PfBlockerNG

attilahooper · Aug 23, 2015, 12:35 AM

just applied pfBlocker_import.php from post #600, thanks to BBcan177 and doktornotor and it went swimmingly well, aside form some failed downloads.

here's the smattering in case someone else is having same issue


 [ pfB_PRI1 Abuse_Spyeye ] Download FAIL [ 08/22/15 20:02:47 ]

 [ pfB_PRI2 HoneyPot ] Download FAIL [ 08/22/15 20:03:03 ]

 [ pfB_PRI3 Infiltrated ] Download FAIL [ 08/22/15 20:03:08 ]

 [ pfB_PRI3 Juniper ] Download FAIL [ 08/22/15 20:03:24 ]

 [ pfB_SEC1 OpenBL ] Download FAIL [ 08/22/15 20:03:31 ]

 [ SFS_All ] file_get_contents(http://www.stopforumspam.com/downloads/bannedips.zip): failed to open stream: HTTP request failed! HTTP/1.1 503 Service Unavailable

 [ pfB_MAIL ToastedSpam ] Download FAIL 

 [ pfB_MAIL SpamCop ] Download FAIL [ 08/22/15 20:03:51 ]

I suppose this is or can be one time event based on availability of the host, curious if you guys see similar results.

Anyway, Thanks for pfBlocker and especially keeping it up w pfBlockerNG, it's the first thing I setup after configuring my networks.<hat tip=""></hat>

BBcan177 · Aug 23, 2015, 5:08 AM

When you have issues downloading Feeds, first review the logs to ensure that its not being blocked by another list or the IDS if enabled. You can also load the URL in a browser to get more information. Feeds change URLs from time to time. Feeds also go down.

Its important to donate to some of the Feeds that you rely on, as most do this as a Free service and everyone has bills to pay.

pfB_PRI1 Abuse_Spyeye
This Feed has been discontinued.

pfB_PRI2 HoneyPot
Feed is temporarily under Maintenance

pfB_PRI3 Infiltrated
Feed not in service.

pfB_PRI3 Juniper
Feed not in Service.

pfB_SEC1 OpenBL
This feed has some SSL issues from time to time. You can try with http://
But best to wait and see if it continues to have issues.

SFS_All stopforumspam.com
This Feed rate limits. Please put it into its own Alias and set for Once per Day.

pfB_MAIL ToastedSpam
Feed is temporarily down.

pfB_MAIL SpamCop
Use this URL
https://www.spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt

attilahooper · Aug 23, 2015, 2:11 PM

@BBcan177:

When you have issues downloading Feeds, first review the logs to ensure that its not being blocked by another list or the IDS if enabled. You can also load the URL in a browser to get more information. Feeds change URLs from time to time. Feeds also go down. Its important to donate to some of the Feeds that you rely on, as most do this as a Free service and everyone has bills to pay.

ok, thanks man. After turning off those lists and forcing a cron the log looks a lot cleaner, except for BBC_GOZ and Feodo_BAD returning empty lists. I gotta tell ya, before I refreshed, the number of hits shown on the dashboard panel was in the thousands for a couple of the aliases. I am a happy camper now.

I concur on donations to list maintainers. I gave a little something to another foss app I use to watch my cat door - zoneminder dvr. One year I was away for a couple weeks around xmas (I'm in a winter lattitude) and feline wasn't doing usual 40 round trips through door - I expected something, so I sent friend to check, sure enough it had got beat up by neighbour cat and was hiding in the basement. So free and open source software earned its keep again. Worthy of a few bucks.

More than likely I'll contrib to pfSense as the little router is/has done a stellar job. I showed another friend my pfSense setup, he pays the subscrip for a Sonicwall, he was impressed with pfS functionality.

hulleyrob · Aug 23, 2015, 2:37 PM

Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?

BBcan177 · Aug 23, 2015, 4:25 PM

@attilahooper:

log looks a lot cleaner, except for BBC_GOZ and Feodo_BAD returning empty lists.

Use the following URL for BBC. It incorporates all of their IP lists into one IP feed:
http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt

Follow that with a "Force Reload"

BBcan177 · Aug 23, 2015, 4:29 PM

@hulleyrob:

Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?

I had one user complain about this a few months back, but couldn't figure out why its doing that. I suspect an issue with the browser or a conflict with another widget.

