Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 210 Posters 1.8m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jamerson
      last edited by

      @f34rinc:

      @shadowset:

      I have a couple questions:

      Can PFBlockerNG work with lists in p2p.gz format? I didn't see it listed in the IPv4/IPv6 tabs.

      Also can PFBlockerNG use snort lists for IP blocking?

      Thanks.

      Can you link me to the .gz list in question?

      Yes pfBlockerNG can use snort's IP lists

      @Jamerson:

      i am having the same issue can't get the internet working after the pfblockerNG is enabled.
      Firewall rules from the LAN are allowed to everything,
      from the WAN is as usually allowing the OPENVPN.

      Do you have OpenVPN Interface selected from the General tab in pfBlockerNG ?

      no i don't have openvpn interface selected
      on the Interface/Rules Configuration
      i have inbound firewall rules and outbound firewall rules.
      inbound = WAN  Action Block
      outbound = LAN Action  Reject

      Thank you

      1 Reply Last reply Reply Quote 0
      • F
        f34rinc
        last edited by

        Did that fix your problem Jamerson?

        1 Reply Last reply Reply Quote 0
        • T
          thehasty
          last edited by

          pfBlockerNG  Firewall  1.09
          2.2.3-RELEASE  (amd64)
          FreeBSD 10.1-RELEASE-p13

          Hello,

          I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

          My alias smtp_ports has the value "25, 465, 587" and I see Alerts like this:
          Jul 12 05:27:36 WAN pfB_DShield
          (96) TCP-S Icon Reverse Resolve with DNS  94.102.52.27:49717 my_server_ip_here:902 NL dshield

          Obviously port 902 is not within my alias parameters, so I am thinking something is wrong here. Either it is truly blocking all ports from the IPs on the lists and ignoring my specified ports, or it is just showing false alerts.

          Please advise.

          Thank you!

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @thehasty:

            I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

            When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • T
              thehasty
              last edited by

              @BBcan177:

              When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.

              Thank you, I've set custom protocol to tcp/ip for all of my ipv6 lists and top25. Seems odd to me that is a requirement.

              Thanks again! I will report back if I encounter any other issues.

              1 Reply Last reply Reply Quote 0
              • C
                cyberbot
                last edited by

                @f34rinc:

                Did that fix your problem Jamerson?

                no still waiting for some answers,
                whenever i activate the pfBlockerNG the internet stops working.

                1 Reply Last reply Reply Quote 0
                • F
                  fragged
                  last edited by

                  @cyberbot:

                  @f34rinc:

                  Did that fix your problem Jamerson?

                  no still waiting for some answers,
                  whenever i activate the pfBlockerNG the internet stops working.

                  We need to see rules.debug or a screenshot of the rules created to give you any information.

                  1 Reply Last reply Reply Quote 0
                  • T
                    taryezveb
                    last edited by

                    Just wanted to add, also having issues with pfBlockerNG, but only after a reboot. Which just noticed, because the UPS needs new batteries. Power here is terrible and has gone out several times. Each time after pfSense reboots can not connect to the internet and sometimes even to pfSense.

                    Guessing this a new issue, since did not notice this before. Either with the recent change to pfSense made with the 2.2.3 update or with the pfBlockerNG 1.09 update. Both happened about the same time. Before those updates everything worked fine, but had not rebooted since the 2.2.2 update. So it is possible that is not the cause.

                    After connecting to pfSense and unchecking the Enable/Disable checkbox[to disable] and then saving; internet comes back up. After that checking the Enable/Disbable checkbox[to enable] and then saving. And forcing an update, cron and reload; pfBlockerNG works fine after that.

                    Note, if it matters: the few times I remembered to ping a site[7) Ping host], did not get any packet loss. Before doing the above. Also the Floating Rules are present before doing the above.

                    Using the defaults for many of the options and just have a few IPV4 lists. Nothing shows in the logs that would be helpful.

                    Thanks

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      Hi cyberbot/taryezveb,

                      Are you running a Nano version/Ramdisk or a full installation of pfSense?

                      On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?

                      After pfSense Boots, does the widget show entries in the packet column? or is it all blank?

                      When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?

                      Run the following commands when there are issues, and report back with the output.

