PfBlockerNG

doktornotor

Well, some of these lists would need splitting feature until the damned bug is found.

interos

Having issues setting up pfBlockerNG on pfSense.
Seems like an easy to fix problem if I want to write code; so my assumption is that it is also an easy settings fix that I missed.

The problem is that when pfBlockerNG ingests a list, it finds spaces in the header and promptly aborts.
I've been testing several lists from iBlockList via both paid and public lists that demonstrate the same problem.

The first list I tried was the Pedophile list. Here is the excerpt from the txt file which is downloaded via a gz file.

List distributed by iblocklist.com

Sharing R@ygold Porn:1.9.98.0-1.9.99.255
Shares Various Illegal Porn:1.9.101.0-1.9.103.255

In pfBlockerNG, I have the following settings:

Alias Name: Pedophiles
List Description: i-BlockList Pedophiles
Format: gz
State: On
URL: http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz&username=MyUserName&pin=MyPIN
Header: iBlock-Pedo
List Action: Deny Both
Update Frequency: Every 4 Hours
Weekly: Monday
Enable Logging: Enable
Enable Custom Port: Blank
Enable Custom Destination: Blank
Custom Protocol: any
IPv4 Custom Addresses: Blank
Update Custom List: Default

Running pfSense 2.2.4
pfBlockerNG 1.10

Here is the Log File from the UI

UPDATE PROCESS START [ 10/11/15 17:27:44 ]

[ http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz&username=MyUserName&pin=MyPinCode ]
** TERMINATED - Header contains Blank/International/Special or Spaces

===[ Aliastables / Rules ]================================

No Changes to Firewall Rules, Skipping Filter Reload
No Changes to Aliases, Skipping pfctl Update

UPDATE PROCESS ENDED

So my first thought is to do pre-processing on these and rehost them. That seems like a poor choice to just configuring the plugin correctly. Any thoughts on how to fix this? Thanks in advance.

BBcan177

@interos:

** TERMINATED - Header contains Blank/International/Special or Spaces

This error means that you entered invalid characters in the Header field. This is the field beside the URL in the IPv4 tab. Do not include spaces, or other special characters when naming the Header…

So remove the "-" in your Header: iBlock**-**Pedo
You can use "_" if you wish instead…

hmh

How-to block social networks with pfBlockerNG

Install package Cron
Install FreeBSD package manager https://doc.pfsense.org/index.php/Installing_FreeBSD_Packages


pkg install whois

Add Cron task


/usr/local/bin/mwhois -h whois.radb.net -i origin as32934 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/facebook_cidr.raw
/usr/local/bin/mwhois -h whois.radb.net -i origin as49988 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/odnoklassniki_cidr.raw
/usr/local/bin/mwhois -h whois.radb.net -i origin as47541 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/vk_com_cidr.raw

My config
update lists once a week on friday

In pfBlockerNG add IPv4 List

With
List Action: Alias Match
And
Update Frequency: Weekly

Add firewall rule:

Thats it!

P.S.
If you already have list (for example) Top20 with List Action: Alias Match, processing of files will be skipped
Because nets from facebook_cidr.raw already in list Top20

Will be cool if developers add option to block networks by AS number
It is very useful

BBcan177

Yes v2.0 has whois support built-in… :)

Soloam

BBcan177, first of all great work on this package, it's a must have to all pfsense boxes.

I found a bug! If we can call it a bug, it can be only miss configuration.

Lets assume this scenario. 2 Lists, 2 Interfaces.

I have list 1 (IP's)
1.2.3.4
5.6.7.8

I have list 2(IP's)
1.2.3.4
9.10.11.12

Both have IP 1.2.3.4

I make use of De-Duplication.

I set list 1 as Deny on Interface LAN1
I set list 2 as Deny on Interface LAN2

The logs are all messed up, because He can't find out that from what interface the block 1.2.3.4 is.

Best Regards

BBcan177

@soloam:

I found a bug! If we can call it a bug, it can be only miss configuration.

Hi soloam,

Its not a bug. When you use de-duplication, only one of the Lists will have IP 1.2.3.4
If you want a second list to skip de-duplication, you will need to use "Alias Native" and manually create the firewall rule…

Soloam

That was my solution. :)

Thank you BBcan177.

Best Regards
Soloam

Soloam

Hello all, just to make one question.

I what to see the complete list of IP's on a alias. So i'm looking at Diagnostics > Tables and selecting the alias table. When I do this I get a blank page and in pfsense the alert:


Crash report details:

PHP Errors:
[15-Oct-2015 15:55:19] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 115824003 bytes) in /usr/local/www/csrf/csrf-magic.php on line 157

Can any one tell me if it's possible to resolve this?

Thank you.
Best Regards

heliop100

Hi,

Are there same way to get Alerts auto-refresh with one filter applied saved?

