Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 210 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      @heliop100:

      [ There were error(s) loading the rules: /tmp/rules.debug:27: cannot define table pfB_IBlock: Cannot allocate memory - The line in question reads [27]: table persist file /var/db/aliastables/pfB_IBlock.txt]

      Welcome to the club. This is not a package issue, also nothing to do with lack of physical RAM. It's core OS (probably kernel-level) stuff…

      https://redmine.pfsense.org/issues/4876

      1 Reply Last reply Reply Quote 0
      • H
        heliop100
        last edited by

        ok, thanks.

        @doktornotor:

        @heliop100:

        [ There were error(s) loading the rules: /tmp/rules.debug:27: cannot define table pfB_IBlock: Cannot allocate memory - The line in question reads [27]: table persist file /var/db/aliastables/pfB_IBlock.txt]

        Welcome to the club. This is not a package issue, also nothing to do with lack of physical RAM. It's core OS (probably kernel-level) stuff…

        https://redmine.pfsense.org/issues/4876

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          @heliop100:

          Hi

          I'm receiving this error:

          [ There were error(s) loading the rules: /tmp/rules.debug:27: cannot define table pfB_IBlock: Cannot allocate memory - The line in question reads [27]: table persist file /var/db/aliastables/pfB_IBlock.txt]

          The pfSense box has 4Gb ram and are at 7%.

          Thanks.

          Damn IBlock again :)

          Create a second IBlock Alias for this large IBlock list.

          There seems to be an issue with having that many IPs in one Alias table.

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            Well, some of these lists would need splitting feature until the damned bug is found.

            1 Reply Last reply Reply Quote 0
            • I
              interos
              last edited by

              Having issues setting up pfBlockerNG on pfSense.
              Seems like an easy to fix problem if I want to write code; so my assumption is that it is also an easy settings fix that I missed.

              The problem is that when pfBlockerNG ingests a list, it finds spaces in the header and promptly aborts.
              I've been testing several lists from iBlockList via both paid and public lists that demonstrate the same problem.

              The first list I tried was the Pedophile list.  Here is the excerpt from the txt file which is downloaded via a gz file.

              List distributed by iblocklist.com

              Sharing R@ygold Porn:1.9.98.0-1.9.99.255
              Shares Various Illegal Porn:1.9.101.0-1.9.103.255

              In pfBlockerNG, I have the following settings:

              Alias Name: Pedophiles
              List Description: i-BlockList Pedophiles
              Format: gz
              State: On
              URL: http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz&username=MyUserName&pin=MyPIN
              Header: iBlock-Pedo
              List Action: Deny Both
              Update Frequency: Every 4 Hours
              Weekly: Monday
              Enable Logging: Enable
              Enable Custom Port: Blank
              Enable Custom Destination: Blank
              Custom Protocol: any
              IPv4 Custom Addresses: Blank
              Update Custom List: Default

              Running pfSense 2.2.4
              pfBlockerNG 1.10

              Here is the Log File from the UI

              UPDATE PROCESS START [ 10/11/15 17:27:44 ]

              [ http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz&username=MyUserName&pin=MyPinCode ]
              ** TERMINATED - Header contains Blank/International/Special or Spaces

              ===[  Aliastables / Rules  ]================================

              No Changes to Firewall Rules, Skipping Filter Reload
              No Changes to Aliases, Skipping pfctl Update

              UPDATE PROCESS ENDED

              So my first thought is to do pre-processing on these and rehost them.  That seems like a poor choice to just configuring the plugin correctly.  Any thoughts on how to fix this? Thanks in advance.

