Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 211 Posters 2.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      taryezveb
      last edited by

      BBcan177,

      A reboot was forced on me; power went out again :) So can answer some of your questions:

      @BBcan177:

      On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?

      Can not answer this for sure, still have no monitor. Like said before do not recall any such issue.

      @BBcan177:

      After pfSense Boots, does the widget show entries in the packet column? or is it all blank?

      Can verify, all blank.

      @BBcan177:

      When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?

      All blank as well.

      @BBcan177:

      Run the following commands when there are issues, and report back with the output.

      /sbin/pfctl -vvsTables | grep -A4 'pfB_'
          ls -lah /var/db/aliastables/*

      Here is the output of both commands, before restarting pfBlockerNG:

      # /sbin/pfctl -vvsTables | grep -A4 'pfB_'
      #
      # ls -lah /var/db/aliastables/*
      -rw-r--r--  1 root  wheel   3.4K Jul 16 11:00 /var/db/aliastables/pfB_BC.txt
      -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_BC.txt.tmp
      -rw-r--r--  1 root  wheel   6.6M Jul 16 11:00 /var/db/aliastables/pfB_Bluetack.txt
      -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_Bluetack.txt.tmp
      -rw-r--r--  1 root  wheel    12M Jul 16 11:00 /var/db/aliastables/pfB_TBG.txt
      -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_TBG.txt.tmp
      
      

      Here is the output of both commands, after restarting pfBlockerNG:

      # /sbin/pfctl -vvsTables | grep -A4 'pfB_'
      -pa---- pfB_BC
              Addresses:   102
              Cleared:     Thu Jul 16 11:03:42 2015
              References:  [ Anchors: 0                  Rules: 0                  ]
              Evaluations: [ NoMatch: 0                  Match: 0                  ]
      --
      -pa---- pfB_Bluetack
              Addresses:   423729
              Cleared:     Thu Jul 16 11:03:39 2015
              References:  [ Anchors: 0                  Rules: 0                  ]
              Evaluations: [ NoMatch: 0                  Match: 0                  ]
      
      # ls -lah /var/db/aliastables/*
      -rw-r--r--  1 root  wheel   3.4K Jul 16 11:03 /var/db/aliastables/pfB_BC.txt
      -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_BC.txt.tmp
      -rw-r--r--  1 root  wheel   6.6M Jul 16 11:03 /var/db/aliastables/pfB_Bluetack.txt
      -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_Bluetack.txt.tmp
      -rw-r--r--  1 root  wheel    12M Jul 16 11:03 /var/db/aliastables/pfB_TBG.txt
      -rw-r--r--  1 root  wheel     0B Jul  1 12:49 /var/db/aliastables/pfB_TBG.txt.tmp
      
      

      As you can tell from the above, the pfB_TBG alias does not get loaded. The widget shows no entries for pfB_TBG alias or when hovering over the floating firewall rule for it. In the /var/log/pfblockerng/pfblockerng.log, shows the pfB_TBG alias fails to load:

      Updating: pfB_TBG
      no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0
      

      And here is the full output after restarting pfBlockerNG, forcing an update, cron and reload:

      
      **Saving Configuration [ 07/16/15 11:01:57 ] ...
      
      **Saving Configuration [ 07/16/15 11:02:07 ] ...
       UPDATE PROCESS START [ 07/16/15 11:02:20 ]
      
      [ level1 ]		 exists, Reloading File 
      [ level2 ]		 exists, Reloading File 
      [ level3 ]		 exists, Reloading File 
      [ ads ]			 exists, Reloading File 
      [ spyware ]		 exists, Reloading File 
      [ badpeers ]		 exists, Reloading File 
      [ hijacked ]		 exists, Reloading File 
      [ dshield ]		 exists, Reloading File 
      [ bogon ]		 exists, Reloading File 
      [ Primary_Threats ]	 exists, Reloading File 
      [ Hijacked ]		 exists, Reloading File 
      [ Bogon ]		 exists, Reloading File 
      [ General_Corporate_Ranges ] exists, Reloading File 
      [ Business_ISPs ]	 exists, Reloading File 
      [ Search_Engines ]	 exists, Reloading File 
      [ c2_IP_Feed ]		 exists, Reloading File 
      [ c2_All_Indicator_Feed ] exists, Reloading File 
      
      ===[  Aliastables / Rules  ]================================
      
      No Changes to Firewall Rules, Skipping Filter Reload
      No Changes to Aliases, Skipping pfctl Update
      
       UPDATE PROCESS ENDED [ 07/16/15 11:02:22 ]
       CRON  PROCESS  START [ 07/16/15 11:02:30 ]
      
