PfBlockerNG
-
Just wanted to add, also having issues with pfBlockerNG, but only after a reboot. Which just noticed, because the UPS needs new batteries. Power here is terrible and has gone out several times. Each time after pfSense reboots can not connect to the internet and sometimes even to pfSense.
Guessing this a new issue, since did not notice this before. Either with the recent change to pfSense made with the 2.2.3 update or with the pfBlockerNG 1.09 update. Both happened about the same time. Before those updates everything worked fine, but had not rebooted since the 2.2.2 update. So it is possible that is not the cause.
After connecting to pfSense and unchecking the Enable/Disable checkbox[to disable] and then saving; internet comes back up. After that checking the Enable/Disbable checkbox[to enable] and then saving. And forcing an update, cron and reload; pfBlockerNG works fine after that.
Note, if it matters: the few times I remembered to ping a site[7) Ping host], did not get any packet loss. Before doing the above. Also the Floating Rules are present before doing the above.
Using the defaults for many of the options and just have a few IPV4 lists. Nothing shows in the logs that would be helpful.
Thanks
-
Hi cyberbot/taryezveb,
Are you running a Nano version/Ramdisk or a full installation of pfSense?
On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?
After pfSense Boots, does the widget show entries in the packet column? or is it all blank?
When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?
Run the following commands when there are issues, and report back with the output.
/sbin/pfctl -vvsTables | grep -A4 'pfB_'
ls -lah /var/db/aliastables/* -
Is it appropriate to offer a bounty here?
I'd like to pledge $100 to add the following feature: block TOR exit nodes. I personally like TOR, but my forum is getting attacks from the TOR network that average more than one every eight seconds. Right now I'm going to the following URL and manually updating the list of nodes that can access my site as a custom list:
https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=[my server's IP address]&port=
I'd love to be able to simply check TOR the way I can flag a country within pfBlockerNG to deal with the problem instead.
-
Is it appropriate to offer a bounty here?
I'd like to pledge $100 to add the following feature: block TOR exit nodes. I personally like TOR, but my forum is getting attacks from the TOR network that average more than one every eight seconds. Right now I'm going to the following URL and manually updating the list of nodes that can access my site as a custom list:
https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=[my server's IP address]&port=
I'd love to be able to simply check TOR the way I can flag a country within pfBlockerNG to deal with the problem instead.
It's always appropriate to throw beer or coffee to BB ;D
If you are in a hurry, I noticed, for me Snort/Suricata are also blocking TOR nodes. So you could perhaps use that until (and if) BB finds time to fulfill your request.
-
There are three IP lists that contain 'Tor Exit Nodes' that can be used in pfBNG without any code changes :
(gz) http://list.iblocklist.com/?list=togdoptykrlolpddwbvz&fileformat=p2p&archiveformat=gz
(txt) https://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv
(html) https://rules.emergingthreats.net/open/suricata/rules/tor.rules -
Thanks for that BB. I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages. I'll tinker a bit more.
-
Hi cyberbot/taryezveb,
Are you running a Nano version/Ramdisk or a full installation of pfSense?
Full install here.
On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?
None that can recall. pfSense boots normally, will verify again tho. Once the new monitor arrives, since the previous one failed and do not have any at the moment. Not much luck with hardware lately :)
After pfSense Boots, does the widget show entries in the packet column? or is it all blank?
It is all blank, will verify again tho.
When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?
Will report back on this, did not think to try that.
Run the following commands when there are issues, and report back with the output.
/sbin/pfctl -vvsTables | grep -A4 'pfB_'
ls -lah /var/db/aliastables/*Will do. Not sure when I can report back, whether forced by power outage or just by rebooting. Need to find the right time to do this, if not forced too. Some people here complain when they can not connect to the internet; I'd rather avoid that if possible ;)
Also having another issue with an alias, that fails to load. Do not think this is the cause of or related to the reboot issue. Since pfBlockerNG keeps on working regardless after it is restarted as explained before. Can supply some details of that now or would it be better to deal with one issue at a time?
Thank You
-
Thanks for that BB. I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages. I'll tinker a bit more.
For this particular list I ended up setting a cron job on one of my RaspberryPi's to fetch the list on schedule and then fetch it from the Pi to pfBlockerNG.
-
BBcan177,
A reboot was forced on me; power went out again :) So can answer some of your questions:
On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?
Can not answer this for sure, still have no monitor. Like said before do not recall any such issue.
After pfSense Boots, does the widget show entries in the packet column? or is it all blank?
Can verify, all blank.
When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?
All blank as well.
Run the following commands when there are issues, and report back with the output.
