PfBlockerNG

pfcode · Sep 12, 2015, 1:38 AM

@pfcode:

HI,

I have found that if I'm using RAMDisk, After a pfSense start/restart, the pfBlockerNG Alerts page list 'No match' on all alerts until I manually do a force update. I thought the lists should be all loaded after a root/start. Obviously it didn't when using RAMDisk. No issue when not using RAM Disk. This is annoying. Am I missing something?

Well this is the issue with RamDisk installations… On a reboot the /var folder is wiped out… That would include any other packages that store data there...

I have added a workaround to copy the final "/var/db/aliastables/pfB_*" files… and restore those after a reboot so that the tables and firewall rules don't have any issues...

However, the rest of the files are gone, and the only way to recover is with a "Force Reload" or wait for the next Cron task to execute. The issue with a RamDisk is always size, so Its not appropriate to try and archive all the files and restore them... Not to mention that any time Cron ran, or you used a "Force" command, it would archive the files and take some time (I assume) depending on how many Lists you use... Whats the benefit to use a Ramdisk anyways?

Thanks for the clarification. My pfSense box is using SSD, and 16GB RAM, lots of memory, so I thought why not use RAM Disk.

The cosmic gate · Sep 12, 2015, 5:34 PM

Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .

Or is the only way to solve this, to create floating rules ?

doktornotor · Sep 12, 2015, 5:51 PM

If you need a particular sorting, then use one of the Alias actions and create the rules manually, instead of using Block/Reject.

BBcan177 · Sep 12, 2015, 6:03 PM

@The:

Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .

Or is the only way to solve this, to create floating rules ?

Did you try to change the "Rule Order" in the General Tab? Otherwise for more complicated setups, you will need to use "Alias" type rules as Dok indicated.

The cosmic gate · Sep 13, 2015, 11:21 AM

@The:

Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .

Or is the only way to solve this, to create floating rules ?

Just to be sure what i'am trying to reach:
This is the standard setting:

I changed this otherwise G-mail / e-mail wont arrive on the Zimbra server i run:

after for example 1 hour everything is the same as the standard setting en e-mail stop's arriving .

What to do ?
Create some floating rules (as i read in the Wiki)
create some alias as you replied ?

The cosmic gate · Sep 13, 2015, 11:22 AM

@BBcan177:

@The:

Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .

Or is the only way to solve this, to create floating rules ?

Did you try to change the "Rule Order" in the General Tab? Otherwise for more complicated setups, you will need to use "Alias" type rules as Dok indicated.

I change this rules order using: firewall -> rules

doktornotor · Sep 13, 2015, 11:23 AM

Why the hell are you blocking the entire world? Please, read this thread on the implicit "default deny" rule on WAN and general sane usage notes.

BBcan177 · Sep 13, 2015, 3:42 PM

@The:

What to do ?
Create some floating rules (as i read in the Wiki)
create some alias as you replied ?

In v1.10 I added some additional text to the TOP20 tab to help with this issue. (See Note:)

Instead of blocking the world, you can change all of the "Deny" rule(s) to be a single "Permit Inbound" Rule…

For example: It seems like you want to allow South America only to hit your Zimbra mail server, follow the instructions below: ( BTW: Big fan of Zimbra!! )

Remove all of your existing Country Blocking Rules.
Remove all of your existing "Pass" Firewall rules for Zimbra.
You could also just disable these pass rules and keep them there as a backup, if pfBNG is disabled for any reason.
Goto "South America" Country Tab.
Select the IPv4/6 Countries that you want to allow access.
List Action: "Permit Inbound"
In "Advanced Inbound Firewall Rule Settings":
- Enable the Custom Port checkbox
  
  Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_Ports" (Change the alias name to what ever you wish), and enter all of the Mail ports in the alias.
- Enable Custom Destination checkbox
  
  Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_IPs"
  (Change the alias name to what ever you wish), and enter all of the Mail Destination IPs (ie: the 192.x.x.x address from your screenshot above)
- Custom Protocol: Select "TCP/UDP" (Or as required)

Hope that helps!

The cosmic gate · Sep 14, 2015, 7:31 AM

@doktornotor:

Why the hell are you blocking the entire world? Please, read this thread on the implicit "default deny" rule on WAN and general sane usage notes.

Just to be sure ;-)
I followed soms YouTube configuration instructions that told me to configure it this wat
Yesterday i start reading this topic, stopped at page 20, but at this moment there's nothing about the default een rule :( or maybe i was to tired to find it ?

The cosmic gate · Sep 14, 2015, 6:46 PM

@BBcan177:

@The:

What to do ?
Create some floating rules (as i read in the Wiki)
create some alias as you replied ?

In v1.10 I added some additional text to the TOP20 tab to help with this issue. (See Note:)

Instead of blocking the world, you can change all of the "Deny" rule(s) to be a single "Permit Inbound" Rule…

For example: It seems like you want to allow South America only to hit your Zimbra mail server, follow the instructions below: ( BTW: Big fan of Zimbra!! )

Remove all of your existing Country Blocking Rules.