        No Updates required.
       CRON  PROCESS  ENDED
       UPDATE PROCESS ENDED
       UPDATE PROCESS START [ 07/16/15 11:02:41 ]
      
      [ level1 ]		 Using Previously Downloaded File 
      [ level2 ]		 Using Previously Downloaded File [ 07/16/15 11:02:53 ]
      [ level3 ]		 Using Previously Downloaded File [ 07/16/15 11:02:57 ]
      [ ads ]			 Using Previously Downloaded File [ 07/16/15 11:02:58 ]
      [ spyware ]		 Using Previously Downloaded File [ 07/16/15 11:02:59 ]
      [ badpeers ]		 Using Previously Downloaded File 
      [ hijacked ]		 Using Previously Downloaded File [ 07/16/15 11:03:00 ]
      [ dshield ]		 Using Previously Downloaded File 
      [ bogon ]		 Using Previously Downloaded File 
      [ Primary_Threats ]	 Using Previously Downloaded File 
      [ Hijacked ]		 Using Previously Downloaded File [ 07/16/15 11:03:17 ]
      [ Bogon ]		 Using Previously Downloaded File 
      [ General_Corporate_Ranges ] Using Previously Downloaded File 
      [ Business_ISPs ]	 Using Previously Downloaded File [ 07/16/15 11:03:28 ]
      [ Search_Engines ]	 Using Previously Downloaded File [ 07/16/15 11:03:34 ]
      [ c2_IP_Feed ]		 Using Previously Downloaded File [ 07/16/15 11:03:35 ]
      [ c2_All_Indicator_Feed ] Using Previously Downloaded File 
      
      ===[  Aliastables / Rules  ]================================
      
      No Changes to Firewall Rules, Skipping Filter Reload
      
       Updating: pfB_Bluetack
      1 table created.423729 addresses added.
       Updating: pfB_TBG
      no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0
       Updating: pfB_BC
      1 table created.102 addresses added.
      
      ===[ FINAL Processing ]=============================================
      
         [ Original count   ]  [ 1173166 ]
      
      ===[ Deny List IP Counts ]===========================
      
       1173167 total
        375147 /var/db/pfblockerng/deny/Primary_Threats.txt
        257969 /var/db/pfblockerng/deny/level1.txt
        217513 /var/db/pfblockerng/deny/General_Corporate_Ranges.txt
        145954 /var/db/pfblockerng/deny/Business_ISPs.txt
         89452 /var/db/pfblockerng/deny/level2.txt
         48844 /var/db/pfblockerng/deny/badpeers.txt
         19891 /var/db/pfblockerng/deny/level3.txt
          5575 /var/db/pfblockerng/deny/Bogon.txt
          3654 /var/db/pfblockerng/deny/spyware.txt
          3341 /var/db/pfblockerng/deny/ads.txt
          2731 /var/db/pfblockerng/deny/bogon.txt
          1668 /var/db/pfblockerng/deny/Search_Engines.txt
           604 /var/db/pfblockerng/deny/Hijacked.txt
           536 /var/db/pfblockerng/deny/hijacked.txt
           151 /var/db/pfblockerng/deny/c2_All_Indicator_Feed.txt
            97 /var/db/pfblockerng/deny/c2_IP_Feed.txt
            40 /var/db/pfblockerng/deny/dshield.txt
      
      ====================[ Last Updated List Summary ]==============
      
      Jul 15	07:20	spyware.gz
      Jul 15	07:20	ads.gz
      Jul 15	07:20	badpeers.gz
      Jul 15	07:22	Primary_Threats.gz
      Jul 15	07:30	dshield.gz
      Jul 15	07:36	Hijacked.gz
      Jul 15	07:50	hijacked.gz
      Jul 15	07:51	bogon.gz
      Jul 15	07:51	General_Corporate_Ranges.gz
      Jul 15	07:51	level2.gz
      Jul 15	07:51	level3.gz
      Jul 15	07:51	Business_ISPs.gz
      Jul 15	09:00	Bogon.gz
      Jul 15	09:01	Search_Engines.gz
      Jul 15	12:01	level1.gz
      Jul 15	23:56	c2_IP_Feed.raw
      Jul 15	23:56	c2_All_Indicator_Feed.raw
      Jul 16	11:02	level1
      Jul 16	11:02	level2
      Jul 16	11:02	level3
      Jul 16	11:02	spyware
      Jul 16	11:02	ads
      Jul 16	11:03	hijacked
      Jul 16	11:03	dshield
      Jul 16	11:03	bogon
      Jul 16	11:03	badpeers
      Jul 16	11:03	Primary_Threats
      Jul 16	11:03	Hijacked
      Jul 16	11:03	Bogon
      Jul 16	11:03	General_Corporate_Ranges
      Jul 16	11:03	Search_Engines
      Jul 16	11:03	Business_ISPs
      Jul 16	11:03	c2_IP_Feed
      Jul 16	11:03	c2_All_Indicator_Feed
      ===============================================================
      
