Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    IP-Blocklist

    pfSense Packages
    86
    496
    258853
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tommyboy180 last edited by

      Just like PeerGuardian2 the IP-Blocklist package can block ranges of IPs from lists or manual input. This is a Global IP blocking package.
      Ver. 3.5

      Info:
      This package uses the pf (pfctl) to block IP addresses. For each IP range or list added a pf table is made and applied to the firewall to prevent traffic from being sent to and traffic from being received from the target. You can whitelist ranges by entering a list from sites like iblocklist.com.
      Tested on 1.2.2, 1.2.3, and 2.0 RC3 with FF & Chrome. IE not supported.

      Limits:
      Lists can have any extension BUT if the list is compressed only .gz is supported. CIDR is coming for pfsense 2.0
      Long lists take more ram (not much)
      Increase your php memory limit in /etc/inc/config.inc to avoid issues if you use many lists

      Format
      The lists must be in the PeerBlock or PeerGuardian2 format.
      Single IP Example: NAS:192.168.1.110-192.168.1.110
      Range IP Example: HOME:192.168.1.0-192.168.1.255
      CIDR Ranges will be in future versions for 2.0 only.

      FAQ:
      Q: How do I know if the list got applied?
      A: The package web interface will display the current status.

      Q: I notice a performance drop with network traffic after applying
      A: When applying the list at the system has to download and process the list. This should only take less than 2 mins.

      Q: I have the "Enable" check box checked but I don't think its blocking any IPs
      A: Any Errors will be at the bottom of the page when you press Save/Update

      Q: My list site only give dynamic links to lists (I can't get a direct link to the file)
      A: You need a direct link to the file in order for the package to work. Use a download manager like FF has. Download the file then go back to the download manager and copy the file link. Paste that into the package. File upload may be in the future.

      Q: Where can I get lists to block SPAM and other bad IPs?
      A: http://www.iblocklist.com/lists.php

      Q: I think I can improve your package or add features, how can I help?
      A: Send me a PM

      Q: I'm running embedded and it's not working
      A: http://forum.pfsense.org/index.php/topic,24769.msg170314.html#msg170314

      Features include interface filtering, outbound access, whitelisting, and much much more!



      -Tom Schaefer
      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

      Please support pfBlocker | File Browser | Strikeback

      1 Reply Last reply Reply Quote 0
      • S
        simby last edited by

        and where is packet to download? :)

        1 Reply Last reply Reply Quote 0
        • J
          jigpe last edited by

          Thanks for the file :) Gonna test this out this afternoon. I'll let you know the updates :)
          Thanks again. Great job :)

          jigp
          1.2.2

          1 Reply Last reply Reply Quote 0
          • C
            Cino last edited by

            I can't seem to locate this package, is it called : 'URL Table Aliases'?

            1 Reply Last reply Reply Quote 0
            • T
              tommyboy180 last edited by

              Version 0.1.5 is complete. This update uses pf tables as the blocking method. This brings a huge performance boost but uses more ram. New screen shot added.

              Package will be committed soon. Just trying to get a hold of a DEV to commit. I also have some new updates to the package, one update will let you process a level1 list in 2 seconds and apply it immediately!

              Thank you jim-p for the idea.

              You can download the packages right now while you wait for a DEV to commit them. http://www.tomschaefer.org/temp/pfsense/packages/

              -Tom Schaefer
              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

              Please support pfBlocker | File Browser | Strikeback

              1 Reply Last reply Reply Quote 0
              • C
                Cino last edited by

                i installed 0.1.5 and when i try to start it i get this error: ipblocklist.conf:8: cannot define table ipblocklist: Cannot allocate memory

                Running 1.2.3.. Lots of add ons, squid, squidguard,snort. i have 1.7g free of memory

                1 Reply Last reply Reply Quote 0
                • T
                  tommyboy180 last edited by

                  I am working on an update. I think the big lists are hitting a ceiling. I should have 0.1.6 out here soon, at-least within the week.

                  -Tom Schaefer
                  SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                  Please support pfBlocker | File Browser | Strikeback

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cino last edited by

                    Its a limit on the system i think

                    pfctl -sm

                    states        hard limit    10000
                    src-nodes    hard limit    10000
                    frags        hard limit    5000
                    tables        hard limit    1000
                    table-entries hard limit  200000

                    would need to increase table-entries somehow… I'm playing URL Table Aliases and notice I get the error with Level1 list

                    1 Reply Last reply Reply Quote 0
                    • T
                      tommyboy180 last edited by

                      Update 0.1.6 released.

                      -Tom Schaefer
                      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                      Please support pfBlocker | File Browser | Strikeback

                      1 Reply Last reply Reply Quote 0
                      • S
                        Supermule Banned last edited by

                        Release notes??

