IP-Blocklist

tommyboy180

It seems like ipblocklist may have some incomparability with HAVP due to the way ipblocklist inject's it's rules into the firewall config.

I will do some digging around. Glad you got it working.

Xthink

Because I'm just new to pfSense (new to Linux and BSD) my box is in the process of

install pfSense
update pfSense
install packages
uninstall packages
reinstall pfSense

I think it's good for me because while I'm learning how it works little by little I have the feeling that I already memorized the process of installing/reinstalling :)

My concern is for several installation now I can't make ip-blocklist to work. Added list is not showing, though if I will add the same list I can see it is already on the list. The status also showed not running though enabled is checked. My installation/reinstallation magic is not working :)

How can I check if it is already working or not. Looks not for me because I added Onion Router and Tor list from I-Blocklist and I can still connect to Tor network.

tommyboy180

@Xthink:

Because I'm just new to pfSense (new to Linux and BSD) my box is in the process of

install pfSense
update pfSense
install packages
uninstall packages
reinstall pfSense

I think it's good for me because while I'm learning how it works little by little I have the feeling that I already memorized the process of installing/reinstalling :)

My concern is for several installation now I can't make ip-blocklist to work. Added list is not showing, though if I will add the same list I can see it is already on the list. The status also showed not running though enabled is checked. My installation/reinstallation magic is not working :)

How can I check if it is already working or not. Looks not for me because I added Onion Router and Tor list from I-Blocklist and I can still connect to Tor network.

What browser are you using?

Xthink

google chrome 5.0.375.126

I just check with firefox portable 4.0b5pre, the list is there but the status is also "Not Running". Clicking Save/Update makes it run but it's not running again when I restart pfSense. Is it normal?

The list display is also fine with IE.

tommyboy180

@Xthink:

google chrome 5.0.375.126

I just check with firefox portable 4.0b5pre, the list is there but the status is also "Not Running". Clicking Save/Update makes it run but it's not running again when I restart pfSense. Is it normal?

The list display is also fine with IE.

I think you are missing something. 1. Paste your list link into the form and press '+'. 2. Check 'Enable IP-Blocklist. 3. Click Save/Update.

IE doesn't work with this package. Use FF.

Pistolero

Yesterday I noticed that Country Block also interferes with HAVP… I was sad to have to uninstall it...

Xthink

I just updated to the latest snapshot build, using ff ip-blocklist installed fine and i added

http://iblocklist.com/list.php?list=bt_level1
http://iblocklist.com/list.php?list=bt_proxy
http://iblocklist.com/list.php?list=tor

Tried to connect to tor and still works fine. The status is running.

Also, is disabling a certain list (like a checkbox) and not enable all or nothing on the plan for the future releases?

Xthink

As a follow-up, is this normal?

_Current Status = Running

You are blocking 0 IPs_

Same, using this list:
http://iblocklist.com/list.php?list=bt_level1
http://iblocklist.com/list.php?list=bt_proxy
http://iblocklist.com/list.php?list=tor

tommyboy180

@Xthink:

As a follow-up, is this normal?

_Current Status = Running

You are blocking 0 IPs_

Same, using this list:
http://iblocklist.com/list.php?list=bt_level1
http://iblocklist.com/list.php?list=bt_proxy
http://iblocklist.com/list.php?list=tor

Please look back on previous posts, this has been discussed twice now. Please read the FAQ as well.
Also, I am still working on HAVP compatibility for those of you who want it. It sucks right now that one or the other has to be disabled so if there is anyone who knows php, you can help.

DWAyotte

I am really happy to see this package! I am going to give it a shot and if all goes well I will roll it out to all my pfSense boxes.

Many thanks to the author! :)

tommyboy180

@DWAyotte:

I am really happy to see this package! I am going to give it a shot and if all goes well I will roll it out to all my pfSense boxes.

Many thanks to the author! :)

Thank you!

DWAyotte

So far I am pretty impressed and happy. :)

I don't mean to sound picky, but is there a way to whitelist? Or will there be in the future?

tommyboy180

@DWAyotte:

So far I am pretty impressed and happy. :)

I don't mean to sound picky, but is there a way to whitelist? Or will there be in the future?

That is coming in the next couple updates. I haven't had time to even sit down and look at the package lately due to other priorities.
As soon as I have a good amount of time to dedicate to the project I will update the package.

screech

Hello, I'm french, so sorry for my bad english ;)

I use Pfsense V2 and Ip-Blocklist.

I try to put level1 and level2 list in ip-blocklist

When I Save/Upload I have this message :

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 780

As said in previous message i try these thing :

Add memory_limit = 128M in /usr/local/lib/php.ini and /usr/local/etc/php.ini -> It disapear after reboot
Add ini_set("memory_limit","128M"); in /etc/inc/config.inc -> Maybe it work… Or not... It doesn't shown in /usr/local/lib/php.ini or /usr/local/etc/php.ini
I think 128M is not enough so I try to put 256M -> Exactly the same
_From I-Blocklist, lvl1 is about 814983437 IPs and lvl2 is about 330844784 IPs. After the error message, I have only 326376 IPs Blocked and the Status is Running.

