Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.
-
Are there any ip addresses in the PRI3 tables ?
Diagnostics -> Tables
-
@NogBadTheBad It is showing 1408 records ( IP's)
All of the other lists are populated as well. Some with as many as 50,000 records
-
@themadsalvi
Try restarting the pfb_filter from Status / Services tab.Check the log files in tab Firewall / pfBlockerNGLog /Browser, does ip_block.log is updated?
Do you see any blocks in tab Status / System Logs / Firewall / Normal View?
Try to ping some of the IPs in the table (Diagnostics/ Ping).
-
-
restarted, and nothing changed in the alert tab
-
the log file ip_block.log is just showing the blocks from march 26th
3.no blocks at all (empty) for normal, or any other view.
- Cannot ping any of the iPs on the lists. Tried about 5 with no luck. It will not show them as blocked on any logs, though.
-
-
Well check the pfblockerNG logs to see if something break.
Check the system logs to see if they are recentls -al /var/logCheck the FW Rules
Check to see if pfblockerNG is enabled etc.
What happened on march 26 ? -
@RonpfS Firewall rules are the auto configured ones that PFblocker creates when you tell it if you want it in floating rules or not. I am not seeing any errors in the logs. March 26th a blackout happened, which ended up corrupting the PFsense install, and I had to redo it.
No errors in the log, except that it failed to download one list. PFblockerNG is enabled, as the DNSBL are working fine, and have not had the same issue. I have not been able to SSH into my pfsense to check the log date.
-
@themadsalvi said in Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.:
I have not been able to SSH into my pfsense to check the log date.
You can use the Diagnostics / Command Prompt tab.
-
@RonpfS
got it
-
@themadsalvi said in Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.:
March 26th a blackout happened, which ended up corrupting the PFsense install, and I had to redo it.
Well something went wrong then. How did you redo it ? With a fresh install ?
-
Some log files are not updating, you may copy them if you "need" them, then reset the log file from the Status / System Logs / Settings tab
I would run a fsck from the Shell prompt or even better, redo a Fresh install then recover the config.
-
@RonpfS Re-installed the whole thing again and went back to known working configurations, even ones before the march 26th issue, and there are still no IP blocks showing up in the Report tab, nor the firewall logs. Maybe somehow something is getting borked in the install? I am installing through USB with "guided install"
-
@themadsalvi Did you format the partition ? There should not be any file from the older installation after a Fresh install before restoring the config.
Restoring the config also doesn't change /var/log files.
-
@RonpfS yes, I also had it use the whole drive, just in case(to make sure nothing would interfere). I even used a different drive(that never had pfsense installed) to take out the chance of the hard drive being the issue as well.
-
@themadsalvi So after the install, before restoring the config, you have no log files updating ? Even after a reboot ?
-
@RonpfS The log files have not updated since the fresh install was finished yesterday. very strange.
My only guess is that something in the config that is being restored is causing this to happen. Don't know how this could actually occur though, as mentioned before, I went with configs from 2018 where Pfblocker was actually blocking IP's.
-
Start over, check that logging occurs, then redo the config from scratch instead of restoring a config. Keep monitoring logging until you identify the culprit.
-
@RonpfS looks like that is indeed my only option here. I will have to wait until I can make a window for re-do/update in my environment.
-
@themadsalvi You could investigate your config.xml to check if something obvious might cause your problems.
-
@themadsalvi here is what I have on my side :
[2.4.4-RELEASE][2019-05-06 18:51:20][admin@pfsense.local]/var/log: ls -altr total 4195 drwx------ 2 www www 2 Oct 3 2018 lighttpd -rw-r--r-- 1 root wheel 161664 Dec 8 19:40 bsdinstall_log drwxr-xr-x 2 root wheel 2 Dec 8 19:42 ntp -rw-r--r-- 1 root wheel 0 Dec 8 19:46 lastlog drwx------ 3 root wheel 4 Dec 8 19:51 suricata drwxr-xr-x 26 root wheel 26 Dec 12 07:42 .. drwxr-xr-x 7 root wheel 30 Dec 12 07:42 . -rw------- 1 root wheel 10240000 Dec 20 21:14 vpn.log -rw------- 1 root wheel 10240000 Dec 20 21:14 poes.log -rw------- 1 root wheel 10240000 Dec 20 21:14 l2tps.log -rw------- 1 root wheel 10240000 Dec 20 21:14 openvpn.log -rw------- 1 root wheel 10240000 Dec 20 21:14 portalauth.log -rw------- 1 root wheel 10240000 Dec 20 21:14 ipsec.log -rw------- 1 root wheel 10240000 Dec 20 21:14 ppp.log -rw------- 1 root wheel 10240000 Dec 20 21:14 relayd.log -rw------- 1 root wheel 10240000 Dec 20 21:14 wireless.log -rw------- 1 root wheel 10240000 Dec 20 21:14 routing.log drwxr-xr-x 2 root wheel 4 Feb 25 17:03 nginx -rw-r--r-- 1 root wheel 11566 Feb 26 12:40 dmesg.boot -rw------- 1 root wheel 9252 Feb 26 12:40 userlog -rw------- 1 root wheel 10240000 Mar 29 12:40 ntpd.log -rw-r--r-- 1 root wheel 394 May 6 17:45 utx.lastlogin -rw------- 1 root wheel 11801 May 6 17:45 utx.log drwxr-xr-x 2 unbound unbound 12 May 6 18:19 pfblockerng -rw------- 1 root wheel 10240000 May 6 18:20 system.log -rw------- 1 root wheel 10240000 May 6 18:20 dhcpd.log -rw------- 1 root wheel 10240000 May 6 18:20 resolver.log -rw------- 1 root wheel 10240000 May 6 18:20 gateways.log -rw------- 1 root wheel 10240000 May 6 18:28 nginx.log -rw------- 1 root wheel 10240000 May 6 18:51 filter.logSo some files are updated, some are dated from the last install.
-
I'm new to using pfblocker and just had the same issue. I noticed you are using squid as i am also. pfblocker will not filter ip addresses while squid is enabled. I tested enabling and disabling it. I'm not sure what the better option is because i cant get pfblocker to filter https. so currently i'm just using pfblocker to filter dnsbl