                        1 Reply Last reply Reply Quote 0
                        • T
                          tommyboy180 last edited by

                          0.1.6 Release Notes:
                          Introduction
                          IP-Blocklist is a global IP blocking package. The package is designed to import IP lists in the format of “Descption:xx.xx.xx.xx-xx.xx.xx.xx” This is the format that PeerGuardian2 uses. Therefore, this package is a PeerGuardian2 solution at the gateway/router level.

                          What’s New
                          0.1.6 doesn’t overwrite or interfere with your existing firewall rules. 4 lines are inserted into the pf config file that allows pf to block the IPs in your list. pf is resync’d  with the pf config file. Building a pf table allows you to block thousands and thousands of IP addresses in a matter of seconds. The manual IP blocking feature still uses IPFW

                          Security considerations
                          This package gives you the power to completely block a range of networks and IPs, be careful not to block DNS servers, internal IPs, and other IPs/Networks that you rely on.

                          Contributed Software
                          Perl IP to CIDR converter edited for this package. Original code at: http://www.bluetack.co.uk/forums/index.php?showtopic=18081&pid=84901&st=0&#entry84901
                          IP2CIDR Perl script from Guy Patterson. Website: www.nullamatix.com

                          Requirements
                          This package installs Perl and the NET CIDR Perl module. Lists can be found at iblocklist.com

                          Upgrading from any version to latest
                          Please uninstall your previous version before installing the new version. Upgrading without uninstalling will lead to unknown/unwanted effects.

                          To-Do list
                          Script does not apply blocklist on startup.
                          Large lists hit a hard limit set by the pf config file.

                          -Tom Schaefer
                          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                          Please support pfBlocker | File Browser | Strikeback

                          1 Reply Last reply Reply Quote 0
                          • C
                            Cino last edited by

                            Have you been able to get one of the dev to add it to the package manager? My dumba$$ did something to the globals.inc file and now i can't access my box…lol... have to wait till i get home and do a quick rebuild.....

                            1 Reply Last reply Reply Quote 0
                            • T
                              tommyboy180 last edited by

                              I am still trying to get a hold of a dev. I have emailed them and contacted them on the freenode chat room.

                              I can email you a globals.inc file if you need. PM me.

                              -Tom Schaefer
                              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                              Please support pfBlocker | File Browser | Strikeback

                              1 Reply Last reply Reply Quote 0
                              • T
                                tommyboy180 last edited by

                                Version 0.1.9 is complete.

                                Changes:

                                • If enabled the block list will apply on start-up.

                                • Fixed "out of memory" errors. You can now have a lvl1,2,&3 list applied at the same time. New limit is 900,000 entries

                                • Removes duplicate entries to speed up process

                                This version is considered very stable. I have tested on 1.2.2 and 1.2.3.

                                -Tom Schaefer
                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                Please support pfBlocker | File Browser | Strikeback

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Supermule Banned last edited by

                                  Nice work Tommy!!

                                  Have you had any luck getting hold of the dev's??

                                  @tommyboy180:

                                  Version 0.1.9 is complete.

                                  Changes:

                                  • If enabled the block list will apply on start-up.

                                  • Fixed "out of memory" errors. You can now have a lvl1,2,&3 list applied at the same time. New limit is 900,000 entries

                                  • Removes duplicate entries to speed up process

                                  This version is considered very stable. I have tested on 1.2.2 and 1.2.3.

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    Cino last edited by

                                    When I try just the level1 list, i get this error after a min or 2 of clicking save/update

                                    Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 381

                                    The status states it is running but the Enable IP-Blocklist is not checked, even tho i checked it before clicking on save/update

                                    I've tried the level 2 and level 3 list and did not get the same error… Worked like it should I think...

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      tommyboy180 last edited by

                                      Yes. The web server runs out of memory. You can increase the memory limit in the php.ini file

                                      The script still operates as it should and the lists still get applied as they should. The only downside that I can see from this error is that the "Enabled" checkbox seems to not be checked when in fact it is.

                                      I chose not to have the package edit the php.ini memory limit because I didn't want to crash a pfsense install that had limited memory.

                                      You are correct that it does work as it should even with the error.

                                      -Tom Schaefer
                                      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                      Please support pfBlocker | File Browser | Strikeback

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        Cino last edited by

                                        Thanks again!!! Would you happen to know which php.ini file to change and how would I get it to stay after a reboot?

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          peterclark4 last edited by

                                          Will this automatically update the lists like PeerBlock/PeerGuardian does?