Thanks.

deepakaagrwal

pfblocker NG blocking client of my NAT rule, I have Put allow NAT rule above any of the pfblocker rules. it is worked but after next cron update, NAT Rule comes down under pfblocker rules automatically. how to resolve it please help.

f34rinc

@deepakaagrwal:

pfblocker NG blocking client of my NAT rule, I have Put allow NAT rule above any of the pfblocker rules. it is worked but after next cron update, NAT Rule comes down under pfblocker rules automatically. how to resolve it please help.

From pfBlockerNG General tab scroll down to Rule order and change it to
|pfSense Pass/Match | pfB_pass/Match | pfB_Block/Reject|

Click save and go check your rule order it should be the way you want it

Fesoj

@BBcan177:

Well its kind of what the name of the package implies :)
So to answer your question, yes the package can create firewall rules to "Block/Reject/Permit/Match"…

Need more info on how you have configured it to help you further.

I am currently studying the thing. Once I think that I know what is going I'll be back…

Some IPs are actually blocked, but I don't know exactly why. I am using "| pfB_Block/Reject | All other Rules | (original format)"

BBcan177

@heliop100:

Are there same way to get Alerts auto-refresh with one filter applied saved?

Currently, no… That would require creating a cookie so that when the Alerts Tab reloads each minute, it could load any filter settings stores in the cookie... Maybe in a future release...

BBcan177

@soloam:

I what to see the complete list of IP's on a alias. So i'm looking at Diagnostics > Tables and selecting the alias table. When I do this I get a blank page and in pfsense the alert:

Loading really large files into the browser can cause issues… Try to use the pfBlocker Log tab (Which also might have issues with these large files) or view the files from the shell. Files are located in the following folders:

/var/db/pfblockerng/deny or /permit or /match or /native

You can view these files with your choice of file editor like vi or ee…

hulleyrob

Sometimes after cron has run and i read the log file it has a very small number at the end which does not correspond to the total addition of the numbers on the block files.

This is fixed with a force reload and the number matches the number above in the log file. (its usually about 1/8th the number)

Another thing I've noticed is the number on the widget shown after deny does not correspond to either of these numbers and I'm not using de-duplication so why is that? And is there anything i can do to investigate?

Thanks

Rob

UPDATE: BBcan177 confirmed this issue is just a timing issue and how to check it.

fher98

Hello eveybody,

So im trying to block TOR, I wrote this script to collect TOR exit nodes, and write it to a txt in a web server. So pfBlocker goes and downloads this file and adds the IPs, as shown below;

CRON PROCESS START [ 10/22/15 16:55:48 ]
[ TOR01 ]
Remote timestamp: Thu, 22 Oct 2015 22:53:58 GMT
Local timestamp: Wed, 21 Oct 2015 21:03:50 GMT
Updates Found
UPDATE PROCESS START

[ TOR01 ] Downloading New File –--------------------------------------------------------
Original Masterfile Outfile [ Post Duplication count ]
–--------------------------------------------------------
7375 6416 6416 [ Passed ]
–--------------------------------------------------------

===[ Aliastables / Rules ]================================

No Changes to Firewall Rules, Skipping Filter Reload

Updating: pfB_TOR
1131 addresses added.783 addresses deleted.

===[ FINAL Processing ]=====================================

[ Original count ] [ 7375 ]

[ Processed Count ] [ 6416 ]

===[ Deny List IP Counts ]===========================

6416 /var/db/pfblockerng/deny/TOR01.txt

====================[ Last Updated List Summary ]==============

Oct 22 16:53 TOR01

Sanity Check (Not Including IPv6) ** These two Counts should Match! **
–----------
Masterfile Count [ 6416 ]
Deny folder Count [ 6416 ]

Duplication Sanity Check (Pass=No IPs reported)
–----------------------
Masterfile/Deny Folder Uniq check
Deny Folder/Masterfile Uniq check

Sync Check (Pass=No IPs reported)

IPv4 Alias Table IP Total

6416

IPv6 Alias Table IP Total

0

Alias Table IP Counts

6416 /var/db/aliastables/pfB_TOR.txt

pfSense Table Stats

table-entries hard limit 2000000
Table Usage Count 9765

UPDATE PROCESS ENDED [ 10/22/15 16:55:50 ]

Then it adds the rules to the firewall, but is not blocking any of the IPs. Can you guys help me … what Im doing wrong??

Thanks

hulleyrob

Can you show the rules that are added?

fher98

@hulleyrob:

Can you show the rules that are added?

Thank you for your reply, here you go

The first screenshot is WAN, to block from the outside and just added outbound too.
Next is LAN with it its default rules plus the auto block.
The last one is for my office branch, in which the rule for 10.4.2.3 is to get acces to the internet via squid/dansguardian at port 3128 on that pfsense.

rulespfsense1.png_thumb

rulespfsense2.png_thumb

rulespfsense3.png_thumb

hulleyrob

Where are you seeing these, can you post the log showing the TOR traffic entering your network?

Also should the WAN only be blocking TCP TOR traffic? (because it is, not * like the others)

Rob