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @interos:

                ** TERMINATED - Header contains Blank/International/Special or Spaces

                This error means that you entered invalid characters in the Header field. This is the field beside the URL in the IPv4 tab. Do not include spaces, or other special characters when naming the Header…

                So remove the "-" in your Header:    iBlock**-**Pedo
                You can use "_" if you wish instead…

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • H
                  hmh
                  last edited by

                  How-to block social networks with pfBlockerNG

                  Install package Cron
                  Install FreeBSD package manager https://doc.pfsense.org/index.php/Installing_FreeBSD_Packages

                  
                  pkg install whois
                  
                  

                  Add Cron task

                  
                  /usr/local/bin/mwhois -h whois.radb.net -i origin as32934 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/facebook_cidr.raw
                  /usr/local/bin/mwhois -h whois.radb.net -i origin as49988 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/odnoklassniki_cidr.raw
                  /usr/local/bin/mwhois -h whois.radb.net -i origin as47541 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/vk_com_cidr.raw
                  
                  

                  My config
                  update lists once a week on friday

                  In pfBlockerNG add IPv4 List

                  With
                  List Action: Alias Match
                  And
                  Update Frequency: Weekly

                  Add firewall rule:

                  Thats it!

                  P.S.
                  If you already have list (for example) Top20 with List Action: Alias Match, processing of files will be skipped
                  Because nets from facebook_cidr.raw already in list Top20

                  Will be cool if developers add option to block networks by AS number
                  It is very useful

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    Yes v2.0 has whois support built-in… :)

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • SoloamS
                      Soloam
                      last edited by

                      BBcan177, first of all great work on this package, it's a must have to all pfsense boxes.

                      I found a bug! If we can call it a bug, it can be only miss configuration.

                      Lets assume this scenario. 2 Lists, 2 Interfaces.

                      I have list 1 (IP's)
                      1.2.3.4
                      5.6.7.8

                      I have list 2(IP's)
                      1.2.3.4
                      9.10.11.12

                      Both have IP 1.2.3.4

                      I make use of De-Duplication.

                      I set list 1 as Deny on Interface LAN1
                      I set list 2 as Deny on Interface LAN2

                      The logs are all messed up, because He can't find out that from what interface the block 1.2.3.4 is.

                      Best Regards

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        @soloam:

                        I found a bug! If we can call it a bug, it can be only miss configuration.

                        Hi soloam,

                        Its not a bug. When you use de-duplication, only one of the Lists will have IP 1.2.3.4
                        If you want a second list to skip de-duplication, you will need to use "Alias Native" and manually create the firewall rule…

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • SoloamS
                          Soloam
                          last edited by

                          That was my solution. :)

                          Thank you BBcan177.

                          Best Regards
                          Soloam

                          1 Reply Last reply Reply Quote 0
                          • SoloamS
                            Soloam
                            last edited by

                            Hello all, just to make one question.

                            I what to see the complete list of IP's on a alias. So i'm looking at Diagnostics > Tables and selecting the alias table. When I do this I get  a blank page and in pfsense the alert:

                            
                            Crash report details:
                            
                            PHP Errors:
                            [15-Oct-2015 15:55:19] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 115824003 bytes) in /usr/local/www/csrf/csrf-magic.php on line 157
                            
                            

                            Can any one tell me if it's possible to resolve this?

                            Thank you.
                            Best Regards

                            1 Reply Last reply Reply Quote 0
                            • H
                              heliop100
                              last edited by

                              Hi,

                              Are there same way to get Alerts auto-refresh with one filter applied saved?

                              Thanks.

                              1 Reply Last reply Reply Quote 0
                              • D
                                deepakaagrwal
                                last edited by

                                pfblocker NG blocking client of my NAT rule, I have Put  allow NAT rule above any of the pfblocker rules. it is worked but after next cron update, NAT Rule comes down under pfblocker rules automatically. how to resolve it please help.

                                1 Reply Last reply Reply Quote 0
                                • F
                                  f34rinc
                                  last edited by

                                  @deepakaagrwal:

                                  pfblocker NG blocking client of my NAT rule, I have Put  allow NAT rule above any of the pfblocker rules. it is worked but after next cron update, NAT Rule comes down under pfblocker rules automatically. how to resolve it please help.

                                  From pfBlockerNG General tab scroll down to Rule order and change it to
                                  |pfSense Pass/Match | pfB_pass/Match | pfB_Block/Reject|

                                  Click save and go check your rule order it should be the way you want it

                                  1 Reply Last reply Reply Quote 0
                                  • F
                                    Fesoj
                                    last edited by

                                    @BBcan177:

                                    Well its kind of what the name of the package implies :)
                                    So to answer your question, yes the package can create firewall rules to "Block/Reject/Permit/Match"…

                                    Need more info on how you have configured it to help you further.