                                          1 Reply Last reply Reply Quote 0
                                          • G
                                            g4m3c4ck last edited by

                                            Just to be sure where exactly do the tarballs content go? And will the howto instructions break the current pkg system?

                                            1 Reply Last reply Reply Quote 0
                                            • T
                                              tommyboy180 last edited by

                                              This package gets updated on start-up and every time you click save.

                                              The tar archive is if you wanted to experiment without the package system. Just change your package system settings back to default after you install. This is only temporay until a DEV is kind enough to commit my package.

                                              -Tom Schaefer
                                              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                              Please support pfBlocker | File Browser | Strikeback

                                              1 Reply Last reply Reply Quote 0
                                              • T
                                                tommyboy180 last edited by

                                                IP-Blocklist is now available as a package!

                                                -Tom Schaefer
                                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                                Please support pfBlocker | File Browser | Strikeback

                                                1 Reply Last reply Reply Quote 0
                                                • S
                                                  Sambo last edited by

                                                  @tommyboy180:

                                                  This package gets updated on start-up and every time you click save.

                                                  Are you referring to the package itself or the blocklists?  Is there a way to automatically update your blocklists daily or whatever without restarting the firewall?

                                                  1 Reply Last reply Reply Quote 0
                                                  • T
                                                    tommyboy180 last edited by

                                                    On start-up the blocklists will get updated.

                                                    To have the lists updated on a specific schedule you have to create a cron job. The file to run is /usr/local/etc/rc.d/IP-Blocklist.sh

                                                    -Tom Schaefer
                                                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                                    Please support pfBlocker | File Browser | Strikeback

                                                    1 Reply Last reply Reply Quote 0
                                                    • S
                                                      Sambo last edited by

                                                      @tommyboy180:

                                                      On start-up the blocklists will get updated.

                                                      To have the lists updated on a specific schedule you have to create a cron job. The file to run is /usr/local/etc/rc.d/IP-Blocklist.sh

                                                      Sweet, thanks.  That would be a feature request from me then; GUI based scheduled blocklist updates :)

                                                      1 Reply Last reply Reply Quote 0
                                                      • A
                                                        ari last edited by

                                                        I would be interested in being able to tie this into Fail2Ban. Do to do we'd need a simple API to add items to the list. For example a RESTful api:

                                                        /api/blocklist/add?ip=1.2.3.4&expire=3600&key=kjdsft34jk8

                                                        1 Reply Last reply Reply Quote 0
                                                        • P
                                                          peterclark4 last edited by

                                                          This wouldn't play nice with the NanoBSD install until I added lines to mount the CF card for R/W access and then back to R/O access at the point of where it writes to the lists.txt file in ipblocklist_list.php.

                                                          1 Reply Last reply Reply Quote 0
                                                          • S
                                                            simby last edited by

                                                            I have this problem in pfsense 2.0 beta 1

                                                            Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 785

                                                            1 Reply Last reply Reply Quote 0
                                                            • T
                                                              tommyboy180 last edited by

                                                              @simby:

                                                              I have this problem in pfsense 2.0 beta 1

                                                              Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 785

                                                              Take a look at Cino's post above.

                                                              -Tom Schaefer
                                                              SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                                              Please support pfBlocker | File Browser | Strikeback

                                                              1 Reply Last reply Reply Quote 0
                                                              • J
                                                                jideel last edited by

                                                                Hello,

                                                                Sorry, but i can't get it to work.
                                                                I'm using pfSense 1.2.3 release and IP-Blocklist 0.1.9.
                                                                The box is used in a multi-wan context, plus some IPsecs, plus PPTP, plus Squid/Squidguard (use only on WAN1).
                                                                I tried to use the following list : http://list.iblocklist.com/?list=cn, and it seems to be well added in the GUI, but the status is always shown as "NOT running" in red.
                                                                I enabled/disabled the module, saved/updated, there's no error such as the memory error, and no message in the logs.
                                                                Any idea ?
                                                                Thank you.


                                                                1 Reply Last reply Reply Quote 0
                                                                • S
                                                                  sofakng last edited by

                                                                  How much do these additional tables slow down the router?

                                                                  It seems like "normal" firewalls only block a very small number of hosts (50?) but these lists seem to contain thousands of entries and it seems like it would take a lot of time to process every packet against so many hosts…

                                                                  1 Reply Last reply Reply Quote 0
                                                                  • P
                                                                    peterclark4 last edited by

                                                                    @peterclark4:

                                                                    This wouldn't play nice with the NanoBSD install until I added lines to mount the CF card for R/W access and then back to R/O access at the point of where it writes to the lists.txt file in ipblocklist_list.php.

                                                                    I still don't think that this is playing well with my NanoBSD install. I'm getting no errors and the current status is "Running" but it doesn't appear to be blocking any connections.

