PfBlockerNG

trumee · Aug 24, 2015, 8:13 PM

Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng?

BBcan177 · Aug 25, 2015, 12:10 AM

@JC2:

I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.

Can you browse to http://bgp.he.net ?

BBcan177 · Aug 25, 2015, 12:12 AM

@trumee:

Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng?

When pfB_Top_v4 creates an Auto Firewall Rule, you can manually create another Rule and reference the same "pfB_Top_v4" table without issue…

joshcch · Aug 25, 2015, 12:12 PM

@BBcan177:

@JC2:

I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.

Can you browse to http://bgp.he.net ?

Yes. I attempted to do another update and same results, 403.

doktornotor · Aug 25, 2015, 12:16 PM

Apparently you got banned… :P

Jamerson · Aug 25, 2015, 3:28 PM

@doktornotor:

Apparently you got banned… :P

I was curious what kind of website is this ?
http://bgp.he.net

marcelloc · Aug 25, 2015, 5:02 PM

@Jamerson:

I was curious what kind of website is this ?
http://bgp.he.net

Hurricane Electric BGP Toolkit
bgp.he.net/
Welcome to the Hurricane Electric BGP Toolkit. You are visiting from 66.249.79.114 (crawl-66-249-79-114.googlebot.com). United States. Announced as …
‎Looking Glass - ‎BGP Prefix Report - ‎BGP Peer Report - ‎World Report

Bgp.he.net Explained - YouTube

trumee · Aug 26, 2015, 12:18 PM

Hello,

I have selected Germany in the Top20 list and defined it as Deny Inbound. However, snort is still picking up German ip address. Why isnt pfblocker blocking this ip address?

Ip address in snort

PfblockerNG

Firewall rules

Thanks

f34rinc · Aug 26, 2015, 1:09 PM

Trumee - Snort sees all traffic regardless of pfSense firewall rules. Even if you have zero allow inbound rules Snort still sees the attempted connection and will generate an alert block even if its already blocked by pfSense.

RpR · Aug 27, 2015, 10:47 PM

Does the ip4 txt file care about double ip's?
I mean if you have a txt:

1.2.3.4
2.3.4.5
1.2.3.4

will it work or does it require a unique list?
Also if a list exist:
192.168.1.200
192.168.1.0/24
does it work?

BBcan177 · Aug 27, 2015, 10:54 PM

Enable "De-Duplication" in the General Tab. This will remove all duplication's (Including CIDR). If you already have lists downloaded, you can make that change and then execute a "Force Reload".

badger · Aug 28, 2015, 8:59 AM

hi,

outstanding work. Just stumbled about a little problem. I'm using pfblockerNG in combination with CARP. Settings should be synced to configured backup server - which i'm not sure they really get. I can clearly find the rules pfblocker added on the WAN-tab - but on the secondary firewall i can neither find selected entries in the individual tabs nor do filter list under "IPv4"-tab get synced.

Am I doing something wrong - or must sees settings be performed additionally on the backup firewall?

Thank you very much =)

taryezveb · Aug 28, 2015, 8:07 PM

BBcan177,

Was finally able to do what you suggested. Got rid of those IBlock
lists, did not bother to see which list was causing the no internet
issue on reboot. Using your pfBlockerNG_import.php script, posted
here[0] by doktornotor and following superweasel's instructions[1]. No
more reboot issues.

For those that are going to use the pfBlockerNG_import.php script. There
are a few things you still need to do, after following superweasel's
instructions:

Firewall => pfBlockerNG => IPv4 tab

Edit each Alias/List Configuration to:

Enable the lists you want to use. Ie. 'State' to 'ON'.

And 'List Action' as needed.

Do not forget to 'Save' your changes. And also Force an Update and
Reload]; in:

Firewall => pfBlockerNG => Update tab

Once all that is done, will still need to adjust the feeds as they
change from time to time. Take a look at the error.log log file:

Firewall => pfBlockerNG => Logs tab

And this post[2] from BBcan177 for some hints. When done repeat the
Force [Update, Reload].

Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search
did not bring up anything.

Would like to Thank all for the information in this thread. Specifically
for the information above, BBcan177, doktornotor and superweasel.
Especially BBcan177, without whom this would not be possible.

Thank You

pfcode · Aug 28, 2015, 8:16 PM

@taryezveb:

Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search
did not bring up anything.

Its one time use. you may delete it after you were done.

BBcan177 · Aug 29, 2015, 4:09 PM

@taryezveb:

Was finally able to do what you suggested. Got rid of those IBlock lists ….. No more reboot issues.

IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)

Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search did not bring up anything.

I am contemplating adding a feature to allow auto updating the Lists/Feeds for a future release. I am finalizing v2.0 which has DNSBL domain name blocking via Unbound Resolver and hope to get that released soon…

Especially BBcan177, without whom this would not be possible.

Thank You!

foetus · Aug 29, 2015, 4:28 PM

@BBcan177:

@taryezveb:

Was finally able to do what you suggested. Got rid of those IBlock lists ….. No more reboot issues.

IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)

I remember a long time ago I managed to break several boxes that way during the beta period, with a certain list :).

I must say pfblockerng is still my favorite package. Maintained and pretty much bug free. Now I should finally start testing the DNSBL..

serialdie · Aug 29, 2015, 9:33 PM

@cauthier:

Problem solved by BBcan177 with a minor edit to the following file:

/usr/local/www/pfblockerng/pfblockerng.php

Line 192

if (file_exists($local_file)) {
// Determine if URL is Remote or Local
if ($host['host'] == "127.0.0.1" || $host['host'] == $pfb['iplocal'] || empty($host['host'])) {
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));
} else {

Original:
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));

NEW:
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($list_url));

Thanks!

To be very clear, change the variable $local_file to $list_url

I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list.
Once I regain my IP list I can see my updates.

Any ideas?

BBcan177 · Aug 29, 2015, 9:51 PM

@serialdie:

I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list. Once I regain my IP list I can see my updates.

Hi serialdie,

How many pfBNG Aliases did you configure? I think you hit another bug that I haven't merged into the release… If you only have one, create a second Alias and use a list like Spamhaus drop. I think creating a second alias will fix this issue for you... (2 bugs for you in one day :) )

https://www.spamhaus.org/drop/drop.txt

serialdie · Aug 29, 2015, 9:56 PM

@BBcan177:

@serialdie:

I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list. Once I regain my IP list I can see my updates.

Hi serialdie,

How many pfBNG Aliases did you configure? I think you hit another bug that I haven't merged into the release… If you only have one, create a second Alias and use a list like Spamhaus drop. I think creating a second alias will fix this issue for you... (2 bugs for you in one day :) )

https://www.spamhaus.org/drop/drop.txt

HAHAHA! I get a cookie? :P
Yes I do have one list setup only so looks like you nailed it with this one.
I will try that and report back.

Thanks!

cyberbot · Aug 30, 2015, 9:25 PM

I have asked this before but didn't get a answer
is there is a possibility to use PFblockerNG to block porns like proxy server ?