pfBlockerNG does not show properly the MaxMind GeoLite2 GeoIPs
-
I noticed that https://saaq.gouv.qc.ca/ does not open if I block all IPs from Asia with pfBlockerNG.
At the time of my tests, saaq.gouv.qc.ca was pointing to IP 167.86.41.59 and https://hostingchecker.com/ was showing the host IP (167.86.41.59) in Ashburn, US
MaxMind GeoLite2 (GeoLite2-City-Blocks-IPv4.csv) also showed the correct location of the IP
167.86.41.48/28,4744870,294640,,0,0,20149,39.0469,-77.4903,20,where 39.0469,-77.4903 are the coordinates of Ashburn, US
Problem in pfBlockerNG 3.2.8 (and 3.2.8_1):
The IP block 167.86.41.48/28 is incorrectly presented in pfB_Asia_v4I am not sure where exactly is the problem but there are two options:
-
MaxMind GeoLite2 incorrectly holds the IP group in one of the source files used by pfBlockerNG (I already confirmed that the GeoLite2-City-Blocks-IPv4.csv source file holds the correct geo location of the IP group).
-
pfBlockerNG incorrectly reads the information from the MaxMind GeoLite2 source files.
-
-
@TCI_user said in pfBlockerNG does not show properly the MaxMind GeoLite2 GeoIPs:
Problem in pfBlockerNG 3.2.8 (and 3.2.8_1):
The IP block 167.86.41.48/28 is incorrectly presented in pfB_Asia_v4pfBlockerNG, when you install it, has no DNSBL or IP lists loaded.
When you instruct it to use load and use a list like "pfB_Asia_v4" which contains "167.86.41.48/28" (just 16 IPs ?!) and it's wrong .... call GeoIP, a that's the place where the list came from
It's known : IPs (IP networks) change ownership all the time, as it has become a financial trading object.
GeoIP isn't the seller or the owner or the manager, they just track the 'who owns what IP' and it often arrives that their info is outdated. Just like a web site that tracks the name of a phone number (reverse phone book).
Probably (I'm not sure) the not-free GeoIP is more up to date. Afaik, the free one is synced with reality just ones a month.Btw : not sure how GeoIP will handle the IPv6. These (entire networks) will get assigned and probably 'never' sold as there are so; many of them ... IPv6 lists will be huge and won't fit into 'RAM' ^^
@TCI_user said in pfBlockerNG does not show properly the MaxMind GeoLite2 GeoIPs:
I am not sure where exactly is the problem but there are two options:
It takes mere moments to remove the 'not sure' here.
GeoIP files are downloaded and placed here : /var/db/pfblockerng/original/
If the IP network is in that file - it's just a text file - use Ctrl F to locate it, you know it came from GeoIP ^^ -
@Gertjan, I had the same thought about free vs not-free GeoIP list of networks.
That is why (as I mentioned in my initial post), I connected to my free MaxMind account and manually downloaded the latest GeoLite2-City-Blocks-IPv4.csv file and inside I found that GeoIP is pointing to the correct location (167.86.41.48/28 --> Ashburn, US). It looks like my free MaxMind account already holds the correct value.I am not sure how pfBlockerNG populates the IP list per country, but I assume it pulls a different file from the MaxMind website and one of the following happens:
- The MaxMind file is with wrong value (I do not know how to confirm this from the pfSense CLI).
- pfBlockerNG incorrectly updates the IP lists per country, provided by MaxMind.
Is anyone from the community here aware, how I can confirm if the downloaded MaxMind file is at fault, so I can report it to the MaxMind team?
Thank you.
-
@Gertjan said in pfBlockerNG does not show properly the MaxMind GeoLite2 GeoIPs:
It takes mere moments to remove the 'not sure' here.
GeoIP files are downloaded and placed here : /var/db/pfblockerng/original/
If the IP network is in that file - it's just a text file - use Ctrl F to locate it, you know it came from GeoIP ^^I did the following test:
- Opened the file /var/db/pfblockerng/original/pfB_Asia_v4.orig
- Removed the line 167.86.41.48/28
- Saved the file and then confirmed that the line is not there anymore
- Performed pfBlocker > Force > Reload > All
- Opened the file /var/db/pfblockerng/original/pfB_Asia_v4.orig and found that the line (167.86.41.48/28) is back.
Correction:
I misunderstood the explanation from @Gertjan.
I am going to contact MaxMind about this problem.Thank you.
-
I actually did some digging on my pfSense and found this:
- Opened the file /usr/local/share/GeoIP/GeoLite2-Country-Blocks-IPv4.csv
- Found this line 167.86.41.48/28,6252001,294640,,0,0,
- Opened the file /usr/local/share/GeoIP/GeoLite2-Country-Locations-en.csv
- Confirmed that
- geoname_id points to US (6252001,en,NA,"North America",US,"United States",0)
- registered_country_geoname_id points to Israel (294640,en,AS,Asia,IL,Israel,0)
Next,
- Opened the folder /usr/local/share/GeoIP/cc/
- Found that the line 167.86.41.48/28 exists in multiple files
- Asia_v4.txt
- IL_rep_v4.txt
- North_America_v4.txt
- US_v4.txt
@Gertjan, would you (or someone else from the community) be able to confirm if pfBlockerNG is not at fault here because of the registered_country_geoname_id value?