                      /sbin/pfctl -vvsTables | grep -A4 'pfB_'
                          ls -lah /var/db/aliastables/*

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • D
                        dzeanah
                        last edited by

                        Is it appropriate to offer a bounty here?

                        I'd like to pledge $100 to add the following feature: block TOR exit nodes.  I personally like TOR, but my forum is getting attacks  from the TOR network that average more than one every eight seconds.  Right now I'm going to the following URL and manually updating the list of nodes that can access my site as a custom list:

                        https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=[my server's IP address]&port=

                        I'd love to be able to simply check TOR the way I can flag a country within pfBlockerNG to deal with the problem instead.

                        1 Reply Last reply Reply Quote 0
                        • M
                          Mr. Jingles
                          last edited by

                          @Derek:

                          Is it appropriate to offer a bounty here?

                          I'd like to pledge $100 to add the following feature: block TOR exit nodes.  I personally like TOR, but my forum is getting attacks  from the TOR network that average more than one every eight seconds.  Right now I'm going to the following URL and manually updating the list of nodes that can access my site as a custom list:

                          https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=[my server's IP address]&port=

                          I'd love to be able to simply check TOR the way I can flag a country within pfBlockerNG to deal with the problem instead.

                          It's always appropriate to throw beer or coffee to BB  ;D

                          If you are in a hurry, I noticed, for me Snort/Suricata are also blocking TOR nodes. So you could perhaps use that until (and if) BB finds time to fulfill your request.

                          6 and a half billion people know that they are stupid, agressive, lower life forms.

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            There are three IP lists that contain 'Tor Exit Nodes' that can be used in pfBNG without any code changes :

                            (gz)    http://list.iblocklist.com/?list=togdoptykrlolpddwbvz&fileformat=p2p&archiveformat=gz
                            (txt)    https://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv
                            (html)  https://rules.emergingthreats.net/open/suricata/rules/tor.rules

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • D
                              dzeanah
                              last edited by

                              Thanks for that BB.  I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages.  I'll tinker a bit more.

                              1 Reply Last reply Reply Quote 0
                              • T
                                taryezveb
                                last edited by

                                @BBcan177:

                                Hi cyberbot/taryezveb,

                                Are you running a Nano version/Ramdisk or a full installation of pfSense?

                                Full install here.

                                @BBcan177:

                                On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?

                                None that can recall. pfSense boots normally, will verify again tho. Once the new monitor arrives, since the previous one failed and do not have any at the moment. Not much luck with hardware lately :)

                                @BBcan177:

                                After pfSense Boots, does the widget show entries in the packet column? or is it all blank?

                                It is all blank, will verify again tho.

                                @BBcan177:

                                When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?

                                Will report back on this, did not think to try that.

                                @BBcan177:

                                Run the following commands when there are issues, and report back with the output.

                                /sbin/pfctl -vvsTables | grep -A4 'pfB_'
                                    ls -lah /var/db/aliastables/*

                                Will do. Not sure when I can report back, whether forced by power outage or just by rebooting. Need to find the right time to do this, if not forced too. Some people here complain when they can not connect to the internet; I'd rather avoid that if possible ;)

                                Also having another issue with an alias, that fails to load. Do not think this is the cause of or related to the reboot issue. Since pfBlockerNG keeps on working regardless after it is restarted as explained before. Can supply some details of that now or would it be better to deal with one issue at a time?

                                Thank You

                                1 Reply Last reply Reply Quote 0
                                • F
                                  fragged
                                  last edited by

                                  @Derek:

                                  Thanks for that BB.  I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages.  I'll tinker a bit more.

                                  For this particular list I ended up setting a cron job on one of my RaspberryPi's to fetch the list on schedule and then fetch it from the Pi to pfBlockerNG.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    taryezveb
                                    last edited by

                                    BBcan177,

                                    A reboot was forced on me; power went out again :) So can answer some of your questions:

                                    @BBcan177:

                                    On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?

                                    Can not answer this for sure, still have no monitor. Like said before do not recall any such issue.

                                    @BBcan177:

                                    After pfSense Boots, does the widget show entries in the packet column? or is it all blank?

                                    Can verify, all blank.

                                    @BBcan177:

                                    When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?

                                    All blank as well.

                                    @BBcan177:

                                    Run the following commands when there are issues, and report back with the output.

