pfBlockerNG-devel feedback

occamsrazor

@ronpfs said in pfBlockerNG-devel feedback:

Yes you can do that as well.
You should also inspect the content of the tables in the Logs tab.

Nice. Thanks a lot for clearing that up. When I go to the top two items in the dropdown seen here I can see all the IPs including the ones converted from domains, so I think that is all working correctly....

0_1535744394594_Screen Shot 2018-08-31 at 22.38.02.jpg

One final (I hope) question. Is there a way to keep one single domain whitelist that gets used for both:
a) Conversion to IPs for IPV4 whitelisting
b) Use in DNSBL whitelisting
I get the impression the IPV4 and DNSBL functions operate very separately..... and that you would have to keep domain whitelist in the two places to be sure.

RonpfS

@occamsrazor
IPV4 operates in the IP space. It can take domain names and convert them to IPs before building the tables.

DNSBL operates in the DNS space, that is only with domain names.

Instead of using Whitelist, why don't you suppress IPs instead?

occamsrazor

@ronpfs said in pfBlockerNG-devel feedback:

Instead of using Whitelist, why don't you suppress IPs instead?

What would be the advantage of that way vs whitelist? In the IPV4 Suppression box I thought you could only enter ranges not individual IPs. But I guess you can enter them with /32 netmask, right?

JeGr

@BBcan177 just a quick question: I checked on pfBlockerNG devel on a 2.4.4 snapshot system. Still shows php56-5.6.34 as dependency. As 2.4.4 runs on php7.2 I'm wondering, why pfBNG requires usage of the old PHP version (in package manager listing)?

BBcan177

@jegr said in pfBlockerNG-devel feedback:

I checked on pfBlockerNG devel on a 2.4.4 snapshot system. Still shows php56-5.6.34 as dependency. As 2.4.4 runs on php7.2 I'm wondering, why pfBNG requires usage of the old PHP version (in package manager listing)?

The pfSense devs manage that integration. Here is the commit to the makefile:
https://github.com/pfsense/FreeBSD-ports/commit/54dd3d529ac6a55cd0c1e05f0c3956fb668d7cbd

There seem to be some hiccups with this but I believe it to be part of the base pfSense code.

JeGr

@bbcan177 no problem, just wanted to ask as that drew my attention :)

Edit: My mistake, I set the system to "stable" after updating to 2.4.4-snapshots, to get it to 2.4.4-Release without any further snapshot. That switched Packages back to displaying 2.4.3 info, so the PHP version was old. Switching it back to snaps shows a correct 7.2.9 - my bad!

BBcan177

@jegr said in pfBlockerNG-devel feedback:

@bbcan177 no problem, just wanted to ask as that drew my attention :)

I did some tests and the only way I could get the PHP version to be out of sync was to set the 2.4.4 machine to use the pfSense 2.3.x branch ?

EDIT: Haha... yes, I was typing as you made your edit !! :)

JeGr

@bbcan177 said in pfBlockerNG-devel feedback:

@jegr said in pfBlockerNG-devel feedback:

@bbcan177 no problem, just wanted to ask as that drew my attention :)

I did some tests and the only way I could get the PHP version to be out of sync was to set the 2.4.4 machine to use the pfSense 2.3.x branch ?

EDIT: Haha... yes, I was typing as you made your edit !! :)

Haha I was curious, too, as I read through the GIT intel so I backtracked and facepalmed over my own stupidity. Serves me right, better double check my facts before calling bugs

occamsrazor

No big deal but just to let you know these feeds have been getting download errors for the last few days..... at least for me.

0_1536825395478_download fails.jpg

bartkowski

@BBcan177 Can you see my post https://forum.netgate.com/topic/135362/geoip-policy-based-routing-not-working-with-pfblockerng-devel
To me it appears as an issue with the new version.

BBcan177

@occamsrazor

Blutmagie needs to have the State set to "flex" since the TLS settings or the certificates of the site are poor.

For the Dan.me feed, they have rate-limiting. You can move that feed into its own Alias "TOR2" and set it update every 4 hours... I might have to adjust the Feeds Tab to account for this issue. I have been after Dan.me for several months to try to improve this issue. Part of the problem is that pfBlockerNG checks the last-time-stamp of the Feed and Dan.me is counting this as a download attempt which causes the rate-limiting issue.

un1que

Since some days I have some troubles using pfBlockerNG. From time to time there appears a notification:

There were error(s) loading the rules: /tmp/rules.debug:52: cannot define table pfB_Level4_v4: Cannot allocate memory - The line in question reads [52]: table &lt;pfB_Level4_v4&gt; persist file &quot;/var/db/aliastables/pfB_Level4_v4.txt&quot;
@ 2018-09-16 00:38:28

Has anyone an idea what the solution might be?

BBcan177

@un1que said in pfBlockerNG-devel feedback:

Cannot allocate memory

Need to increase the pfSense > System > Advanced > Firewall & NAT > Firewall Maximum Table Entries
The package defaults it to "2000000", but you might need to increase that value depending on how many Aliastable entries you have.

un1que

@bbcan177
Thanks for your reply! I’ll try that.

I now reloaded the IP values via force update and at the end of that process I found those numbers:

pfSense Table Stats
-------------------
table-entries hard limit  2000000
Table Usage Count         104384

Before your hint I had 600000 table entries set in advanced settings. But for only about 100k used entries it should have been enough, isn’t it?

RonpfS

And the table-entries hard limit was showing 600000 in pfblockerng.log before you made the change ?

un1que

@ronpfs
I can’t say yet, but I think at the end of the force update process it was showing 600k instead of 2mio now, yes.

Grimson

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

BBcan177

@grimson said in pfBlockerNG-devel feedback:

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

Can you check this:
https://forum.netgate.com/topic/135893/getting-crash-reports-after-updating-to-2-4-4/24

php -v
php_pfb -v

Versions should match.

You can also try to start from the shell to see if it shows any errors:

/usr/local/etc/rc.d/pfb_filter.sh restart

BBcan177

@grimson said in pfBlockerNG-devel feedback:

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

I think its running:

ps auxww | grep pfb

/usr/local/bin/php_pfb -f /usr/local/pkg/pfblockerng/pfblockerng.inc filterlog (php)

But now thats its a symlink and not a link, the Services function might not see the executable "php_pfb".

So as long as your still getting firewall events in the Alerts/Reports tab, then it is still working, just not showing that in the the services status as "running".

Still investigating...

occamsrazor

@grimson said in pfBlockerNG-devel feedback:

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

Just to chime in... same situation here, was shown as running Services before I upgraded to v2.2.5_16 but not now.