All alerts showing as unk country code.. help

[sesipod]

Please see the following screenshot. All of my blocks are showing the region but not the country code.

[NogBadTheBad]

Have you registered for a MaxMind License Key ?

pfBlockerNG-devel or pfBlockerNG ?

[sesipod]

Yes I have a key added to the pfblockerng-dev

[NogBadTheBad]

What page is the screenshot from ?

I've looked at my reports and don't see any with the header like your screenshot, Cant see a CC header.

[sesipod]

Alerts

[sesipod]

.... I just realized my issue I think

[NogBadTheBad]

@sesipod said in All alerts showing as unk country code.. help:

.... I just realized my issue I think

Thats what I see in the alerts:-

[sesipod]

So I actually was not running dev version .. so I updated to that now and yet still the same issue. Also made a new key just to be sure.

[NogBadTheBad]

Space at the start or end of your MaxMind License Key?

[sesipod]

Nope no space :'/

[sesipod]

So it's all fixed after a reboot of pfsense. Guess something was clogged up ¯_( ͠° ͟ʖ °͠ )_/¯

[sesipod]

@NogBadTheBad how did you get the asn ?

Mine only shows CC

[NogBadTheBad]

Not a clue sorry, it maybe that I have a few rules set to block by ASN.

AFAIK its been there all the time.

[sesipod]

Iptab

ASN Reporting

[sesipod]

A reboot seems to force geoip cc updates and asn updates

[BBcan177]

@sesipod
This is fixed in the next version. The pfb_filer service needs to be restarted on first download of MaxMind.

https://github.com/pfsense/FreeBSD-ports/pull/762/files

[serbus]

Hello!

sg-3100 running 2.4.5.r.20200305.1800
pfblockerng-devel 2.2.5_29

I have been having this problem and just found this thread.
Maxmind key is good.
Manually ran the pfblockerng.php dc command with success.
extras.log shows successful download and parsing.
Restarted the router.
Tried clearing all downloaded lists (disable/enable pfBlockerNG & Keep Settings check boxes).
pfBlockerNG Reports -> Alerts and IP Stats still show "Unk" for GeoIP in all reports.

Is there anything else I can check or try?

Thanks!

John

[BBcan177]

@serbus

Restart the "pfb_filter" service and it should start reporting on new events as long as Maxmind DB was previously downloaded successfully.

[serbus]

Hello!

How do I restart the service?

Not sure if this test is valid, but I ran this:

/usr/local/bin/mmdblookup -v -f /usr/local/share/GeoIP/GeoLite2-Country.mmdb -i 1.1.1.1 country iso_code

and got this:

Can't open /usr/local/share/GeoIP/GeoLite2-Country.mmdb - The MaxMind DB file contains invalid metadata

John

[serbus]

Hello!

I tried deleting the GeoLite2-Country.mmdb file and then recreating it by running :

php /usr/local/www/pfblockerng/pfblockerng.php dc

It was recreated, but still gives the same error when running mmdblookup.

The size of the mmdb file in pfb is :

-rw-r--r-- 1 root wheel 2048734 Mar 7 22:24 GeoLite2-Country.mmdb

When I download the GeoLite2-Country.mmdb file directly from maxmind, the file looks like this :

John