                                    /sbin/pfctl -vvsTables | grep -A4 'pfB_'
                                        ls -lah /var/db/aliastables/*

                                    Here is the output of both commands, before restarting pfBlockerNG:

                                    # /sbin/pfctl -vvsTables | grep -A4 'pfB_'
                                    #
                                    # ls -lah /var/db/aliastables/*
                                    -rw-r--r--  1 root  wheel   3.4K Jul 16 11:00 /var/db/aliastables/pfB_BC.txt
                                    -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_BC.txt.tmp
                                    -rw-r--r--  1 root  wheel   6.6M Jul 16 11:00 /var/db/aliastables/pfB_Bluetack.txt
                                    -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_Bluetack.txt.tmp
                                    -rw-r--r--  1 root  wheel    12M Jul 16 11:00 /var/db/aliastables/pfB_TBG.txt
                                    -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_TBG.txt.tmp
                                    
                                    

                                    Here is the output of both commands, after restarting pfBlockerNG:

                                    # /sbin/pfctl -vvsTables | grep -A4 'pfB_'
                                    -pa---- pfB_BC
                                            Addresses:   102
                                            Cleared:     Thu Jul 16 11:03:42 2015
                                            References:  [ Anchors: 0                  Rules: 0                  ]
                                            Evaluations: [ NoMatch: 0                  Match: 0                  ]
                                    --
                                    -pa---- pfB_Bluetack
                                            Addresses:   423729
                                            Cleared:     Thu Jul 16 11:03:39 2015
                                            References:  [ Anchors: 0                  Rules: 0                  ]
                                            Evaluations: [ NoMatch: 0                  Match: 0                  ]
                                    
                                    # ls -lah /var/db/aliastables/*
                                    -rw-r--r--  1 root  wheel   3.4K Jul 16 11:03 /var/db/aliastables/pfB_BC.txt
                                    -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_BC.txt.tmp
                                    -rw-r--r--  1 root  wheel   6.6M Jul 16 11:03 /var/db/aliastables/pfB_Bluetack.txt
                                    -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_Bluetack.txt.tmp
                                    -rw-r--r--  1 root  wheel    12M Jul 16 11:03 /var/db/aliastables/pfB_TBG.txt
                                    -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_TBG.txt.tmp
                                    
                                    

                                    As you can tell from the above, the pfB_TBG alias does not get loaded. The widget shows no entries for pfB_TBG alias or when hovering over the floating firewall rule for it. In the /var/log/pfblockerng/pfblockerng.log, shows the pfB_TBG alias fails to load:

                                    Updating: pfB_TBG
                                    no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0
                                    

                                    And here is the full output after restarting pfBlockerNG, forcing an update, cron and reload:

                                    
                                    **Saving Configuration [ 07/16/15 11:01:57 ] ...
                                    
                                    **Saving Configuration [ 07/16/15 11:02:07 ] ...
                                     UPDATE PROCESS START [ 07/16/15 11:02:20 ]
                                    
                                    [ level1 ]		 exists, Reloading File 
                                    [ level2 ]		 exists, Reloading File 
                                    [ level3 ]		 exists, Reloading File 
                                    [ ads ]			 exists, Reloading File 
                                    [ spyware ]		 exists, Reloading File 
                                    [ badpeers ]		 exists, Reloading File 
                                    [ hijacked ]		 exists, Reloading File 
                                    [ dshield ]		 exists, Reloading File 
                                    [ bogon ]		 exists, Reloading File 
                                    [ Primary_Threats ]	 exists, Reloading File 
                                    [ Hijacked ]		 exists, Reloading File 
                                    [ Bogon ]		 exists, Reloading File 
                                    [ General_Corporate_Ranges ] exists, Reloading File 
                                    [ Business_ISPs ]	 exists, Reloading File 
                                    [ Search_Engines ]	 exists, Reloading File 
                                    [ c2_IP_Feed ]		 exists, Reloading File 
                                    [ c2_All_Indicator_Feed ] exists, Reloading File 
                                    
                                    ===[  Aliastables / Rules  ]================================
                                    
                                    No Changes to Firewall Rules, Skipping Filter Reload
                                    No Changes to Aliases, Skipping pfctl Update
                                    
