Unofficial E2guardian package for pfSense

marcelloc

I've tried the usual re applying black list, reinstall, uninstall then install. No joy yet.

Here is the output of one of my testing vms with no hacks or code changes(using 0.4.2.5).

[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root: pkg install -f e2guardian
Updating Unofficial repository catalogue...
Unofficial repository is up to date.
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
        e2guardian: 4.1.1_11 -> 4.1.1_12 [Unofficial]

Number of packages to be upgraded: 1

587 KiB to be downloaded.

Proceed with this action? [y/N]: Y
[1/1] Fetching e2guardian-4.1.1_12.txz: 100%  587 KiB 601.5kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Upgrading e2guardian from 4.1.1_11 to 4.1.1_12...
Extracting e2guardian-4.1.1_12: 100%
You may need to manually remove /usr/local/etc/e2guardian/e2guardian.conf if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/e2guardianf1.conf if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/authplugins/ipgroups if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirusextensionlist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirusmimetypelist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirussitelist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirusurllist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/exceptioniplist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/filtergroupslist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/bannedsitelistwithbypass if it is no longer needed.
Message from e2guardian-4.1.1_12:
===>   Please Note:

*******************************************************************************
       This port has created a log file named e2guardian.log that can get
       quite large.  Please read the newsyslog(8) man page for instructions
       on configuring log rotation and compression.

       This port has been converted using old dansguardian-devel port
       Let me know how it works (or not). (Patches always welcome.)
*******************************************************************************
[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root:

Then, gone to GUI and saved config under blacklist tab and hit save

Back to console and tried to start and restart e2g


[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root: /usr/local/etc/rc.d/e2guardian.sh start
kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 20480 -> 20480
e2guardian already running?  (pid=84327).

[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root: /usr/local/etc/rc.d/e2guardian.sh restart
kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 20480 -> 20480
Stopping e2guardian.
Waiting for PIDS: 84327.
Starting e2guardian.

error_using_fully_report_template.PNG_thumb

error_using_html_template.PNG_thumb

pfsensation

@marcelloc:

@pfsensation:

I've tried the usual re applying black list, reinstall, uninstall then install. No joy yet.

Here is the output of one of my testing vms with no hacks or code changes(using 0.4.2.5).

[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root: pkg install -f e2guardian
Updating Unofficial repository catalogue...
Unofficial repository is up to date.
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
        e2guardian: 4.1.1_11 -> 4.1.1_12 [Unofficial]

Number of packages to be upgraded: 1

587 KiB to be downloaded.

Proceed with this action? [y/N]: Y
[1/1] Fetching e2guardian-4.1.1_12.txz: 100%  587 KiB 601.5kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Upgrading e2guardian from 4.1.1_11 to 4.1.1_12...
Extracting e2guardian-4.1.1_12: 100%
You may need to manually remove /usr/local/etc/e2guardian/e2guardian.conf if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/e2guardianf1.conf if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/authplugins/ipgroups if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirusextensionlist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirusmimetypelist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirussitelist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/contentscanners/exceptionvirusurllist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/exceptioniplist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/filtergroupslist if it is no longer needed.
You may need to manually remove /usr/local/etc/e2guardian/lists/bannedsitelistwithbypass if it is no longer needed.
Message from e2guardian-4.1.1_12:
===>   Please Note:

*******************************************************************************
       This port has created a log file named e2guardian.log that can get
       quite large.  Please read the newsyslog(8) man page for instructions
       on configuring log rotation and compression.

       This port has been converted using old dansguardian-devel port
       Let me know how it works (or not). (Patches always welcome.)
*******************************************************************************
[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root:

Then, gone to GUI and saved config under blacklist tab and hit save

Back to console and tried to start and restart e2g


[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root: /usr/local/etc/rc.d/e2guardian.sh start
kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 20480 -> 20480
e2guardian already running?  (pid=84327).