Remove all of your existing "Pass" Firewall rules for Zimbra.
You could also just disable these pass rules and keep them there as a backup, if pfBNG is disabled for any reason.

Goto "South America" Country Tab.

Select the IPv4/6 Countries that you want to allow access.

List Action: "Permit Inbound"

In "Advanced Inbound Firewall Rule Settings":

Enable the Custom Port checkbox

Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_Ports" (Change the alias name to what ever you wish), and enter all of the Mail ports in the alias.

Enable Custom Destination checkbox

Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_IPs"
(Change the alias name to what ever you wish), and enter all of the Mail Destination IPs (ie: the 192.x.x.x address from your screenshot above)

Custom Protocol: Select "TCP/UDP" (Or as required)

Hope that helps!

Big thnx for this ! I'll changed the configuration exactly as above.
What should be the list action for the rest of the clean selected country's : deny inbound ?

Btw the only reason why i need N.A enabled is to recieve mail from gmail users who mail me at the Zimbra server

doktornotor · Sep 14, 2015, 6:48 PM

@The:

What should be the list action for the rest of the clean selected country's : deny inbound ?

ZOMG. What's not allowed is already denied by default… You need no other action.

apbirch67 · Sep 15, 2015, 12:44 AM

Hello, I was using pfBlocker and had a list that was built for just VZW Ip's. Here is the list as it is still in the firewall.

https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerVZW_Custom

Is this still be updated? If not how do I find the source of that list to rebuild it in NG under the IPV4 Ailias tab

Thanks for the pointers.

BBcan177 · Sep 15, 2015, 3:43 AM

@apbirch67:

Hello, I was using pfBlocker and had a list that was built for just VZW Ip's. Here is the list as it is still in the firewall.

https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerVZW_Custom

Is this still be updated? If not how do I find the source of that list to rebuild it in NG under the IPV4 Ailias tab

Thanks for the pointers.

Hi apbirch67,

The old pfBlocker files are located in the following folder:

ls /usr/local/pkg/pfblocker

The files are a longfile name like:

a5535b15c63d449c51574971f9ab6098.txt

These files are an md5 hash of the URL used for each List. View each file to determine which file is the one you are looking for.

The cosmic gate · Sep 15, 2015, 7:02 AM

@doktornotor:

@The:

What should be the list action for the rest of the clean selected country's : deny inbound ?

ZOMG. What's not allowed is already denied by default… You need no other action.

Excuse me for beeing an newbee user . But i'll try to learn everyday and want to have the network as save as possible (like all the other people here i thing ;) )
The question is not that bad i think, because when you look at the rule action it's disabled .

BBcan177 · Sep 16, 2015, 4:12 AM

Unfortunately BGP has blocked access to "non-humans".

In the interim, I have posted some of these [ Domain -> IPs ] lists. I will try to keep them updated as time permits.

Please use the "html" format:

Facebook
https://gist.githubusercontent.com/BBcan177/fb389885e4fb39508bcc/raw
Twitter
https://gist.githubusercontent.com/BBcan177/0caa6ae9badee2206660/raw
Spotify
https://gist.githubusercontent.com/BBcan177/58ae5e02838cea68de25/raw
Netflix
https://gist.githubusercontent.com/BBcan177/419897fb723a24323f1f/raw
Dropbox
https://gist.githubusercontent.com/BBcan177/3ddcf1ef916f70b9bc26/raw

Also posted are two feeds which I have collected from recent Security Blogs etc:
MS_1
https://gist.githubusercontent.com/BBcan177/bf29d47ea04391cb3eb0/raw
MS_3
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

heliop100 · Sep 30, 2015, 10:19 PM

Hi

First very thanks to BBcan177 for the package.

These IP list are a strange world

The list: http://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=p2p&archiveformat=gz

are blocking that: http://www.reputationauthority.org/toptens.php

Cheers.

BBcan177 · Sep 30, 2015, 10:55 PM

@heliop100:

Hi

First very thanks to BBcan177 for the package.

These IP list are a strange world

The list: http://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=p2p&archiveformat=gz

are blocking that: http://www.reputationauthority.org/toptens.php

Cheers.

I am not a big fan of IBlock lists… They tend to have a lot of False positives... You can always send them a FP report.

heliop100 · Oct 1, 2015, 11:09 PM

Hi,

Are there some way to backup/restore pfbloquerNG settings (or IPV4/IPV6 lists) from one pfsense to another?

I use "pfBlockerNG_import.php" and made some changes, on a lab box. Will be nice to export that to the production one.

Thanks.

doktornotor · Oct 2, 2015, 2:54 AM

You mean, like… the invisible Sync tab?

brandur · Oct 2, 2015, 11:53 AM

Hi
I'm new around here(with pfSense and pfBlockerNG), so please be gentle ;)
First of all. What a great package. You did a awesome job.

Back to my question. I was wondering if there are any plans to support this AmazonAWS json IP list https://ip-ranges.amazonaws.com/ip-ranges.json ?

Some extra info: http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
Thank you.