pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL?

netboy

I see log entries as follows

[ pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL [ 10/17/24 08:00:31 ]
[ pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL [ 10/17/24 03:00:30 ]
[ pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL [ 10/17/24 02:00:29 ]
[ pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL [ 10/17/24 01:00:39 ]

Is this ok?

SteveITS

@netboy can you download it in your browser?

That one keeps coming up from time to time in this forum.

https://forum.netgate.com/topic/178834/talos_bl_v4-fails-to-update/

netboy

@SteveITS said in pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL?:

can you download it in your browser?
What URL should I use?

SteveITS

@netboy on the Feeds tab the Header/URL column should contain the URL.

jrey

@netboy

https://forum.netgate.com/topic/190361/pfblockerng-devel-3-2-0_18/19?_=1729185149444

it is because they have inserted a terms and conditions page and pf can't hit accept button.

their link https://talosintelligence.com/documents/ip-blacklist will redirect your
here read their notice https://snort.org/downloads/ip-block-list/terms

Even if you accept it it is tied to a session and time expires.

if you try to go directly to the page after the accept, you won't get there because the reference tokens and session data are gone after the time limit expires.

I also found that most of the IP's are covered in other feeds in the same block and disabling it didn't really change anything with regards to blocking.

The other one mentioned Spamhaus in the referenced thread has been fixed for the next release (or the patch referenced) so get you by.

BBcan177

See the following for some more info:

https://x.com/BBcan177/status/1846578375374323931?t=qTBuM4A9NMcVJHiVukxd8w&s=19

SteveITS

Can someone with a Twitter account (to see the thread) TL,DR? Like, is it just not going to work now? Thanks.

provels

Well, it's not like there aren't a zillion others to use.

jrey

@provels said in pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL?:

it's not like there aren't a zillion others to use.

Exactly -- just disable it and move on.

SteveITS

@provels OK thanks, so don't use it, got it.

tedquade

@SteveITS Go into cron and change the run time. I had the same issue ages ago and changing the run time from default to avoid the time when their server is being pounded on.

Ted

SteveITS

@tedquade No, they've basically blocked its use with the T&C page. That was an issue in the past though.