[2.3.4-RELEASE][root@pfSense.yyyyyyy.br]/root: /usr/local/etc/rc.d/e2guardian.sh restart
kern.ipc.somaxconn: 16384 -> 16384
kern.maxfiles: 131072 -> 131072
kern.maxfilesperproc: 104856 -> 104856
kern.threads.max_threads_per_proc: 20480 -> 20480
Stopping e2guardian.
Waiting for PIDS: 84327.
Starting e2guardian.

HMMm….. Tried again it seems to work now, look:

It's like 4.x has a mind of its own. However, it still doesn't show the categories of the sites that are blocked by the blacklist.

Mr. Jingles

@Mr.:

Thank you, pfsensation :)

Of course, by now I have no clue which directories ;D

Would you know?

Thank you.

I see you are online, pfsensation: would you know which directories?

Thank you :D

marcelloc

@Mr.:

would you know which directories?

run on console/ssh:

/usr/local/bin/php /usr/local/www/e2guardian.php fetch_blacklist

Mr. Jingles

@marcelloc:

@Mr.:

would you know which directories?

run on console/ssh:
/usr/local/bin/php /usr/local/www/e2guardian.php fetch_blacklist

Thank you Marcello.

It downloads fine. I then do the same save/reapply/save/apply, and we get the same errors.

It perhaps indeed is what pfsensation said, a permission/directories problem. Which directories?

e2guardian_005.jpg_thumb

e2guardian_006.jpg_thumb

marcelloc

Post the results of

ls -l /usr/local/etc/dansguandian/lists/blacklists

Mr. Jingles

@marcelloc:

Post the results of

ls -l /usr/local/etc/dansguandian/lists/blacklists

Thank you Marcello.

I changed it into dansguaRdian, but it comes back with:


ls: /usr/local/etc/dansguardian/lists/blacklist: No such file or directory

marcelloc

Sorry for the typo

It's```

ls -l /usr/local/etc/e2guardian/lists/blacklists

pfsensation

@Mr.:

@marcelloc:
@Mr.:

would you know which directories?

run on console/ssh:
/usr/local/bin/php /usr/local/www/e2guardian.php fetch_blacklist
Thank you Marcello.

It downloads fine. I then do the same save/reapply/save/apply, and we get the same errors.

It perhaps indeed is what pfsensation said, a permission/directories problem. Which directories?

My E2Guardian is now fully working fine, without crashes. However -HOST- shows DNS error and setting "log client hostnames" under general tab causes the daemon to crash. So make sure you check chose things first

These are the steps I took to properly fix the crashes, probably all of them together made it work:

First uninstalled and reinstalled E2Guardian
Downloaded the blacklist and applied it under the blacklists tab
Opened up FileZilla (FTP Client) navigated over to : /usr/local/etc/e2guardian Then set permissions to 644, recursively into all directories within it too. You can do this via SSH also, but I prefer using an actual FTP client, that way I can see all the files and directories in a GUI.

After that, I gave the entire pfSense box a restart, and it seems to be working. I've had it running for a day with MITM.

Try the following out, and see if it works for you.

@Marcelloc, can you write an update on GitHub regarding the blacklist category issue? I'm not fully aware of what you tried to fix it, but it doesn't seem to be fixed until now, even for you (can see from screenshots) : https://github.com/e2guardian/e2guardian/issues/244

Thanks

Mr. Jingles

Thank you Marcello, and thank you pfsensation :)

I've attached the output of Marcello's ls command. I will next try what pfsensation suggested.