                                     UPDATE PROCESS ENDED [ 07/16/15 11:02:22 ]
                                     CRON  PROCESS  START [ 07/16/15 11:02:30 ]
                                    
                                      No Updates required.
                                     CRON  PROCESS  ENDED
                                     UPDATE PROCESS ENDED
                                     UPDATE PROCESS START [ 07/16/15 11:02:41 ]
                                    
                                    [ level1 ]		 Using Previously Downloaded File 
                                    [ level2 ]		 Using Previously Downloaded File [ 07/16/15 11:02:53 ]
                                    [ level3 ]		 Using Previously Downloaded File [ 07/16/15 11:02:57 ]
                                    [ ads ]			 Using Previously Downloaded File [ 07/16/15 11:02:58 ]
                                    [ spyware ]		 Using Previously Downloaded File [ 07/16/15 11:02:59 ]
                                    [ badpeers ]		 Using Previously Downloaded File 
                                    [ hijacked ]		 Using Previously Downloaded File [ 07/16/15 11:03:00 ]
                                    [ dshield ]		 Using Previously Downloaded File 
                                    [ bogon ]		 Using Previously Downloaded File 
                                    [ Primary_Threats ]	 Using Previously Downloaded File 
                                    [ Hijacked ]		 Using Previously Downloaded File [ 07/16/15 11:03:17 ]
                                    [ Bogon ]		 Using Previously Downloaded File 
                                    [ General_Corporate_Ranges ] Using Previously Downloaded File 
                                    [ Business_ISPs ]	 Using Previously Downloaded File [ 07/16/15 11:03:28 ]
                                    [ Search_Engines ]	 Using Previously Downloaded File [ 07/16/15 11:03:34 ]
                                    [ c2_IP_Feed ]		 Using Previously Downloaded File [ 07/16/15 11:03:35 ]
                                    [ c2_All_Indicator_Feed ] Using Previously Downloaded File 
                                    
                                    ===[  Aliastables / Rules  ]================================
                                    
                                    No Changes to Firewall Rules, Skipping Filter Reload
                                    
                                     Updating: pfB_Bluetack
                                    1 table created.423729 addresses added.
                                     Updating: pfB_TBG
                                    no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0
                                     Updating: pfB_BC
                                    1 table created.102 addresses added.
                                    
                                    ===[ FINAL Processing ]=============================================
                                    
                                       [ Original count   ]  [ 1173166 ]
                                    
                                    ===[ Deny List IP Counts ]===========================
                                    
                                     1173167 total
                                      375147 /var/db/pfblockerng/deny/Primary_Threats.txt
                                      257969 /var/db/pfblockerng/deny/level1.txt
                                      217513 /var/db/pfblockerng/deny/General_Corporate_Ranges.txt
                                      145954 /var/db/pfblockerng/deny/Business_ISPs.txt
                                       89452 /var/db/pfblockerng/deny/level2.txt
                                       48844 /var/db/pfblockerng/deny/badpeers.txt
                                       19891 /var/db/pfblockerng/deny/level3.txt
                                        5575 /var/db/pfblockerng/deny/Bogon.txt
                                        3654 /var/db/pfblockerng/deny/spyware.txt
                                        3341 /var/db/pfblockerng/deny/ads.txt
                                        2731 /var/db/pfblockerng/deny/bogon.txt
                                        1668 /var/db/pfblockerng/deny/Search_Engines.txt
                                         604 /var/db/pfblockerng/deny/Hijacked.txt
                                         536 /var/db/pfblockerng/deny/hijacked.txt
                                         151 /var/db/pfblockerng/deny/c2_All_Indicator_Feed.txt
                                          97 /var/db/pfblockerng/deny/c2_IP_Feed.txt
                                          40 /var/db/pfblockerng/deny/dshield.txt
                                    
