making changes to rules applied only after reboot
-
yes im using them to block incoming via geolocation.
and i started getting some error that i was unable to fix about memory so i kept adding more to
Firewall Maximum States
and to Firewall Maximum Table Entries -
@oren1031 said in making changes to rules applied only after reboot:
error that i was unable to fix
What was the specific error - yeah if you had issues with the memory and tables - that for sure could of caused issues with load of rules..
Not talking about geoip, I use those in pfblocker - more talking about letting pfblocker auto create rules.. Which I don't use.. I just use it to create native aliases that I put in the rules.
-
Cannot allocate memory - The line in question reads [48]: table <pfB_NAmerica_v6> persist file "/var/db/aliastables/pfB_NAmerica_v6.txt"
-
yeah that list is going to be freaking HUGE ;) NA v6...
You need to up the table size.. if your going to use such a list. What do you have yours set to?
-
now i took it up to 2400000 for now im getting no error.
-
but look like pfblocker is doing its job...
-
Wouldn't it just be easier to allow what you want ;) Out of the box all is blocked anyway. Just use geoip list of what you want to allow to hit your port forward/exposed ports..
-
that is what i did. blocked all but what i want to be enabled.
-
Why are you loading the NA list then? Just for your picture of where IPs are from?
-
im blocking all inbounds. from everywhere but my country.
isnt that the way to go? if i have a service i want to be accessed only from my country to minimize exposer? -
Again just allow your country on your rule/port forward. All is blocked by default.. There is little reason to load up some table of all NA v6, when ALL is blocked by default. And your allow is only your country list of IP ranges.
-
so when allowing only 1 country all others will be blocked by pfblocker?
is that what you mean?
no need for block rules because all that is not allowed is blocked? -
what is the downside? of using it the way i do?
keeping in mind i have i3 with 8 gig ram. so its not really
working that hard.. its a home environment. -
What trying to load every known IP on the planet to put in a list so you can block it? When ALL ips are blocked by default anyway ;)
-
ill try what you offer it is more logic. i was not aware that it block by default.
also i like the picture :)
