No Alerts from pfBlockerNG since update

  • Guys,

    I know missing something really obvious here.

    Here's the story ...

    I have a PFS setup on a dell 1950 running 2.4.4-RELEASE-p3 (amd64) with pfBlockerNG 2.1.4_17 and snort Works like a dream.

    I copied the config to a thumb drive and installed on a completely new machine, as described here:

    The move seemed to work fine, but [unfortunately] the packages updated themselves to latest versions ... which seem to require version 2.4.5. I tried to get back to older versions using a couple of the many threads on the subject but no joy.

    SO ... I removed snort and pfBlockerNG and upgraded to 2.4.5. Again ... went like a dream. Reinstalled packages which picked up the original configs and all seemed wonderful.

    BUT ...

    Since then I've received no alerts from pfBlockerNG ...

    I've set up a key for MaxMind - everything downloads as it should.

    I've tried upgrading pfBlockerNG to pfBlockerNG-devel as some folks suggest - no change.

    I've worked through the configs on working [old] and not working [new] machines and they seem to be the same [more or less with obvious differences due to package update, etc].

    Snort is running without a hitch though.

    It seems my stupidity knows no bounds :(

    Does anyone have any suggestions, other than stick with the working machine?



  • Guys,

    Mystery solved.

    All my fault, plus assistance from the H/W manufacturer ...

    Seems that port0 MAC ended :0b and port1 ended :0a, so I basically had them labeled the wrong way around. PfBlockerNG was set up on the 'outside' port, hence what I was seeing.

    Like I said - all my fault, but I'd still love to have a minute with the olympic class ^%$ head that designed it this way.

    Hope someone else benefits from this experience.


Log in to reply