      IPv4 Alias Table IP Total
      -----------------------------
      1173167
      
      IPv6 Alias Table IP Total
      -----------------------------
      0
      
      Alias Table IP Counts
      -----------------------------
       1173167 total
        746461 /var/db/aliastables/pfB_TBG.txt
        426458 /var/db/aliastables/pfB_Bluetack.txt
           248 /var/db/aliastables/pfB_BC.txt
      
      pfSense Table Stats
      -------------------
      table-entries hard limit  5000000
      Table Usage Count        427593
      
       UPDATE PROCESS ENDED [ 07/16/15 11:03:43 ]
      
      

      Hope this helps and Thank You.

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        @taryezveb:

        Updating: pfB_TBG
        no IP address found for /31pfctl: cannot load /var/db/aliastables/pfB_TBG.txt: No error: 0

        Hi taryezveb,

        What lists are in this pfB_TBG alias? Can you send me the full URLs that are part of this Alias? It seems that the IP parser failed to convert one line as it is showing  "no IP address found for /31" and pfctl is failing. IBlock lists are renowned for adding strange IPs and once i review the list, I can patch this up.

        It would be good if FreeBSD pfctl had some error checking ability. As any error in the alias file can cause the whole packet fence to fail.

        If you see this issue again, please copy the    /var/db/aliastables/pfB_TBG.txt  file and forward to my email address which is in the General Tab of pfBNG.  I would need to see the file before you perform a Reload.

        Thanks!

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          @fragged:

          @Derek:

          Thanks for that BB.  I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages.  I'll tinker a bit more.

          For this particular list I ended up setting a cron job on one of my RaspberryPi's to fetch the list on schedule and then fetch it from the Pi to pfBlockerNG.

          Its strange that you guys are seeing errors in downloading this list from www.dan.me.uk?

          If you load that URL in a browser does it fail to download also? Did you try http instead? I use this list in several other boxes and have not seen anyone else complain about that list.

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • N
            n3by
            last edited by

            I had this error… and now I think maybe because:

            Umm… You can only fetch the data every 30 minutes - sorry.  It's pointless any faster as I only update every 30 minutes anyway.
            If you keep trying to download this list too often, you may get blocked from accessing it completely.
            (this is due to some people trying to download this list every minute!)

            1 Reply Last reply Reply Quote 0
            • T
              thehasty
              last edited by

              @BBcan177:

              @thehasty:

              I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

              When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.

              Apparently it is no longer blocking inbound spam from my custom list?

              2015-07-16 23:57:19 Copper-Fit-Back-Relief@cdkql.xyz [myemail] 198.154.80.46 127.0.0.1 SMTP ? 250 5467

              fit in a range on my custom block list: 198.154.80.2-198.154.80.219

              Please advise

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                @thehasty:

                Please advise

                Please post your "custom list". Plus how's that list configured in pfBNBG. Noone can advise with no info.

                1 Reply Last reply Reply Quote 0
                • T
                  thehasty
                  last edited by

                  It was working until I changed the setting he advised. I've changed it back for now.

                  top to bottom

                  manualMail
                  IPs added manually to be blocked from sending mail.
                  txt
                  on
                  blank
                  blank
                  deny inbound
                  never
                  Monday
                  enable
                  tick'd with my smtp_ports alias in the box
                  unticked
                  unticked
                  any (was tcp/udb)

                  5.56.133.231-5.56.133.237
                  5.255.94.149-5.255.94.243
                  23.108.42.1-23.108.42.138
                  23.227.199.146-23.227.199.158
                  23.231.63.12-23.231.63.139
                  50.2.66.2-50.2.66.50
                  50.2.70.2-50.2.70.44
                  50.30.36.45-50.30.36.182
                  69.12.64.24-69.12.64.230
                  80.79.17.10-80.79.179.51
                  81.31.44.2-81.31.44.64
                  82.118.242.107-82.118.242.140
                  82.192.81.134-82.192.81.157
                  85.187.151.170-85.187.151.184
                  94.228.219.2-94.228.219.14
                  94.242.202.227-94.242.202.254
                  95.211.147.113-95.211.147.117
                  95.211.159.9-95.211.159.12
                  107.158.123.194-107.158.123.253
                  107.179.25.195-107.179.25.252
                  109.200.217.177-109.200.217.192
                  138.99.218.6-138.99.218.223
                  159.8.217.192-159.8.217.198
                  173.224.115.142-173.224.115.144
                  173.247.227.2-173.247.227.19
                  185.7.34.116-185.7.34.173
                  185.82.202.20-185.82.202.222
                  192.3.11.82-192.3.11.94
                  192.3.207.187-192.3.207.190
                  192.161.194.131-192.161.194.148
                  192.169.69.131-192.169.69.141
                  198.23.190.35-198.23.190.157
                  198.52.147.34-198.52.147.62
                  198.52.150.34-198.52.150.61
                  198.52.231.141-198.52.231.147
                  198.52.246.137-198.52.246.163
                  198.52.251.134-198.52.251.232
                  198.52.152.34-198.52.152.62
                  198.154.80.2-198.154.80.219
                  209.126.121.18-209.126.121.35
                  216.144.241.194-216.144.241.205
                  216.169.105.172-216.169.105.211
                  216.169.112.80-216.169.112.206