                                    I am currently studying the thing. Once I think that I know what is going I'll be back…

                                    Some IPs are actually blocked, but I don't know exactly why. I am using "| pfB_Block/Reject | All other Rules | (original format)"

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      @heliop100:

                                      Are there same way to get Alerts auto-refresh with one filter applied saved?

                                      Currently, no… That would require creating a cookie so that when the Alerts Tab reloads each minute, it could load any filter settings stores in the cookie... Maybe in a future release...

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        @soloam:

                                        I what to see the complete list of IP's on a alias. So i'm looking at Diagnostics > Tables and selecting the alias table. When I do this I get  a blank page and in pfsense the alert:

                                        Loading really large files into the browser can cause issues… Try to use the pfBlocker Log tab (Which also might have issues with these large files) or view the files from the shell. Files are located in the following folders:

                                        /var/db/pfblockerng/deny  or /permit or /match or /native

                                        You can view these files with your choice of file editor like vi or ee…

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • H
                                          hulleyrob
                                          last edited by

                                          Sometimes after cron has run and i read the log file it has a very small number at the end which does not correspond to the total addition of the numbers on the block files.

                                          This is fixed with a force reload and the number matches the number above in the log file. (its usually about 1/8th the number)

                                          Another thing I've noticed is the number on the widget shown after deny does not correspond to either of these numbers and I'm not using de-duplication so why is that? And is there anything i can do to investigate?

                                          Thanks

                                          Rob

                                          UPDATE: BBcan177 confirmed this issue is just a timing issue and how to check it.

                                          1 Reply Last reply Reply Quote 0
                                          • F
                                            fher98
                                            last edited by

                                            Hello eveybody,

                                            So im trying to block TOR, I wrote this script to collect TOR exit nodes, and write it to a txt in a web server. So pfBlocker goes and downloads this file and adds the IPs, as shown below;

                                            CRON  PROCESS  START [ 10/22/15 16:55:48 ]
                                            [ TOR01 ]
                                              Remote timestamp: Thu, 22 Oct 2015 22:53:58 GMT
                                              Local  timestamp: Wed, 21 Oct 2015 21:03:50 GMT
                                              Updates Found
                                            UPDATE PROCESS START

                                            [ TOR01 ] Downloading New File –--------------------------------------------------------
                                            Original  Masterfile Outfile    [ Post Duplication count ] 
                                            –--------------------------------------------------------
                                            7375      6416      6416        [ Passed ]                 
                                            –--------------------------------------------------------

                                            ===[  Aliastables / Rules  ]================================

                                            No Changes to Firewall Rules, Skipping Filter Reload

                                            Updating: pfB_TOR
                                            1131 addresses added.783 addresses deleted.

                                            ===[ FINAL Processing ]=====================================

                                            [ Original count  ]  [ 7375 ]

                                            [ Processed Count  ]  [ 6416 ]

                                            ===[ Deny List IP Counts ]===========================

                                            6416 /var/db/pfblockerng/deny/TOR01.txt

                                            ====================[ Last Updated List Summary ]==============

                                            Oct 22 16:53 TOR01

                                            Sanity Check (Not Including IPv6)  ** These two Counts should Match! **
                                            –----------
                                            Masterfile Count    [ 6416 ]
                                            Deny folder Count  [ 6416 ]

                                            Duplication Sanity Check (Pass=No IPs reported)
                                            –----------------------
                                            Masterfile/Deny Folder Uniq check
                                            Deny Folder/Masterfile Uniq check

                                            Sync Check (Pass=No IPs reported)

                                            IPv4 Alias Table IP Total

                                            6416

                                            IPv6 Alias Table IP Total

                                            0

                                            Alias Table IP Counts

                                            6416 /var/db/aliastables/pfB_TOR.txt

                                            pfSense Table Stats

                                            table-entries hard limit  2000000
                                            Table Usage Count        9765

                                            UPDATE PROCESS ENDED [ 10/22/15 16:55:50 ]

                                            Then it adds the rules to the firewall, but is not blocking any of the IPs.  Can you guys help me … what Im doing wrong??

                                            Thanks

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.