Thank you.

e2guardian_007.jpg_thumb

Mr. Jingles

:-[ :-[ :-[

I did:

[code]
chmod -R 644 /usr/local/etc/e2guardian
/usr/local/bin/php /usr/local/www/e2guardian.php fetch_blacklist
Then I did reapply blacklist, save, daemon tab - save: still nothing, service still doesn't start:

| Jul 1 03:30:56 | php-fpm | 87924 |

/pkg_edit.php: The command '/usr/local/etc/rc.d/e2guardian.sh start' returned exit code '1', the output was 'kern.ipc.somaxconn: 16384 -> 16384 kern.maxfiles: 131072 -> 131072 kern.maxfilesperproc: 104856 -> 104856 kern.threads.max_threads_per_proc: 20480 -> 20480 Starting e2guardian. Error reading file /usr/local/etc/e2guardian/lists/blacklists/adult/urls: No such file or directory Error opening file: /usr/local/etc/e2guardian/lists/blacklists/adult/urls Error reading: /usr/local/etc/e2guardian/lists/bannedurllist.g_Default Error opening bannedurllist Error opening filter group config: /usr/local/etc/e2guardian/e2guardianf1.conf Error in reading filter group files Error reading filter group conf file(s). Error parsing the e2guardian.conf file or other e2guardian configuration files /usr/local/etc/rc.d/e2guardian.sh: WARNING: failed to start e2guardian' [/q][/t][/t]

marcelloc

Access your acls under url tab and check what is enabled. It's looking for a file that doesn't exists on shallalist.

Select categories that shows under include select combo box. They are from current applied blacklist.

There is no need to change file permission.

banned_url.PNG_thumb

Mr. Jingles

Thank you for your reply, Marcello :)

I'm trying to understand what you mean with " It's looking for a file that doesn't exists on shallalist".

In the top Include box I can select, for example, adv urls, spyware urls, tracker urls. However, in the next Config box, none of these exist. What does this mean? what do I need to do here then?

Per your: "Select categories that shows under include select combo box. They are from current applied blacklist"

Could you give a concrete example?

Thank you very much for your help :P

marcelloc

Take a look or send a screenshot on the same field I've pushed on my last post.

techbee

hi marcelloc,

could you possible update your setup and configuration procedure so that it is up to date and tidy up.

marcelloc

@techbee:

hi marcelloc,

could you possible update your setup and configuration procedure so that it is up to date and tidy up.

On a clean install, just save setup on GUI and use.
With previous install, check error messages.

pfsensation

Just an update,

My E2 Guardian has now been rock solid after the last update. However - HOST- shows dns error, not sure why because in my pfSense DHCP leases it shows the host name.

Also Marcello, I replied to the transparent proxy issue you reported on GitHub. Since Phillip will add the feature in V5 do you know if we can use pfSense to redirect the traffic for now? I've been successful in doing it for port 80 (HTTP) but not port 443 (HTTPS).

Thank you for bearing with me, and pushing out the necessary updates.

jetberrocal

@pfsensation:

Just an update,

My E2 Guardian has now been rock solid after the last update. However - HOST- shows dns error, not sure why because in my pfSense DHCP leases it shows the host name.

Also Marcello, I replied to the transparent proxy issue you reported on GitHub. Since Phillip will add the feature in V5 do you know if we can use pfSense to redirect the traffic for now? I've been successful in doing it for port 80 (HTTP) but not port 443 (HTTPS).

Thank you for bearing with me, and pushing out the necessary updates.

Did you tried this:
https://www.howtogeek.com/295048/how-to-configure-a-proxy-server-on-android/

You hardcode the proxy values or enter the url of the PAC file.

marcelloc

@pfsensation:

Since Phillip will add the feature in V5 do you know if we can use pfSense to redirect the traffic for now? I've been successful in doing it for port 80 (HTTP) but not port 443 (HTTPS).

I'm using this way for transparent proxy with no MITM

https://forum.pfsense.org/index.php?topic=128116.msg730725#msg730725

For MITM clients I'm using WPAD.

Mr. Jingles

@marcelloc:

Take a look or send a screenshot on the same field I've pushed on my last post.

Thank you Marcello.

Ok, I've only selected porn (pic8).

In config, it says this (txt).

There is something else weird: in include there are sections that are available in config. For example, spyware and hacking are available in include, but not in config (see pic9 and *.txt).

e2guardian_008.jpg_thumb

e2guardian_009.jpg_thumb
e2guardian_config.txt