                  default

                  Thank you.

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by

                    @thehasty:

                    It was working until I changed the setting he advised.

                    Which setting?

                    @thehasty:

                    manualMail
                    IPs added manually to be blocked from sending mail.
                    txt
                    on
                    blank
                    blank
                    deny inbound
                    never
                    Monday
                    enable
                    tick'd with my smtp_ports alias in the box
                    unticked
                    unticked
                    any (was tcp/udb)

                    Post screenshots. Not such mess. You changed exactly what?

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @thehasty:

                      Apparently it is no longer blocking inbound spam from my custom list?

                      When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)?  If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.

                      Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.

                      I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
                      https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfcode
                        last edited by

                        Using pfB_TOR rules (List: Blut_Tor), it blocks IP 162.244.25.186, the host is 0.ca.pool.ntp.org, Whats the reason to block LAN to access this IP with port 123?

                        Release: pfSense 2.4.3(amd64)
                        M/B: Supermicro A1SRi-2558F
                        HDD: Intel X25-M 160G
                        RAM: 2x8Gb Kingston ECC ValueRAM
                        AP: Netgear R7000 (XWRT), Unifi AC Pro

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          The reason is that you configured it so…

                          1 Reply Last reply Reply Quote 0
                          • P
                            pfcode
                            last edited by

                            @doktornotor:

                            The reason is that you configured it so…

                            Well, whats the pfB_TOR rules for then?  since its turned on by default. why we need to block these IPs if they are good, no harm?

                            Release: pfSense 2.4.3(amd64)
                            M/B: Supermicro A1SRi-2558F
                            HDD: Intel X25-M 160G
                            RAM: 2x8Gb Kingston ECC ValueRAM
                            AP: Netgear R7000 (XWRT), Unifi AC Pro

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              There is NO list turned on by default, anywhere. The blocklist simply lists tor exit nodes. You do not need to block anything. Simply stop using the "offending" blocklist to block outbound traffic, or whitelist the IP, or whatever.

                              1 Reply Last reply Reply Quote 0
                              • M
                                Marvho
                                last edited by

                                Hello everyone,

                                I'm new to pfblockerng and I want some sugestions from you guys.

                                Which list could be useful for a home use scenario with no open ports, just outbound traffic is important.

                                I'm also interested in blocking adverts with pfblockerng. Is there a way to use the easylist from ADBlock Plus ?

                                Which lists are you using actual? And where do I get them?

                                Thanks for any advice.

                                Best regards

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by

                                  @Marvho:

                                  Which lists are you using actual? And where do I get them?

                                  https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    dzeanah
                                    last edited by

                                    @doktornotor:

                                    @Marvho:

                                    Which lists are you using actual? And where do I get them?

                                    https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                                    I totally missed that.  Thanks so much for pointing it out.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      Marvho
                                      last edited by

                                      Thanks for the list.

                                      I imported it successfully and set these to "deny outbound" but they won't show up in the Dashboard listing.

                                      Did I miss something?

                                      //edit: Nevermind, had to switch the state of the link to "ON".

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        thehasty
                                        last edited by

                                        @BBcan177:

                                        When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)?  If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.

                                        Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.

                                        I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
                                        https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272

                                        I always run a Force Update after changes, however I did not have "Update Custom List" set. It is now set and I've changed the scope back to TCP/UDP. I'll report back with any issues.

                                        Thanks again for your help!

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          Marvho
                                          last edited by

                                          How can I suppress a IP for example 192.16.71.176:443 ?

                                          It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

                                          Thanks!

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            Mr. Jingles
                                            last edited by

                                            @Marvho:

                                            How can I suppress a IP for example 192.16.71.176:443 ?

                                            It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

                                            Thanks!

                                            Click on the suppress icon in the alerts?

                                            (I'm probably saying something stupid now  :-[ ).

                                            6 and a half billion people know that they are stupid, agressive, lower life forms.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.