/sbin/pfctl -vvsTables | grep -A4 'pfB_'
ls -lah /var/db/aliastables/*Here is the output of both commands, before restarting pfBlockerNG:
# /sbin/pfctl -vvsTables | grep -A4 'pfB_' # # ls -lah /var/db/aliastables/* -rw-r--r-- 1 root wheel 3.4K Jul 16 11:00 /var/db/aliastables/pfB_BC.txt -rw-r--r-- 1 root wheel 0B Jul 1 12:49 /var/db/aliastables/pfB_BC.txt.tmp -rw-r--r-- 1 root wheel 6.6M Jul 16 11:00 /var/db/aliastables/pfB_Bluetack.txt -rw-r--r-- 1 root wheel 0B Jul 1 12:49 /var/db/aliastables/pfB_Bluetack.txt.tmp -rw-r--r-- 1 root wheel 12M Jul 16 11:00 /var/db/aliastables/pfB_TBG.txt -rw-r--r-- 1 root wheel 0B Jul 1 12:49 /var/db/aliastables/pfB_TBG.txt.tmpHere is the output of both commands, after restarting pfBlockerNG:
# /sbin/pfctl -vvsTables | grep -A4 'pfB_' -pa---- pfB_BC Addresses: 102 Cleared: Thu Jul 16 11:03:42 2015 References: [ Anchors: 0 Rules: 0 ] Evaluations: [ NoMatch: 0 Match: 0 ] -- -pa---- pfB_Bluetack Addresses: 423729 Cleared: Thu Jul 16 11:03:39 2015 References: [ Anchors: 0 Rules: 0 ] Evaluations: [ NoMatch: 0 Match: 0 ] # ls -lah /var/db/aliastables/* -rw-r--r-- 1 root wheel 3.4K Jul 16 11:03 /var/db/aliastables/pfB_BC.txt -rw-r--r-- 1 root wheel 0B Jul 1 12:49 /var/db/aliastables/pfB_BC.txt.tmp -rw-r--r-- 1 root wheel 6.6M Jul 16 11:03 /var/db/aliastables/pfB_Bluetack.txt -rw-r--r-- 1 root wheel 0B Jul 1 12:49 /var/db/aliastables/pfB_Bluetack.txt.tmp -rw-r--r-- 1 root wheel 12M Jul 16 11:03 /var/db/aliastables/pfB_TBG.txt -rw-r--r-- 1 root wheel 0B Jul 1 12:49 /var/db/aliastables/pfB_TBG.txt.tmpAs you can tell from the above, the pfB_TBG alias does not get loaded. The widget shows no entries for pfB_TBG alias or when hovering over the floating firewall rule for it. In the /var/log/pfblockerng/pfblockerng.log, shows the pfB_TBG alias fails to load:
Updating: pfB_TBG no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0And here is the full output after restarting pfBlockerNG, forcing an update, cron and reload:
**Saving Configuration [ 07/16/15 11:01:57 ] ... **Saving Configuration [ 07/16/15 11:02:07 ] ... UPDATE PROCESS START [ 07/16/15 11:02:20 ] [ level1 ] exists, Reloading File [ level2 ] exists, Reloading File [ level3 ] exists, Reloading File [ ads ] exists, Reloading File [ spyware ] exists, Reloading File [ badpeers ] exists, Reloading File [ hijacked ] exists, Reloading File [ dshield ] exists, Reloading File [ bogon ] exists, Reloading File [ Primary_Threats ] exists, Reloading File [ Hijacked ] exists, Reloading File [ Bogon ] exists, Reloading File [ General_Corporate_Ranges ] exists, Reloading File [ Business_ISPs ] exists, Reloading File [ Search_Engines ] exists, Reloading File [ c2_IP_Feed ] exists, Reloading File [ c2_All_Indicator_Feed ] exists, Reloading File ===[ Aliastables / Rules ]================================ No Changes to Firewall Rules, Skipping Filter Reload No Changes to Aliases, Skipping pfctl Update UPDATE PROCESS ENDED [ 07/16/15 11:02:22 ] CRON PROCESS START [ 07/16/15 11:02:30 ] No Updates required. CRON PROCESS ENDED UPDATE PROCESS ENDED UPDATE PROCESS START [ 07/16/15 11:02:41 ] [ level1 ] Using Previously Downloaded File [ level2 ] Using Previously Downloaded File [ 07/16/15 11:02:53 ] [ level3 ] Using Previously Downloaded File [ 07/16/15 11:02:57 ] [ ads ] Using Previously Downloaded File [ 07/16/15 11:02:58 ] [ spyware ] Using Previously Downloaded File [ 07/16/15 11:02:59 ] [ badpeers ] Using Previously Downloaded File [ hijacked ] Using Previously Downloaded File [ 07/16/15 11:03:00 ] [ dshield ] Using Previously Downloaded File [ bogon ] Using Previously Downloaded File [ Primary_Threats ] Using Previously Downloaded File [ Hijacked ] Using Previously Downloaded File [ 07/16/15 11:03:17 ] [ Bogon ] Using Previously Downloaded File [ General_Corporate_Ranges ] Using Previously Downloaded File [ Business_ISPs ] Using Previously Downloaded File [ 07/16/15 11:03:28 ] [ Search_Engines ] Using Previously Downloaded File [ 07/16/15 11:03:34 ] [ c2_IP_Feed ] Using Previously Downloaded File [ 07/16/15 11:03:35 ] [ c2_All_Indicator_Feed ] Using Previously Downloaded File ===[ Aliastables / Rules ]================================ No Changes to Firewall Rules, Skipping Filter Reload Updating: pfB_Bluetack 1 table created.423729 addresses added. Updating: pfB_TBG no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0 Updating: pfB_BC 1 table created.102 addresses added. ===[ FINAL Processing ]============================================= [ Original count ] [ 1173166 ] ===[ Deny List IP Counts ]=========================== 1173167 total 375147 /var/db/pfblockerng/deny/Primary_Threats.txt 257969 /var/db/pfblockerng/deny/level1.txt 217513 /var/db/pfblockerng/deny/General_Corporate_Ranges.txt 145954 /var/db/pfblockerng/deny/Business_ISPs.txt 89452 /var/db/pfblockerng/deny/level2.txt 48844 /var/db/pfblockerng/deny/badpeers.txt 19891 /var/db/pfblockerng/deny/level3.txt 5575 /var/db/pfblockerng/deny/Bogon.txt 3654 /var/db/pfblockerng/deny/spyware.txt 3341 /var/db/pfblockerng/deny/ads.txt 2731 /var/db/pfblockerng/deny/bogon.txt 1668 /var/db/pfblockerng/deny/Search_Engines.txt 604 /var/db/pfblockerng/deny/Hijacked.txt 536 /var/db/pfblockerng/deny/hijacked.txt 151 /var/db/pfblockerng/deny/c2_All_Indicator_Feed.txt 97 /var/db/pfblockerng/deny/c2_IP_Feed.txt 40 /var/db/pfblockerng/deny/dshield.txt ====================[ Last Updated List Summary ]============== Jul 15 07:20 spyware.gz Jul 15 07:20 ads.gz Jul 15 07:20 badpeers.gz Jul 15 07:22 Primary_Threats.gz Jul 15 07:30 dshield.gz Jul 15 07:36 Hijacked.gz Jul 15 07:50 hijacked.gz Jul 15 07:51 bogon.gz Jul 15 07:51 General_Corporate_Ranges.gz Jul 15 07:51 level2.gz Jul 15 07:51 level3.gz Jul 15 07:51 Business_ISPs.gz Jul 15 09:00 Bogon.gz Jul 15 09:01 Search_Engines.gz Jul 15 12:01 level1.gz Jul 15 23:56 c2_IP_Feed.raw Jul 15 23:56 c2_All_Indicator_Feed.raw Jul 16 11:02 level1 Jul 16 11:02 level2 Jul 16 11:02 level3 Jul 16 11:02 spyware Jul 16 11:02 ads Jul 16 11:03 hijacked Jul 16 11:03 dshield Jul 16 11:03 bogon Jul 16 11:03 badpeers Jul 16 11:03 Primary_Threats Jul 16 11:03 Hijacked Jul 16 11:03 Bogon Jul 16 11:03 General_Corporate_Ranges Jul 16 11:03 Search_Engines Jul 16 11:03 Business_ISPs Jul 16 11:03 c2_IP_Feed Jul 16 11:03 c2_All_Indicator_Feed =============================================================== IPv4 Alias Table IP Total ----------------------------- 1173167 IPv6 Alias Table IP Total ----------------------------- 0 Alias Table IP Counts ----------------------------- 1173167 total 746461 /var/db/aliastables/pfB_TBG.txt 426458 /var/db/aliastables/pfB_Bluetack.txt 248 /var/db/aliastables/pfB_BC.txt pfSense Table Stats ------------------- table-entries hard limit 5000000 Table Usage Count 427593 UPDATE PROCESS ENDED [ 07/16/15 11:03:43 ]Hope this helps and Thank You.
