Unofficial E2guardian package for pfSense

marcelloc

@pfsensation:

I think it maybe best to wait for them to fix the issue before diving in

It's fixed now.

@marcelloc:

On first glance, how does it compare to ShallaList?

ShallaList has more categories but I think it's not updated very often.

lindsay

It is actually a paid service http://www.squidblacklist.org

lindsay

Your script gave me

sh /usr/local/Scripts/Blacklist-update.sh
: not foundScripts/Blacklist-update.sh:
: Not Founds://www.squidblacklist.org/downloads/dg-malicious.acl
/usr/local/Scripts/Blacklist-update.sh: /usr/local/sbin/e2guardian: Permission denied

So where do you place the script?

I do think i have some error as getting these errors to in GUI

Notices
Filter Reload
There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [20]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-04-02 20:23:54
There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [20]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-04-02 20:24:03
There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [20]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-04-02 21:41:08

marcelloc

@lindsay:

I do think i have some error as getting these errors to in GUI

Notices
Filter Reload
There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [20]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-04-02 20:23:54
There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [20]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-04-02 20:24:03
There were error(s) loading the rules: /tmp/rules.debug:20: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [20]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-04-02 21:41:08

this error is related do ipv6 bogons netowork alias

https://forum.pfsense.org/index.php?topic=50141.0

marcelloc

@lindsay:

Your script gave me

sh /usr/local/Scripts/Blacklist-update.sh
: not foundScripts/Blacklist-update.sh:
: Not Founds://www.squidblacklist.org/downloads/dg-malicious.acl
/usr/local/Scripts/Blacklist-update.sh: /usr/local/sbin/e2guardian: Permission denied

So where do you place the script?

looks like you're calling the script not on the same folder you saved it or the content does not match what I've posted or you are not running it as root.

lindsay

Things is starting to function, for now i see everything is working also upstream proxy (proxHTTPS and privoxy) ;)
There is a lot to test out but only when i am alone on the network :)

marcelloc

Why do you need an upstream proxy?

pfsensation

I've been getting a few crashes recently here and there. Not sure if it is just my configuration, E2 Guardian just randomly seems to stop.

I've got 1000 HTTP workers, and resource usage seems to be fine. The below is what I see in system logs:

Apr 4 08:17:44 php-fpm 76879 /rc.start_packages: [E2guardian] - Detected boot process pr:1 bp:1 rpc:no
Apr 4 08:17:44 php-fpm 76879 /rc.start_packages: [E2guardian] - Aborting config file generation

lindsay

@marcelloc:

Why do you need an upstream proxy?

Under General Misc settings you have misc options

"If you have the "usexforwardedfor" option enabled, you may want to specify the IPs from which this kind of header is allowed, such as another upstream proxy server for instance If you want authorize multiple IPs, specify each one on an individual xforwardedforfilterip line."

marcelloc

@lindsay:

Under General Misc settings you have misc options

"If you have the "usexforwardedfor" option enabled, you may want to specify the IPs from which this kind of header is allowed, such as another upstream proxy server for instance If you want authorize multiple IPs, specify each one on an individual xforwardedforfilterip line."

Is this a question?

susamlicubuk

Hello Marcello
i just installed e2guardian5
direct connect and certificate selected
Sometimes I click the link and the page is empty
Pressing f5 or clicking again will open the page
for example
http://www.hurriyet.com.tr/
http://www.hurriyet.com.tr/gundem/
set up a manual squid
and e2Guardian settings
parent mode - use automatic embeded parent config
I do not have this problem if I choose
why am I having this problem?

marcelloc

@susamlicubuk:

Hello Marcello
i just installed e2guardian5
direct connect and certificate selected
Sometimes I click the link and the page is empty
Pressing f5 or clicking again will open the page
for example
http://www.hurriyet.com.tr/
http://www.hurriyet.com.tr/gundem/
set up a manual squid
and e2Guardian settings
parent mode - use automatic embeded parent config
I do not have this problem if I choose
why am I having this problem?

I saw this on firefox on my labs. If it's easy to reproduce, we csn open a ticket on e2guardian project to see what developers suggest.

pfsensation

@marcelloc:

@pfsensation:

I think it maybe best to wait for them to fix the issue before diving in

It's fixed now.

It's down again, darnit! It looks like better blacklist to use, when compared to ShallaList as it's a paid provider and has more categories. However, would those extra categories automatically appear on the GUI if we were to replace the ShallaList blacklist link with the Squid one?

marcelloc

@pfsensation:

It's down again, darnit! It looks like better blacklist to use, when compared to ShallaList as it's a paid provider and has more categories. However, would those extra categories automatically appear on the GUI if we were to replace the ShallaList blacklist link with the Squid one?

If it has the same folder structure, yes.

pfsensation

@marcelloc:

@pfsensation:

It's down again, darnit! It looks like better blacklist to use, when compared to ShallaList as it's a paid provider and has more categories. However, would those extra categories automatically appear on the GUI if we were to replace the ShallaList blacklist link with the Squid one?

If it has the same folder structure, yes.

Well, it was specifically designed for E2/DG therefore it should work just fine?

However, I wanted to ask if you had any problems with E2G randomly stopping sometimes? I've had it happen once or twice, a simple start fixed it. It's a bit odd.

marcelloc

@pfsensation:

However, I wanted to ask if you had any problems with E2G randomly stopping sometimes? I've had it happen once or twice, a simple start fixed it. It's a bit odd.

Not yet. I have three productions environments working fine. But I also keep running watchguard.

pfsensation

@marcelloc:

@pfsensation:

However, I wanted to ask if you had any problems with E2G randomly stopping sometimes? I've had it happen once or twice, a simple start fixed it. It's a bit odd.

Not yet. I have three productions environments working fine. But I also keep running watchguard.

Just applied a config, then saw that E2G wasn't started. I've got softrestart enabled.

Here's what I saw in the configs: kernel pid 17852 (e2guardian), uid 106: exited on signal 11

Strange…

pfsensation

Okay… I've managed to re-produce and figure out what's been stopping E2G.

When I go to for example: https://hidemyass.com/

It's stopping E2Guardian, whether I have MITM enabled or not. I've tried a reinstall of E2G and it hasn't helped. I'll enabled the watchdog now and see how it goes.

EDIT: After messing around with it, restarting pfSense, turning off MITM and enabling it again. It seems to have stopped... That was quite a roller coaster ride, not sure what happened. Hopefully it doesn't happen again. E2G started shutting down on all HTTPS denied pages.

susamlicubuk

@marcelloc:

@susamlicubuk:

Hello Marcello
i just installed e2guardian5
direct connect and certificate selected
Sometimes I click the link and the page is empty
Pressing f5 or clicking again will open the page
for example
http://www.hurriyet.com.tr/
http://www.hurriyet.com.tr/gundem/
set up a manual squid
and e2Guardian settings
parent mode - use automatic embeded parent config
I do not have this problem if I choose
why am I having this problem?

I saw this on firefox on my labs. If it's easy to reproduce, we csn open a ticket on e2guardian project to see what developers suggest.

it is very easy to reproduce this error
you can open your ticket e2guardian forum?
thanks.

marcelloc

@susamlicubuk:

it is very easy to reproduce this error
you can open your ticket e2guardian forum?

open it on https://github.com/e2guardian/e2guardian/issues

You did the tests, you have all info for the bug report.