What Browser are you using (Can you try a different browser)? and what widgets are enabled? Are you on 2.2.4? Full/Nano/Ramdisk installation? Do the other pfBNG widget settings work for you?

tim.mcmanus · Aug 23, 2015, 4:31 PM

@hulleyrob:

Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?

Works fine for me. In past versions of pfSense I had issues with most of the widgets not saving their settings. It improved in later releases. I'm on 2.2.4 right now without issue.

joshcch · Aug 24, 2015, 8:53 AM

@BBcan177:

To download from HE, you need to select the format as "html" or it will fail to download.

Disable this list for 24hrs as HE is denying access (rate-limiting) because you probably have this list attempting to download every hour using the wrong download format.

I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.

Hypertext Transfer Protocol
Line-based text data: text/html
    \n
    \n
    <title>403 Forbidden</title>\n
    \n

# Forbidden

\n

You don't have permission to access /search\n
    on this server.

\n

* * *

\n

<address>Apache/2.4.7 (Ubuntu) Server at bgp.he.net Port 80</address>

\n
    \n

     18 GET /search?search%5Bsearch%5D=facebook&commit=Search HTTP/1.1 

Hypertext Transfer Protocol

     20 HTTP/1.1 403 Forbidden  (text/html)

Hypertext Transfer Protocol
Line-based text data: text/html
    \n
    \n
    <title>403 Forbidden</title>\n
    \n

# Forbidden

\n

You don't have permission to access /search\n
    on this server.

\n

* * *

\n

<address>Apache/2.4.7 (Ubuntu) Server at bgp.he.net Port 80</address>

\n
    \n

hda · Aug 24, 2015, 12:56 PM

@hulleyrob:

Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?

Yes metoo. on 2.2.4 (Alix) nano (rw).
Widgets: System Information; Interfaces; Services Status; NTP Status and pfBlockerNG.
Mozilla FF(40.0.2).

doktornotor · Aug 24, 2015, 12:58 PM

@hulleyrob:

Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?

I would love to keep it ticked. Alas, it keeps unticking itself.

hulleyrob · Aug 24, 2015, 6:07 PM

Does the same on both Chrome and Safari on OS X (latest versions of each).

I have the following widgets on the homepage:

System Info, Interfaces, Services Status, Interface Statistics, Installed Packages, PFBlockerNG, Snort Alerts, Firewall Logs.

PFsense 2.2.4 full all other widgets seem to work fine.

Thanks

Rob

trumee · Aug 24, 2015, 6:37 PM

I have multiple forwarded ports in different aliases (some are tcp only and others are udp only). Is it possible to specify multiple aliases in "Enable Custom Port"?

Thanks

doktornotor · Aug 24, 2015, 6:51 PM

You should use one of the Alias list actions and create and manage your own firewall rules using those.

trumee · Aug 24, 2015, 8:13 PM

Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng?

BBcan177 · Aug 25, 2015, 12:10 AM

@JC2:

I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.

Can you browse to http://bgp.he.net ?

BBcan177 · Aug 25, 2015, 12:12 AM

@trumee:

Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng?

When pfB_Top_v4 creates an Auto Firewall Rule, you can manually create another Rule and reference the same "pfB_Top_v4" table without issue…

joshcch · Aug 25, 2015, 12:12 PM

@BBcan177:

@JC2:

I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.

Can you browse to http://bgp.he.net ?

Yes. I attempted to do another update and same results, 403.

doktornotor · Aug 25, 2015, 12:16 PM

Apparently you got banned… :P

Jamerson · Aug 25, 2015, 3:28 PM

@doktornotor:

Apparently you got banned… :P

I was curious what kind of website is this ?
http://bgp.he.net

marcelloc · Aug 25, 2015, 5:02 PM

@Jamerson:

I was curious what kind of website is this ?
http://bgp.he.net

Hurricane Electric BGP Toolkit
bgp.he.net/
Welcome to the Hurricane Electric BGP Toolkit. You are visiting from 66.249.79.114 (crawl-66-249-79-114.googlebot.com). United States. Announced as …
‎Looking Glass - ‎BGP Prefix Report - ‎BGP Peer Report - ‎World Report

Bgp.he.net Explained - YouTube