Unofficial E2guardian package for pfSense

pfsensation

@marcelloc:

Happened and fixed on 4.1. maybe not merged on 5.0

I'll se if I find the issue number on 4.1 branch and post on #375

Face palm even without the -HOSTS- place holder in my block page. E2 Guardian still crashes after sometime, I guess I'll have to do more debugging tomorrow.


SB  list name banned checking type  3
Looking for banned type 3 in listmeta
Found banned type 3 in listmeta
list reference 196 'banned' found for banned
SB  list name banned checking type  2
Looking for banned type 2 in listmeta
Found banned type 2 in listmeta
list reference 206 'banned' found for banned
SB  list name banned checking type  6
Looking for banned type 6 in listmeta
Found banned type 6 in listmeta
list reference 223 'banned' found for banned
banned matches 3 types
Line 218 state is 2 actionid 5003 listname banned
Compiling .*[a-z|A-Z].*
...with PCRE
Setting magic key to 'PWYDSKLILPOTMCAK'
read filter group: 4 /usr/local/etc/e2guardian/e2guardianf5.conf return is 1
I seem to be running already!
In deleteFilterGroups loop
In deleteFilterGroups loop
In deleteFilterGroups loop
In deleteFilterGroups loop
In deleteFilterGroups loop

Just got this @Marcelloc and then E2G crashed. Weird… Not sure what return is 1 means.

Also getting the below with E2G Debug binaries:

Apr 16 14:49:22	e2guardian	83603	Tunnel status not 200 ok aborting
Apr 16 14:49:24	e2guardian	83603	Tunnel status not 200 ok aborting
Apr 16 14:49:30	e2guardian	83603	Tunnel status not 200 ok aborting
Apr 16 14:49:33	e2guardian	83603	Tunnel status not 200 ok aborting

marcelloc

I seem to be running already! Is the error when there is another process running (apply whike reloading, watchdog, etc…)

pfsensation

@marcelloc:

I seem to be running already! Is the error when there is another process running (apply whike reloading, watchdog, etc…)

I think the watchdog may need to be re-designed, because that shouldn't happen. My E2G is set to kill a running instances and start new ones on config change.

pfsensation

Hi Marcelloc,

Could you please update the binaries, the E2G developers have pushed out some patches which should help with these segmentation faults. Funnily enough the debug version seems to work more stable for me than the one in the repo.

Thanks

landforces

hi marcello

There are 2 responsibilities

1. exe zip vs download blocking

When we try to enter some prohibited sites, such as the second picture, it reacts differently
one says that this site can not be reached and the other page comes Block.

e2guard.PNG_thumb

marcelloc

@pfsensation:

Hi Marcelloc,

Could you please update the binaries, the E2G developers have pushed out some patches which should help with these segmentation faults. Funnily enough the debug version seems to work more stable for me than the one in the repo.

Thanks

Binaries updated on repo.

pfsensation

@landforces:

hi marcello

There are 2 responsibilities

1. exe zip vs download blocking

When we try to enter some prohibited sites, such as the second picture, it reacts differently
one says that this site can not be reached and the other page comes Block.

Have you got Forge SSL certificates turned on? If you enable that and install the CA on all your devices, you will then get the block page on all banned sites.

Weird that you're getting a DNS error though. Are you sure you don't have any DNS blocking that site?

pfsensation

@marcelloc:

@pfsensation:

Hi Marcelloc,

Could you please update the binaries, the E2G developers have pushed out some patches which should help with these segmentation faults. Funnily enough the debug version seems to work more stable for me than the one in the repo.

Thanks

Binaries updated on repo.

Awesome, updating right away!

landforces

hi pfsensation

I'm in Turkey we have many sites forbidden we have many sites forbidden
operator bans telecom with DNS

marcelloc

Last build I forgot to remove DEBUG compile option, so I've pushed binaries version e2guardian-5.0.2_5.txz without debug to the repo.

If you need current debug version, fetch from :

pkg add -f https://e-sac.websiteseguro.com/e2g/e2guardian-5.0.2_5.txz

pfsensation

@landforces:

hi pfsensation

I'm in Turkey we have many sites forbidden we have many sites forbidden
operator bans telecom with DNS

That's your problem in the screenshot. Turkey already bans most bad sites due to religious reasons. I recently came back from Turkey (Antalya), went on holiday it was amazing! I'm guessing you're using Turkce Telekom?

I'm not too sure how it'll work in your instance as I haven't tested it. E2 Guardian can't do any phrase checking if the DNS is being null routed. However it should still be detect the URL from ShallaList. Turn on Forge SSL Certificates, and install the CA and give it a shot. Remember, on HTTPS sites you will not get a block page of you do not have MITM enabled.

marcelloc

Is anybody else receiving ERR_SSL_BAS_RECORD_MAC_ALERT on chrome and firefox after latest updated with MITM?

pfsensation

@marcelloc:

Is anybody else receiving ERR_SSL_BAS_RECORD_MAC_ALERT on chrome and firefox after latest updated with MITM?

I don't seem to be getting it, just gave it a quick try. What setup are you using? And did you try clearing the cache?

pfsensation

@Marcelloc when I use E2 Guardian in MITM mode with pfBlocker. I'm getting NGINX errors, E2G seems to be forwarding the traffic to the NGINX server rather that directly to pfBlocker.

I've tried setting the options to make all traffic going to pfBlocker IP bypass the proxy but it hasn't helped. How have you got it setup and are you having this issue? I am using DNSBL on pfBlocker.

marcelloc

@pfsensation:

did you try clearing the cache?

Yes. After cleaning and restarting, few sites goes fine then all get mac error.

marcelloc

@pfsensation:

I'm getting NGINX errors, E2G seems to be forwarding the traffic to the NGINX server rather that directly to pfBlocker.

Does pfblockerNG package started redirecting or showing error pages on latest versions? The pfblocker versions I've used was just a deny rules creator, with any redirect.

pfsensation

@marcelloc:

@pfsensation:

I'm getting NGINX errors, E2G seems to be forwarding the traffic to the NGINX server rather that directly to pfBlocker.

Does pfblockerNG package started redirecting or showing error pages on latest versions? The pfblocker versions I've used was just a deny rules creator, with any redirect.

Nope, this was an ongoing problem since I enabled transparent proxy. pfBlocker has an option for blocking hosts - I have adblocking hosts files. The way it works is, it redirects those domains to pfBlocker's own internal web server in order to block them. They are getting intercepted by the proxy.

EDIT:

I have made a discovery Marcello. On normal non-debug E2Guardian which is setup with Squid. If Squid restarts, or needs to log rotate etc, it crashes E2Guardian. This doesn't seem to be the case with the debug version of E2Guardian, I have tried to replicate the issue but have been unsuccessful. Have you got any ideas?

pfsensation

@marcelloc:

@pfsensation:

did you try clearing the cache?

Yes. After cleaning and restarting, few sites goes fine then all get mac error.

Weird, I haven't got it yet. What authentication method are you using?

marcelloc

@pfsensation:

Weird, I haven't got it yet. What authentication method are you using?

IP address

pfsensation

@marcelloc:

@pfsensation:

Weird, I haven't got it yet. What authentication method are you using?

IP address

Strange, no issues like the one you're describing on my end yet… Only issue I have is that when using it with Squid, from time to time E2Guardian crashes. And somehow... It doesn't crash when debug is enabled.

I'm also hoping you can help me out with the pfBlocker issue, am I doing something wrong?