GeoIP Blocking

[A Former User]

@teamits Hello
I have activated the maxmin license but I don't know how to configure the geo ip in pfBlockerNG on pfsense 2.4.5 help thanks

[A Former User]

@teamits how should i block countries such as the United Kingdom? if you can also help me with screenshots it is easier for me

[SteveITS]

What I usually do is set up rules using Alias Native:

with all the countries desired. Then set up any firewall rules desired using that alias.

Note it's usually better to allow the desired countries than block the world, since all the IP addresses of the world would have to be held in memory.

Also note you have to use the Update tab to generate the files before they can be used.

[A Former User]

This post is deleted!

[A Former User]

This post is deleted!

[RonpfS]

@antonio-briguglio You are using pfblockerNG, was Format GeoIP available then ? Or maybe it's not be compatible with the new MaxMind requirements? I don't know.

Maybe it's time to move to pfBlockerNG-devel. Disable pfblockerNG, Uninstall it, install pfblockerNG-devel, insert Maxmind License, configure, Run Force Update, Force Reload All and see if that works.

[A Former User]

@ronpfs It's not like you say. I don't want to uninstall it
In my opinion I am wrong or skip a few steps.
Help with screenshots

[RonpfS]

@antonio-briguglio
Search the forum: https://forum.netgate.com/search?term=GeoIP&in=titlesposts&matchWords=all&categories[]=62&sortBy=relevance&sortDirection=desc&showAs=posts

This one was on first page: https://forum.netgate.com/topic/154140/can-t-get-geoip-to-work/4

[Gertjan]

What is the pfBlockerNG version this :

?

The new GeoIP (they == GeoIP, changed a lot last year) needs to new pfBlockerNG.

@antonio-briguglio said in GeoIP Blocking:

I don't want to uninstall it

You want to use the 'latest and greatest' with the oldest ?

[SteveITS]

@ronpfs said in GeoIP Blocking:

pfBlockerNG-devel

Ah, sorry, I had trouble with pfBlockerNG and the new MaxMind so we switched all our clients to pfBlockerNG-devel. I wasn't even thinking about the package.

It kept losing the MaxMind key overnight.
https://forum.netgate.com/topic/149343/pfblockerng-maxmind-registration-required-to-continue-to-use-the-geoip-functionality/49

The package maintainer has recommended in the forums to use -devel anyway. I am not sure why there are two at this point...? If you uninstall pfBlockerNG and install pfBlockerNG-devel it will import settings.

[A Former User]

This post is deleted!

[SteveITS]

The warning is so that you don't run an update while an update is already running. Since your update is 59 minutes away, it's safe to go ahead. Aggiorna I assume is "update" so pick that and click Run.

Or wait 59 minutes and it will run an update on its own. :)

[RonpfS]

@teamits Active pfBlockerNG CRON JOB normally means there is an update running on the box.

Inspect pfblockerNG.log file to see what is happening

[A Former User]

@ronpfs yes, but he always does it and doesn't let me update after the time runs out, the stopwatch always starts again
and manual updating doesn't

[RonpfS]

@antonio-briguglio What are you seeing in pfblockerng.log?

[A Former User]

@teamits how do you put a website blocking warning web page when blocking countries?

[RonpfS]

@antonio-briguglio said in GeoIP Blocking:

@teamits how do you put a website blocking warning web page when blocking countries?

You can't.
You use the Alerts tab to see what is blocked on the IP side.

[SteveITS]

@ronpfs said in GeoIP Blocking:

Active pfBlockerNG CRON JOB normally means there is an update running on the box

Yeah, missed that giant red label. It's been a long day.

It sounds like pfBlockerNG is set to check for updates every hour? So it should have updated already.

[A Former User]

@ronpfs so I want that when a customer for example visits a web page in Turkey that I have blocked that a web page is displayed where it warns that the site is blocked instead of the classic internet page not available

[RonpfS]

@antonio-briguglio Not possible with IP blocking. Maybe other package like Squid or something similar could do that.