Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.



  • I have many IP block lists that I am using, and the IPs that they are blocking(or at least I assume they are), are not showing up in the reports. They are set to enable logging in the IPv4 summary in Pfblocker, but nothing shows up in the logs themselves. I think there is probably some small step or check box that I am missing to make them correctly show up. The rules for the Alias' are created, and are correctly placed in the Firewall rules area, but no IP addresses show up in blocks. I have global logging enabled as well as logging enabled in each rule. Any help would be appreciated. Thank you


  • Galactic Empire

    Are you running pfBlockerNG-devel?

    Works fine for me.

    Screenshot 2019-05-01 at 09.34.27.png

    Screenshot 2019-05-01 at 09.40.50.png



  • @NogBadTheBad
    Yes, I am running the most recent version of devel.dab4ec1d-075c-4909-b8e5-3a8e4bb3456b-image.png

    This next one is what I find weird. It looks like the last time it alerted was March 26th, and all of the lists are Enabled, with Global logging, as well as individual logging enabled for each list. Still no recent logs
    359df3df-abf9-4a88-b6df-156283dbfdb2-image.png


  • Galactic Empire

    Are there any ip addresses in the PRI3 tables ?

    Diagnostics -> Tables



  • @NogBadTheBad It is showing 1408 records ( IP's)
    efb28ec5-8e9f-4e49-be4a-1edb86f6c560-image.png

    All of the other lists are populated as well. Some with as many as 50,000 records



  • @themadsalvi
    Try restarting the pfb_filter from Status / Services tab.

    Check the log files in tab Firewall / pfBlockerNGLog /Browser, does ip_block.log is updated?

    Do you see any blocks in tab Status / System Logs / Firewall / Normal View?

    Try to ping some of the IPs in the table (Diagnostics/ Ping).



  • @RonpfS

    1. restarted, and nothing changed in the alert tab

    2. the log file ip_block.log is just showing the blocks from march 26th

    3.no blocks at all (empty) for normal, or any other view.

    1. Cannot ping any of the iPs on the lists. Tried about 5 with no luck. It will not show them as blocked on any logs, though.


  • Well check the pfblockerNG logs to see if something break.
    Check the system logs to see if they are recent

    ls -al /var/log
    

    Check the FW Rules
    Check to see if pfblockerNG is enabled etc.
    What happened on march 26 ?



  • @RonpfS Firewall rules are the auto configured ones that PFblocker creates when you tell it if you want it in floating rules or not. I am not seeing any errors in the logs. March 26th a blackout happened, which ended up corrupting the PFsense install, and I had to redo it.

    No errors in the log, except that it failed to download one list. PFblockerNG is enabled, as the DNSBL are working fine, and have not had the same issue. I have not been able to SSH into my pfsense to check the log date.



  • @themadsalvi said in Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.:

    I have not been able to SSH into my pfsense to check the log date.

    You can use the Diagnostics / Command Prompt tab.



  • @RonpfS
    got it

    9a973d20-cb6f-4c8a-88cc-b25a41a07313-image.png



  • @themadsalvi said in Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.:

    March 26th a blackout happened, which ended up corrupting the PFsense install, and I had to redo it.

    Well something went wrong then. How did you redo it ? With a fresh install ?



  • Some log files are not updating, you may copy them if you "need" them, then reset the log file from the Status / System Logs / Settings tab

    I would run a fsck from the Shell prompt or even better, redo a Fresh install then recover the config.



  • @RonpfS Re-installed the whole thing again and went back to known working configurations, even ones before the march 26th issue, and there are still no IP blocks showing up in the Report tab, nor the firewall logs. Maybe somehow something is getting borked in the install? I am installing through USB with "guided install"



  • @themadsalvi Did you format the partition ? There should not be any file from the older installation after a Fresh install before restoring the config.

    Restoring the config also doesn't change /var/log files.



  • @RonpfS yes, I also had it use the whole drive, just in case(to make sure nothing would interfere). I even used a different drive(that never had pfsense installed) to take out the chance of the hard drive being the issue as well.



  • @themadsalvi So after the install, before restoring the config, you have no log files updating ? Even after a reboot ?



  • @RonpfS The log files have not updated since the fresh install was finished yesterday. very strange.
    c2ad5b41-0910-422e-8fc1-daf1495c8da9-image.png

    My only guess is that something in the config that is being restored is causing this to happen. Don't know how this could actually occur though, as mentioned before, I went with configs from 2018 where Pfblocker was actually blocking IP's.



  • Start over, check that logging occurs, then redo the config from scratch instead of restoring a config. Keep monitoring logging until you identify the culprit.



  • @RonpfS looks like that is indeed my only option here. I will have to wait until I can make a window for re-do/update in my environment.



  • @themadsalvi You could investigate your config.xml to check if something obvious might cause your problems.



  • @themadsalvi here is what I have on my side :

    [2.4.4-RELEASE][2019-05-06 18:51:20][admin@pfsense.local]/var/log: ls -altr
    total 4195
    drwx------   2 www      www             2 Oct  3  2018 lighttpd
    -rw-r--r--   1 root     wheel      161664 Dec  8 19:40 bsdinstall_log
    drwxr-xr-x   2 root     wheel           2 Dec  8 19:42 ntp
    -rw-r--r--   1 root     wheel           0 Dec  8 19:46 lastlog
    drwx------   3 root     wheel           4 Dec  8 19:51 suricata
    drwxr-xr-x  26 root     wheel          26 Dec 12 07:42 ..
    drwxr-xr-x   7 root     wheel          30 Dec 12 07:42 .
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 vpn.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 poes.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 l2tps.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 openvpn.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 portalauth.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 ipsec.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 ppp.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 relayd.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 wireless.log
    -rw-------   1 root     wheel    10240000 Dec 20 21:14 routing.log
    drwxr-xr-x   2 root     wheel           4 Feb 25 17:03 nginx
    -rw-r--r--   1 root     wheel       11566 Feb 26 12:40 dmesg.boot
    -rw-------   1 root     wheel        9252 Feb 26 12:40 userlog
    -rw-------   1 root     wheel    10240000 Mar 29 12:40 ntpd.log
    -rw-r--r--   1 root     wheel         394 May  6 17:45 utx.lastlogin
    -rw-------   1 root     wheel       11801 May  6 17:45 utx.log
    drwxr-xr-x   2 unbound  unbound        12 May  6 18:19 pfblockerng
    -rw-------   1 root     wheel    10240000 May  6 18:20 system.log
    -rw-------   1 root     wheel    10240000 May  6 18:20 dhcpd.log
    -rw-------   1 root     wheel    10240000 May  6 18:20 resolver.log
    -rw-------   1 root     wheel    10240000 May  6 18:20 gateways.log
    -rw-------   1 root     wheel    10240000 May  6 18:28 nginx.log
    -rw-------   1 root     wheel    10240000 May  6 18:51 filter.log
    
    

    So some files are updated, some are dated from the last install.



  • I'm new to using pfblocker and just had the same issue. I noticed you are using squid as i am also. pfblocker will not filter ip addresses while squid is enabled. I tested enabling and disabling it. I'm not sure what the better option is because i cant get pfblocker to filter https. so currently i'm just using pfblocker to filter dnsbl


Log in to reply