Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.
-
I have many IP block lists that I am using, and the IPs that they are blocking(or at least I assume they are), are not showing up in the reports. They are set to enable logging in the IPv4 summary in Pfblocker, but nothing shows up in the logs themselves. I think there is probably some small step or check box that I am missing to make them correctly show up. The rules for the Alias' are created, and are correctly placed in the Firewall rules area, but no IP addresses show up in blocks. I have global logging enabled as well as logging enabled in each rule. Any help would be appreciated. Thank you
-
Are you running pfBlockerNG-devel?
Works fine for me.
-
@NogBadTheBad
Yes, I am running the most recent version of devel.
This next one is what I find weird. It looks like the last time it alerted was March 26th, and all of the lists are Enabled, with Global logging, as well as individual logging enabled for each list. Still no recent logs
-
Are there any ip addresses in the PRI3 tables ?
Diagnostics -> Tables
-
@NogBadTheBad It is showing 1408 records ( IP's)
All of the other lists are populated as well. Some with as many as 50,000 records
-
@themadsalvi
Try restarting the pfb_filter from Status / Services tab.Check the log files in tab Firewall / pfBlockerNGLog /Browser, does ip_block.log is updated?
Do you see any blocks in tab Status / System Logs / Firewall / Normal View?
Try to ping some of the IPs in the table (Diagnostics/ Ping).
-
-
restarted, and nothing changed in the alert tab
-
the log file ip_block.log is just showing the blocks from march 26th
3.no blocks at all (empty) for normal, or any other view.
- Cannot ping any of the iPs on the lists. Tried about 5 with no luck. It will not show them as blocked on any logs, though.
-
-
Well check the pfblockerNG logs to see if something break.
Check the system logs to see if they are recentls -al /var/logCheck the FW Rules
Check to see if pfblockerNG is enabled etc.
What happened on march 26 ? -
@RonpfS Firewall rules are the auto configured ones that PFblocker creates when you tell it if you want it in floating rules or not. I am not seeing any errors in the logs. March 26th a blackout happened, which ended up corrupting the PFsense install, and I had to redo it.
No errors in the log, except that it failed to download one list. PFblockerNG is enabled, as the DNSBL are working fine, and have not had the same issue. I have not been able to SSH into my pfsense to check the log date.
-
@themadsalvi said in Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.:
I have not been able to SSH into my pfsense to check the log date.
You can use the Diagnostics / Command Prompt tab.
-
@RonpfS
got it
-
@themadsalvi said in Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.:
March 26th a blackout happened, which ended up corrupting the PFsense install, and I had to redo it.
Well something went wrong then. How did you redo it ? With a fresh install ?
-
Some log files are not updating, you may copy them if you "need" them, then reset the log file from the Status / System Logs / Settings tab
I would run a fsck from the Shell prompt or even better, redo a Fresh install then recover the config.
-
@RonpfS Re-installed the whole thing again and went back to known working configurations, even ones before the march 26th issue, and there are still no IP blocks showing up in the Report tab, nor the firewall logs. Maybe somehow something is getting borked in the install? I am installing through USB with "guided install"
-
@themadsalvi Did you format the partition ? There should not be any file from the older installation after a Fresh install before restoring the config.
Restoring the config also doesn't change /var/log files.
-
@RonpfS yes, I also had it use the whole drive, just in case(to make sure nothing would interfere). I even used a different drive(that never had pfsense installed) to take out the chance of the hard drive being the issue as well.
-
@themadsalvi So after the install, before restoring the config, you have no log files updating ? Even after a reboot ?
-
@RonpfS The log files have not updated since the fresh install was finished yesterday. very strange.
My only guess is that something in the config that is being restored is causing this to happen. Don't know how this could actually occur though, as mentioned before, I went with configs from 2018 where Pfblocker was actually blocking IP's.
-
Start over, check that logging occurs, then redo the config from scratch instead of restoring a config. Keep monitoring logging until you identify the culprit.
-
@RonpfS looks like that is indeed my only option here. I will have to wait until I can make a window for re-do/update in my environment.