-
Updating: pfB_TBG
no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0Hi taryezveb,
What lists are in this pfB_TBG alias? Can you send me the full URLs that are part of this Alias? It seems that the IP parser failed to convert one line as it is showing "no IP address found for /31" and pfctl is failing. IBlock lists are renowned for adding strange IPs and once i review the list, I can patch this up.
It would be good if FreeBSD pfctl had some error checking ability. As any error in the alias file can cause the whole packet fence to fail.
If you see this issue again, please copy the /var/db/aliastables/pfB_TBG.txt file and forward to my email address which is in the General Tab of pfBNG. I would need to see the file before you perform a Reload.
Thanks!
-
Thanks for that BB. I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages. I'll tinker a bit more.
For this particular list I ended up setting a cron job on one of my RaspberryPi's to fetch the list on schedule and then fetch it from the Pi to pfBlockerNG.
Its strange that you guys are seeing errors in downloading this list from www.dan.me.uk?
If you load that URL in a browser does it fail to download also? Did you try http instead? I use this list in several other boxes and have not seen anyone else complain about that list.
-
I had this error… and now I think maybe because:
Umm… You can only fetch the data every 30 minutes - sorry. It's pointless any faster as I only update every 30 minutes anyway.
If you keep trying to download this list too often, you may get blocked from accessing it completely.
(this is due to some people trying to download this list every minute!) -
I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.
When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.
Apparently it is no longer blocking inbound spam from my custom list?
2015-07-16 23:57:19 Copper-Fit-Back-Relief@cdkql.xyz [myemail] 198.154.80.46 127.0.0.1 SMTP ? 250 5467
fit in a range on my custom block list: 198.154.80.2-198.154.80.219
Please advise
-
Please advise
Please post your "custom list". Plus how's that list configured in pfBNBG. Noone can advise with no info.
-
It was working until I changed the setting he advised. I've changed it back for now.
top to bottom
manualMail
IPs added manually to be blocked from sending mail.
txt
on
blank
blank
deny inbound
never
Monday
enable
tick'd with my smtp_ports alias in the box
unticked
unticked
any (was tcp/udb)5.56.133.231-5.56.133.237
5.255.94.149-5.255.94.243
23.108.42.1-23.108.42.138
23.227.199.146-23.227.199.158
23.231.63.12-23.231.63.139
50.2.66.2-50.2.66.50
50.2.70.2-50.2.70.44
50.30.36.45-50.30.36.182
69.12.64.24-69.12.64.230
80.79.17.10-80.79.179.51
81.31.44.2-81.31.44.64
82.118.242.107-82.118.242.140
82.192.81.134-82.192.81.157
85.187.151.170-85.187.151.184
94.228.219.2-94.228.219.14
94.242.202.227-94.242.202.254
95.211.147.113-95.211.147.117
95.211.159.9-95.211.159.12
107.158.123.194-107.158.123.253
107.179.25.195-107.179.25.252
109.200.217.177-109.200.217.192
138.99.218.6-138.99.218.223
159.8.217.192-159.8.217.198
173.224.115.142-173.224.115.144
173.247.227.2-173.247.227.19
185.7.34.116-185.7.34.173
185.82.202.20-185.82.202.222
192.3.11.82-192.3.11.94
192.3.207.187-192.3.207.190
192.161.194.131-192.161.194.148
192.169.69.131-192.169.69.141
198.23.190.35-198.23.190.157
198.52.147.34-198.52.147.62
198.52.150.34-198.52.150.61
198.52.231.141-198.52.231.147
198.52.246.137-198.52.246.163
198.52.251.134-198.52.251.232
198.52.152.34-198.52.152.62
198.154.80.2-198.154.80.219
209.126.121.18-209.126.121.35
216.144.241.194-216.144.241.205
216.169.105.172-216.169.105.211
216.169.112.80-216.169.112.206default
Thank you.
-
It was working until I changed the setting he advised.
Which setting?
manualMail
IPs added manually to be blocked from sending mail.
txt
on
blank
blank
deny inbound
never
Monday
enable
tick'd with my smtp_ports alias in the box
unticked
unticked
any (was tcp/udb)Post screenshots. Not such mess. You changed exactly what?
-
Apparently it is no longer blocking inbound spam from my custom list?
When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)? If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.
Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.
I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272 -
Using pfB_TOR rules (List: Blut_Tor), it blocks IP 162.244.25.186, the host is 0.ca.pool.ntp.org, Whats the reason to block LAN to access this IP with port 123?
-
The reason is that you configured it so…
-
The reason is that you configured it so…
Well, whats the pfB_TOR rules for then? since its turned on by default. why we need to block these IPs if they are good, no harm?