                                    ====================[ Last Updated List Summary ]==============
                                    
                                    Jul 15	07:20	spyware.gz
                                    Jul 15	07:20	ads.gz
                                    Jul 15	07:20	badpeers.gz
                                    Jul 15	07:22	Primary_Threats.gz
                                    Jul 15	07:30	dshield.gz
                                    Jul 15	07:36	Hijacked.gz
                                    Jul 15	07:50	hijacked.gz
                                    Jul 15	07:51	bogon.gz
                                    Jul 15	07:51	General_Corporate_Ranges.gz
                                    Jul 15	07:51	level2.gz
                                    Jul 15	07:51	level3.gz
                                    Jul 15	07:51	Business_ISPs.gz
                                    Jul 15	09:00	Bogon.gz
                                    Jul 15	09:01	Search_Engines.gz
                                    Jul 15	12:01	level1.gz
                                    Jul 15	23:56	c2_IP_Feed.raw
                                    Jul 15	23:56	c2_All_Indicator_Feed.raw
                                    Jul 16	11:02	level1
                                    Jul 16	11:02	level2
                                    Jul 16	11:02	level3
                                    Jul 16	11:02	spyware
                                    Jul 16	11:02	ads
                                    Jul 16	11:03	hijacked
                                    Jul 16	11:03	dshield
                                    Jul 16	11:03	bogon
                                    Jul 16	11:03	badpeers
                                    Jul 16	11:03	Primary_Threats
                                    Jul 16	11:03	Hijacked
                                    Jul 16	11:03	Bogon
                                    Jul 16	11:03	General_Corporate_Ranges
                                    Jul 16	11:03	Search_Engines
                                    Jul 16	11:03	Business_ISPs
                                    Jul 16	11:03	c2_IP_Feed
                                    Jul 16	11:03	c2_All_Indicator_Feed
                                    ===============================================================
                                    
                                    IPv4 Alias Table IP Total
                                    -----------------------------
                                    1173167
                                    
                                    IPv6 Alias Table IP Total
                                    -----------------------------
                                    0
                                    
                                    Alias Table IP Counts
                                    -----------------------------
                                     1173167 total
                                      746461 /var/db/aliastables/pfB_TBG.txt
                                      426458 /var/db/aliastables/pfB_Bluetack.txt
                                         248 /var/db/aliastables/pfB_BC.txt
                                    
                                    pfSense Table Stats
                                    -------------------
                                    table-entries hard limit  5000000
                                    Table Usage Count        427593
                                    
                                     UPDATE PROCESS ENDED [ 07/16/15 11:03:43 ]
                                    
                                    

                                    Hope this helps and Thank You.

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      @taryezveb:

                                      Updating: pfB_TBG
                                      no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0

                                      Hi taryezveb,

                                      What lists are in this pfB_TBG alias? Can you send me the full URLs that are part of this Alias? It seems that the IP parser failed to convert one line as it is showing  "no IP address found for /31" and pfctl is failing. IBlock lists are renowned for adding strange IPs and once i review the list, I can patch this up.

                                      It would be good if FreeBSD pfctl had some error checking ability. As any error in the alias file can cause the whole packet fence to fail.

                                      If you see this issue again, please copy the    /var/db/aliastables/pfB_TBG.txt  file and forward to my email address which is in the General Tab of pfBNG.  I would need to see the file before you perform a Reload.

                                      Thanks!

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        @fragged:

                                        @Derek:

                                        Thanks for that BB.  I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages.  I'll tinker a bit more.

                                        For this particular list I ended up setting a cron job on one of my RaspberryPi's to fetch the list on schedule and then fetch it from the Pi to pfBlockerNG.

                                        Its strange that you guys are seeing errors in downloading this list from www.dan.me.uk?

                                        If you load that URL in a browser does it fail to download also? Did you try http instead? I use this list in several other boxes and have not seen anyone else complain about that list.

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          n3by
                                          last edited by

                                          I had this error… and now I think maybe because:

                                          Umm… You can only fetch the data every 30 minutes - sorry.  It's pointless any faster as I only update every 30 minutes anyway.
                                          If you keep trying to download this list too often, you may get blocked from accessing it completely.
                                          (this is due to some people trying to download this list every minute!)

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            thehasty
                                            last edited by

                                            @BBcan177:

                                            @thehasty:

                                            I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

                                            When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.

                                            Apparently it is no longer blocking inbound spam from my custom list?

                                            2015-07-16 23:57:19 Copper-Fit-Back-Relief@cdkql.xyz [myemail] 198.154.80.46 127.0.0.1 SMTP ? 250 5467

                                            fit in a range on my custom block list: 198.154.80.2-198.154.80.219

                                            Please advise

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.