An other thing is strange, when I "Purge All" The 2 lists stay in the "Current List(s)"
When 1 Add just lvl1 list, it's ok. The "Current List(s)" show me 1 list..

And the last strange thing (but maybe it's normal), when I go to Status: Package logs, it say : "No packages with logging facilities are currently installed." (And the "Enable Logging" is check and saved in Ip-Blocklist of course)

I Tryed to uninstall and reinstall the package several time. Nothing work.

I Have these package installed :

Cron
NUT
Snort
IP-Blocklist of course

Can you help me please ?

Add : I use Firefox ;) and the list are these in the exemple : http://iblocklist.whitacrecomputers.com/files/bt_level1.gz_

tommyboy180

@screech:

Hello, I'm french, so sorry for my bad english ;)

I use Pfsense V2 and Ip-Blocklist.

I try to put level1 and level2 list in ip-blocklist

When I Save/Upload I have this message :

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 81 bytes) in /etc/inc/util.inc on line 780

As said in previous message i try these thing :

Add memory_limit = 128M in /usr/local/lib/php.ini and /usr/local/etc/php.ini -> It disapear after reboot

Add ini_set("memory_limit","128M"); in /etc/inc/config.inc -> Maybe it work… Or not... It doesn't shown in /usr/local/lib/php.ini or /usr/local/etc/php.ini

I think 128M is not enough so I try to put 256M -> Exactly the same
_From I-Blocklist, lvl1 is about 814983437 IPs and lvl2 is about 330844784 IPs. After the error message, I have only 326376 IPs Blocked and the Status is Running.

An other thing is strange, when I "Purge All" The 2 lists stay in the "Current List(s)"
When 1 Add just lvl1 list, it's ok. The "Current List(s)" show me 1 list..

And the last strange thing (but maybe it's normal), when I go to Status: Package logs, it say : "No packages with logging facilities are currently installed." (And the "Enable Logging" is check and saved in Ip-Blocklist of course)

I Tryed to uninstall and reinstall the package several time. Nothing work.

I Have these package installed :

Cron

NUT

Snort

IP-Blocklist of course

Can you help me please ?

Add : I use Firefox ;) and the list are these in the exemple : http://iblocklist.whitacrecomputers.com/files/bt_level1.gz

Adding large lists will result in the php memory error. Just wait for the 'spinning animation' in FF stop before you continue.
When it says you are blocking X amount of IPs it's supposed to say X amount networks/IPs. Then number is correct just the wrong wording.
Purge all basically deletes your settings. You may try refreshing to see if your settings have been deleted. If it's not working on BETA 2 then you may have to delete one by one.
Logging doesn't go to the package logging section, all logging goes to the firewall log.

Updates will be coming soon for those who are waiting. Keep on the look out for email alerts, bug fixes, and feature additions._

screech

Thank you for your help.

Large file do the Error but it's load -> OK ;)
Number of IP Blocked = Number of Network/IP Blocked -> OK ;)
Purge All Work, it's just a "Cache" Problem of my Firefox -> Ok ;)
Logging go to the Firewall Logging -> Hum… Maybe... How can I be sure Ipblocklist block something ? Is there a way to see if a log is from Ip-Blocklist rules or if it's from Firewall Rules ? Can I see the name resolution of IP (List have a name for each IP, so it could be great if I can see the name instead of the IP ;) )

I can't wait the update ;) Thank you very much for your work.

tommyboy180

@screech:

Thank you for your help.

Large file do the Error but it's load -> OK ;)

Number of IP Blocked = Number of Network/IP Blocked -> OK ;)

Purge All Work, it's just a "Cache" Problem of my Firefox -> Ok ;)

Logging go to the Firewall Logging -> Hum… Maybe... How can I be sure Ipblocklist block something ? Is there a way to see if a log is from Ip-Blocklist rules or if it's from Firewall Rules ? Can I see the name resolution of IP (List have a name for each IP, so it could be great if I can see the name instead of the IP ;) )

I can't wait the update ;) Thank you very much for your work.

Right now the only way to tell what was blocked by the package is to click on the red x next to the entry. That returns a popup with the line number of the firewall rule. You can then open the firewall rules and see what line IPblocklist is on. I know it's a terrible way to track what get's blocked, but I don't have control over how pfsense displays logs. A solution would be to setup a remote logging server and filter that.
Thank you for your support! I look forward to the updates soon too!

DigitalJer

Love this package, TB. Some good ideas in there, looking fwd to whitelisting etc as well - excellent groundwork tho. No complaints whatsoever.

tommyboy180

@DigitalJer:

Love this package, TB. Some good ideas in there, looking fwd to whitelisting etc as well - excellent groundwork tho. No complaints whatsoever.

Thank you! So am I. I just need to find some time to sit down and get it done.

BenKenobe

Is there any way to get this to look inwards i.e. to a local server instead of a URL, it seems crazy to point it out at a URL when that URL is my servers URL. I have the gz files or txt files that I can host locally, I don't want to be dependant upon 'outside' sources.

Also the IP addresses blocked count - is this a count of IP addresses in the files or actively blocked addresses?