                                                                    1 Reply Last reply Reply Quote 0
                                                                    • T
                                                                      tommyboy180 last edited by

                                                                      @jideel:

                                                                      Hello,

                                                                      Sorry, but i can't get it to work.
                                                                      I'm using pfSense 1.2.3 release and IP-Blocklist 0.1.9.
                                                                      The box is used in a multi-wan context, plus some IPsecs, plus PPTP, plus Squid/Squidguard (use only on WAN1).
                                                                      I tried to use the following list : http://list.iblocklist.com/?list=cn, and it seems to be well added in the GUI, but the status is always shown as "NOT running" in red.
                                                                      I enabled/disabled the module, saved/updated, there's no error such as the memory error, and no message in the logs.
                                                                      Any idea ?
                                                                      Thank you.

                                                                      Jideel, Uninstall the package and reinstall. When the package was committed a mistake was made. This should fix your problem.

                                                                      @sofakng:

                                                                      How much do these additional tables slow down the router?

                                                                      It seems like "normal" firewalls only block a very small number of hosts (50?) but these lists seem to contain thousands of entries and it seems like it would take a lot of time to process every packet against so many hosts…

                                                                      Since the IPs (up to 900,000!) are added to a table it doesn't really impact performance in the way you think it would. PF is really awesome in that even a 900,000 ip table will not be noticeable when applied. Very little ram is used and CPU utilization doesn't even budge when my lists are applied.

                                                                      -Tom Schaefer
                                                                      SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                                                      Please support pfBlocker | File Browser | Strikeback

                                                                      1 Reply Last reply Reply Quote 0
                                                                      • S
                                                                        Supermule Banned last edited by

                                                                        I cant get it to start….............No matter what I do.

                                                                        Can add the lists, but status says not running....I have deleted, rebooted like 10 times....

                                                                        Doesnt say anything in the logs. Doesnt work..........:(

                                                                        Rel 1.2.3 with 0.1.9

                                                                        1 Reply Last reply Reply Quote 0
                                                                        • J
                                                                          jideel last edited by

                                                                          @tommyboy180 :
                                                                          just did what you said : install/reinstall, but still doesn't works.
                                                                          Now it says "/tmp/rules.debug:45: Rules must be in order: options, normalization, queueing, translation, filtering".
                                                                          I choosed to turn on the option "Disable all auto-added VPN rules." in the advanced settings, don't know if it matters to your plugin or not.
                                                                          Thanks for your help.

                                                                          1 Reply Last reply Reply Quote 0
                                                                          • G
                                                                            g4m3c4ck last edited by

                                                                            TommyBoy180: How much trouble would it be to make an IP-Allow list? Doesn't pfSense automatically block all but default anyways? Seems like using an allow list would be less intensive if it was possible.

                                                                            1 Reply Last reply Reply Quote 0
                                                                            • S
                                                                              Supermule Banned last edited by

                                                                              It blocks by rule, not by IP address.

                                                                              1 Reply Last reply Reply Quote 0
                                                                              • T
                                                                                tommyboy180 last edited by

                                                                                Some of you are having issues because of a mistake that was committed. The error has been corrected but you still have the old package running.

                                                                                Uninstall your package
                                                                                Reboot your box
                                                                                Re-install your package.

                                                                                PM me with any errors that you encounter and any specific settings that you have.
                                                                                I have tested the current package release on a fresh install of 1.2.3 and 1.2.2 and it is working correctly. I also tested unique settings such as Jideels's 'Disable all auto-added VPN rules' setting and the package works fine.

                                                                                Thank you all for your support with this package.

                                                                                Hopefully version 2 will include scheduled updates and a white-list feature. Keep the suggestions coming!

                                                                                -Tom Schaefer
                                                                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                                                                Please support pfBlocker | File Browser | Strikeback

                                                                                1 Reply Last reply Reply Quote 0
                                                                                • V
                                                                                  vagiff last edited by

                                                                                  ip blocker don't work with traffic shaper

                                                                                  turn off traffic shaper and enable ip blocker

                                                                                  sorry for my english

                                                                                  1 Reply Last reply Reply Quote 0
                                                                                  • T
                                                                                    tommyboy180 last edited by

                                                                                    I tested with traffic shaper enable and the package worked fine. You may have other firewall settings that could be disabling the package. Its really hard to say what is happening without looking at your unique setup. If you want you could send me your pfsense config to my email for further investigation.

                                                                                    -Tom Schaefer
                                                                                    SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                                                                    Please support pfBlocker | File Browser | Strikeback

                                                                                    1 Reply Last reply Reply Quote 0
                                                                                    • First post
                                                                                      Last post