Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Monster pfBlockerNG import script pfBlockerNG_import_gravity.php 224 lists

    Scheduled Pinned Locked Moved pfBlockerNG
    21 Posts 9 Posters 5.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tonymorella
      last edited by

      It includes the ones from the original, but under different alias and header names so it will not overwrite

      Tony

      1 Reply Last reply Reply Quote 0
      • P
        pfcode
        last edited by

        @tonymorella:

        It includes the ones from the original, but under different alias and header names so it will not overwrite

        Tony

        Thanks, is it possible to just import the firehol ones?

        Release: pfSense 2.4.3(amd64)
        M/B: Supermicro A1SRi-2558F
        HDD: Intel X25-M 160G
        RAM: 2x8Gb Kingston ECC ValueRAM
        AP: Netgear R7000 (XWRT), Unifi AC Pro

        1 Reply Last reply Reply Quote 0
        • T
          tonymorella
          last edited by

          @pfcode:

          @tonymorella:

          It includes the ones from the original, but under different alias and header names so it will not overwrite

          Tony

          Thanks, is it possible to just import the firehol ones?

          Could just do the import and turn off the ones you don't want, the Alias are disabled so they will not run until you set them to. Or modify the script before doing the import, delete the ones you don't need.

          1 Reply Last reply Reply Quote 0
          • N
            n3by
            last edited by

            Parse error: syntax error, unexpected 'infolists' (T_STRING), expecting ')' in /usr/local/www/pfBlockerNG_import_gravity.php on line 563
            
            

            … and more

            1 Reply Last reply Reply Quote 0
            • D
              djjerdog
              last edited by

              @n3by:

              Parse error: syntax error, unexpected 'infolists' (T_STRING), expecting ')' in /usr/local/www/pfBlockerNG_import_gravity.php on line 563
              
              

              … and more

              Same error here :/

              1 Reply Last reply Reply Quote 0
              • T
                tonymorella
                last edited by

                @djjerdog:

                @n3by:

                Parse error: syntax error, unexpected 'infolists' (T_STRING), expecting ')' in /usr/local/www/pfBlockerNG_import_gravity.php on line 563
                
                

                … and more

                Same error here :/

                Crud sorry about that typo on line 563

                
                "description"    => "Malware Expect false positives white lists will need to be created",",
                
                

                Change to

                
                "description"    => "Malware Expect false positives white lists will need to be created",
                
                

                Also update file on Github

                1 Reply Last reply Reply Quote 0
                • N
                  n3by
                  last edited by

                  also change this:

                  line 680

                                      "header"     => "trustedsec_atif"),
                  

                  ->

                                      "header"     => "trustedsec_atif")),
                  

                  and
                  line 1020

                              "custom_update"      => "disabled")
                  

                  ->

                              "custom_update"      => "disabled"),
                  
                  1 Reply Last reply Reply Quote 0
                  • J
                    javcasta
                    last edited by

                    Hello.

                    Very good tool for pfBlockerNG :)

                    this is my debugged script that works for me, (zip file attached. or in my web: http://www.javcasta.com/?smd_process_download=1&download_id=33310 )

                    Regads.

                    pfBlockerNG_import_gravity.php.zip

                    Javier Castañón
                    Técnico de comunicaciones, soporte y sistemas.

                    Mi web: https://javcasta.com/

                    Soporte scripting/pfSense https://javcasta.com/soporte/

                    1 Reply Last reply Reply Quote 0
                    • T
                      tonymorella
                      last edited by

                      @n3by:

                      also change this:

                      line 680

                                          "header"     => "trustedsec_atif"),
                      

                      ->

                                          "header"     => "trustedsec_atif")),
                      

                      and
                      line 1020

                                  "custom_update"      => "disabled")
                      

                      ->

                                  "custom_update"      => "disabled"),
                      

                      Thanks for the review, changes updated on github.  This is what happens when your up 24 hours straight :)

                      1 Reply Last reply Reply Quote 0
                      • I
                        iplost
                        last edited by

                        Ok, thanks for update in github

                        One detail,  wget is not by default in pfSense 2.3.2, other way to download script:

                        
                         curl https://raw.githubusercontent.com/tonymorella/pfsense_scipts/master/pfBlockerNG_import_gravity.php > pfBlockerNG_import_gravity.php
                        
                        
                        1 Reply Last reply Reply Quote 0
                        • P
                          pfcode
                          last edited by