IMPORTANT NOTE: The owner of the IP range is in Israel, but the IP range is hosted in US.
-
@TCI_user said in pfBlockerNG does not show properly the MaxMind GeoLite2 GeoIPs:
Opened the file /var/db/pfblockerng/original/pfB_Asia_v4.orig
Removed the line 167.86.41.48/28
Saved the file and then confirmed that the line is not there anymore
Performed pfBlocker > Force > Reload > All
Opened the file /var/db/pfblockerng/original/pfB_Asia_v4.orig and found that the line (167.86.41.48/28) is back.Lol .... serious ?
pfblockerng , when you install it does : nothing.
Then the admin starts to add one or two things :
IP lists. The GeoIP lists are just IP lists
DNSBL lists.
The IP lists can be used 'as is' by the firewall, pf. You can use these IP (lists) to pass, block, etc.
DNSBL : pf can't do anything with these. So pfBlockerng makes them avaible to the pfSense resolver. From now on, for every host name to be resolved, bedore it goes 'outside' to do its resolving job, it compares the host nale with the list. If found, it reurn right away the result ;: it will be 0.0.0.0 (if you have selctyed null blocking).
As said : pfBlockerng itself does nothing.
Wait .... I forgot something : it does do something : it downloads the lists you have selected, and it will update (maintain) these lists with their latest version. So if upstream the list gets modified, you will get automatically the newer version.You don't have to edit these files yourself. You shouldn't do that. (its useless for the reason stated above) I showed you the files so you can see where the IP or IP networks was listed.
What you can do with pfBlocker : per IP or DNSBL feed (list) : you can handle the exceptions. Add them == add a "white list" IP or IP network or DNSBL (host name).
You could (examples) :
Create your own local list with IPs or IP networks, and use this private list in a firewall rule.
Place this firewall rule above the rule of the GeoIP list, and make it a pass rule. If needed, add other IPs.@TCI_user said in pfBlockerNG does not show properly the MaxMind GeoLite2 GeoIPs:
so I can report it to the MaxMind team?
Euh .... don't ?!
They will propose you a solution right away. Don't forget to take your credit card as you will need it.
The GeoIP non-free lists are way more accurate and updated way faster.I am going to contact MaxMind about this problem.
You can of course signal them your findings. That's very
@TCI_user said in pfBlockerNG does not show properly the MaxMind GeoLite2 GeoIPs:
would you (or someone else from the community) be able to confirm if pfBlockerNG is not at fault here because of the registered_country_geoname_id value?
If all goes well you know now that pfBlockerng does 'nothing' so it can't be faulty.
And even if it is, it isn't, as it was the admin that instructed pfBlockerng to use a faulty list. So have a chat with the admin.
It already happened : on a very popular IP list, 8.8.8.8 was added.
Now you have enough info to fully appropriate the total impact of what happened. It was spectacular.
Consider this : inspect the stuff you download (with pfBlockerng) before using it ... ?! and if you're not sure, don't us it. remember : security first. -
@Gertjan, do you know who creates the files inside the /usr/local/share/GeoIP/cc/ folder?
My understanding is that the files are generated locally (with a pf script). If I am correct, then the pf script incorrectly populated the IP line (167.86.41.48/28) in multiple list files (Asia_v4.txt,
IL_rep_v4.txt, North_America_v4.txt and US_v4.txt) based on the host location and the owner location. As a result, the /var/db/pfblockerng/original/pfB_Asia_v4.orig file is holding incorrect values because the owner location is not related to the Geo location of the IP.Am I wrong in my understanding?
Thank you.
-
When you install initially pfSense, it doesn't know what or who 'GeoIP' is.
When you install the pfSense pfBlockerng package, several files and folders get created.
Among these are :
and I presume that one of these two FreeBSD packages create the folders/files you mentioned.
Then, to actually use the GeoIP IP 'database' files, you need to create an account with GeoIP :
Take note of the phrase :
The GeoIP database is automatically updated each day at a random hour.
and from now on the GeoIP base files (maybe / probably already present) will get updated.
After all, you want to use recent files, not very old files/info.Btw : have a search on this forum. It's not uncommon GeoIP files contain errors. As said earlier, blocks with IPs are traded every day, as they are worth gold these days.
-
@Gertjan, thank you for the basic installation and configuration instructions.
I completed these steps already and my pfBlockerNG properly communicates with the MaxMind service on a daily basis. As a result, I do have the daily version of the MaxMind GeoIP database.The problem I am talking about, is related to the way how pfBlockerNG generates the IP lists (like pfB_Asia_v4) from the already downloaded MaxMind GeoIP database.
Unfortunately, I am not a programmer, and I do not have the knowledge to trace the actions inside the pfBlockerNG source code :(
As a reference, please see my update here.
@BBcan177, would you be able to have a look on this problem. If needed, I can provide more details from my system for proper evaluation.
Thank you.
-
Its probably related to the addition of _rep (Represented) options that you selected.
It would show the country as indicated in the _rep Maxmind database.
-
@BBcan177, your suggestion nailed it.
I was not aware about the poupous of the _rep lists. Now I know
Case closed.
Privacy Policy · Cookie Policy