OPENVPN.

                                        Do you have OpenVPN Interface selected from the General tab in pfBlockerNG ?

                                        no i don't have openvpn interface selected
                                        on the Interface/Rules Configuration
                                        i have inbound firewall rules and outbound firewall rules.
                                        inbound = WAN  Action Block
                                        outbound = LAN Action  Reject

                                        Thank you

                                        1 Reply Last reply Reply Quote 0
                                        • F
                                          f34rinc
                                          last edited by

                                          Did that fix your problem Jamerson?

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            thehasty
                                            last edited by

                                            pfBlockerNG  Firewall  1.09
                                            2.2.3-RELEASE  (amd64)
                                            FreeBSD 10.1-RELEASE-p13

                                            Hello,

                                            I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

                                            My alias smtp_ports has the value "25, 465, 587" and I see Alerts like this:
                                            Jul 12 05:27:36 WAN pfB_DShield
                                            (96) TCP-S Icon Reverse Resolve with DNS  94.102.52.27:49717 my_server_ip_here:902 NL dshield

                                            Obviously port 902 is not within my alias parameters, so I am thinking something is wrong here. Either it is truly blocking all ports from the IPs on the lists and ignoring my specified ports, or it is just showing false alerts.

                                            Please advise.

                                            Thank you!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.