                          Some of the lists blocked other lists. e.g. Malware[ransomware_feed] blocks Spam_Bots_PHP[lashback_ubl], Attacks[gofferje_sip] blocks Attacks[blueliv_crimeserver_online, blueliv_crimeserver_recent]. Totally confusion. Also, can't get access from "https://freeapi.blueliv.com"

                          Release: pfSense 2.4.3(amd64)
                          M/B: Supermicro A1SRi-2558F
                          HDD: Intel X25-M 160G
                          RAM: 2x8Gb Kingston ECC ValueRAM
                          AP: Netgear R7000 (XWRT), Unifi AC Pro

                          1 Reply Last reply Reply Quote 0
                          • T
                            tonymorella
                            last edited by

                            @pfcode:

                            Some of the lists blocked other lists. e.g. Malware[ransomware_feed] blocks Spam_Bots_PHP[lashback_ubl], Attacks[gofferje_sip] blocks Attacks[blueliv_crimeserver_online, blueliv_crimeserver_recent]. Totally confusion. Also, can't get access from "https://freeapi.blueliv.com"

                            Good point,  by default I added all the URLs to a custom allow lists so they can not block each other :) Also you need to create and account to access the blueliv.com API

                            1 Reply Last reply Reply Quote 0
                            • P
                              pfcode
                              last edited by

                              @tonymorella:

                              @pfcode:

                              Some of the lists blocked other lists. e.g. Malware[ransomware_feed] blocks Spam_Bots_PHP[lashback_ubl], Attacks[gofferje_sip] blocks Attacks[blueliv_crimeserver_online, blueliv_crimeserver_recent]. Totally confusion. Also, can't get access from "https://freeapi.blueliv.com"

                              Good point,  by default I added all the URLs to a custom allow lists so they can not block each other :) Also you need to create and account to access the blueliv.com API

                              Added 88.198.202.51 (blueliv.com) into the pfBlockerNG surpress list, but it was still blocked by gofferje,  What am I missing?

                              Release: pfSense 2.4.3(amd64)
                              M/B: Supermicro A1SRi-2558F
                              HDD: Intel X25-M 160G
                              RAM: 2x8Gb Kingston ECC ValueRAM
                              AP: Netgear R7000 (XWRT), Unifi AC Pro

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                @pfcode:

                                Also, can't get access from "https://freeapi.blueliv.com"

                                Added 88.198.202.51 (blueliv.com) into the pfBlockerNG surpress list, but it was still blocked by gofferje,  What am I missing?

                                I haven't used blueliv, but your not checking the correct domain name…

                                ping freeapi.blueliv.com

                                PING f01.blueliv.com (88.198.51.46): 56 data bytes

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • P
                                  pfcode
                                  last edited by

                                  @BBcan177:

                                  @pfcode:

                                  Also, can't get access from "https://freeapi.blueliv.com"

                                  Added 88.198.202.51 (blueliv.com) into the pfBlockerNG surpress list, but it was still blocked by gofferje,  What am I missing?

                                  I haven't used blueliv, but your not checking the correct domain name…

                                  ping freeapi.blueliv.com

                                  PING f01.blueliv.com (88.198.51.46): 56 data bytes

                                  Hi,

                                  if I manually add the ip in the suppress list and apply the changes,  Should I do a update or force reload?

                                  Release: pfSense 2.4.3(amd64)
                                  M/B: Supermicro A1SRi-2558F
                                  HDD: Intel X25-M 160G
                                  RAM: 2x8Gb Kingston ECC ValueRAM
                                  AP: Netgear R7000 (XWRT), Unifi AC Pro

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnabbot
                                    last edited by

                                    I think you should put a warning about false positives on the bots and organisations ones. I had to delete them.

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      tonymorella
                                      last edited by

                                      @johnabbot:

                                      I think you should put a warning about false positives on the bots and organisations ones. I had to delete them.

                                      Sure why not :)  I used Organisations for allow rules not block, did you notice issues with this one??

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        johnabbot
                                        last edited by

                                        blocking emails to/from me.com from a local mail server I think it was.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          motific
                                          last edited by

                                          Thanks for the script, it was quite a timesaver.

                                          A number of the lists ought to end up in the DNSBL section rather than IP4 (Privacy/SomeoneWhoCares is one example) - if you're maintaining the script that's something to check.  If I get some time I might take a look.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.