All alerts showing as unk country code.. help
-
.... I just realized my issue I think
-
@sesipod said in All alerts showing as unk country code.. help:
.... I just realized my issue I think
Thats what I see in the alerts:-
-
So I actually was not running dev version .. so I updated to that now and yet still the same issue. Also made a new key just to be sure.
-
Space at the start or end of your MaxMind License Key?
-
Nope no space :'/
-
So it's all fixed after a reboot of pfsense. Guess something was clogged up ¯_( ͠° ͟ʖ °͠ )_/¯
-
@NogBadTheBad how did you get the asn ?
Mine only shows CC
-
Not a clue sorry, it maybe that I have a few rules set to block by ASN.
AFAIK its been there all the time.
-
Iptab
ASN Reporting
-
A reboot seems to force geoip cc updates and asn updates
-
@sesipod
This is fixed in the next version. The pfb_filer service needs to be restarted on first download of MaxMind.https://github.com/pfsense/FreeBSD-ports/pull/762/files
-
Hello!
sg-3100 running 2.4.5.r.20200305.1800
pfblockerng-devel 2.2.5_29I have been having this problem and just found this thread.
Maxmind key is good.
Manually ran the pfblockerng.php dc command with success.
extras.log shows successful download and parsing.
Restarted the router.
Tried clearing all downloaded lists (disable/enable pfBlockerNG & Keep Settings check boxes).
pfBlockerNG Reports -> Alerts and IP Stats still show "Unk" for GeoIP in all reports.Is there anything else I can check or try?
Thanks!
John
-
Restart the "pfb_filter" service and it should start reporting on new events as long as Maxmind DB was previously downloaded successfully.
-
Hello!
How do I restart the service?
Not sure if this test is valid, but I ran this:
/usr/local/bin/mmdblookup -v -f /usr/local/share/GeoIP/GeoLite2-Country.mmdb -i 1.1.1.1 country iso_code
and got this:
Can't open /usr/local/share/GeoIP/GeoLite2-Country.mmdb - The MaxMind DB file contains invalid metadata
John
-
Hello!
I tried deleting the GeoLite2-Country.mmdb file and then recreating it by running :
php /usr/local/www/pfblockerng/pfblockerng.php dc
It was recreated, but still gives the same error when running mmdblookup.
The size of the mmdb file in pfb is :
-rw-r--r-- 1 root wheel 2048734 Mar 7 22:24 GeoLite2-Country.mmdb
When I download the GeoLite2-Country.mmdb file directly from maxmind, the file looks like this :
John
-
Hello!
Sorry to keep bugging you...
It looks like pfb is just renaming the download from maxmind to ,mmdb without actually extracting the files.
The GeoLite2-Country.mmdb file is 2048734 bytes, which is the same length as the GeoLite2-Country_20200303.tar.gz download from maxmind.
cp GeoLite2-Country.mmdb GeoLite2-Country.tar.gz
and then
gzip -l ./GeoLite2-Country.tar.gz
shows that the mmdb file was really a tar.gz fileI think....
John
-
Hello!
Just more guessing...I am not sure I am looking at the correct code...
The download from maxmind is 'application/gzip'
The code doesnt look like it will decompress this type, and will only rename the downloaded file.
Maybe
if ($file_type == 'application/x-gzip' || $file_type == 'application/gzip' )
?
John
-
@BBcan177 I am still seeing this as of today on pfSense 2.4.5-RELEASE and pfBlockerNG-devel 2.2.5_30. Restarting the pfb_filter service didnt seem to fix it.
-
If "191.232.138.2" isn't present in any of your GeoIP files, then the "unknown" is understandable.
While waiting for a reply from BBcan177, have a look at the files and check if this is true ?
-
@ex1580
Yes there was a change to the file mime-types in pfSense 2.4.5 and the change to fix Shallalist and UT1 is also needed to download one of the MaxMind databases.Install the latest version of the package and re-download MaxMind from the shell with this command:
php -f /usr/local/www/pfblockerng/pfblockerng.php dcNew events should show the GeoIP column in the alerts tab.
