IP-Blocklist

hawks_nest

Thanks, I just re-loaded the rules and it is working great. Thanks for this great package. ;D

Slab

Did we ever resolve the IP Blocklist service having this:

Current Status = NOT running

You are blocking 0 Networks/IPs

Even though the "Enable IP-Blocklist" is checked? It seems to happen after some period of time… haven't figured out how long, usually I check each day and it seems consistent.

I'm using embedded, don't know if its specific to this. (1.2.3-release)

Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

tommyboy180

@Slab:

@wm408:

Did we ever resolve the IP Blocklist service having this:

Current Status = NOT running

You are blocking 0 Networks/IPs

Even though the "Enable IP-Blocklist" is checked? It seems to happen after some period of time… haven't figured out how long, usually I check each day and it seems consistent.

I'm using embedded, don't know if its specific to this. (1.2.3-release)

Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

I'll look into this today hopefully.

seggerman

Tommyboy, all

it seems as if IPblocklist is working for everybody except for me :-[ … I currently have two issues:

email settings
see: ipblocklist_1.png

I've set all parameters, but when I hit "test" I get the error
[code]Warning: fsockopen(): unable to connect to none://smtp.1und1.de:25 (Unable to find the socket transport "none" - did you forget to enable it when you configured PHP?) in /usr/local/www/packages/ipblocklist/class.smtp.php on line 122 Mailer Error: SMTP Error: Could not connect to SMTP host.

I solved this problem by commenting

//$mail->SMTPSecure = "none";

in the email_send.php file

Interface settings:
I have in the interfaces.txt file "any", so all interfaces should be activated. Looking at the interfaces tab I get:
see: ipblocklist_if.png

strangely only the LAN interface is available. Going into the ipblocklist_if.php file I modified a few lines of code

                   $portinfo): ?>
$comma_array=implode(",",$iface);
echo "$portname - $comma_array 
";
?>

so that I can see exactly the $iface definitions and I get:
see: ipblocklist_if_new.png

the checking of the interface goes against the physical interface address, instead of pppoe0
The question is if the blocking of the IP-addresses still occur even if the interface tab is "messed up".

I'm currently running on Current version: 2.0-RC1 - Built On: Sat Mar 12 01:18:33 EST 2011

Hope someone can help me out.

Cheers + Regards

Alexander

ipblocklist_if_new.png_thumb

ipblocklist_if.png_thumb

ipblocklist_1.png_thumb

tommyboy180

seggerman,

Hopefully I can get into it more. Right now I don't have a 2.0 RC1 install. I'm working on getting mine going. Soon I will be able to fully support your issue.

EDIT:

I just got 2.0RC1 running. 2.0-RC1 (i386) built on Tue Mar 15 08:53:58 EDT 2011.

I installed the package and everything is good. I would try re-moving the package and re-installing. See if that helps.

Slab

@Slab:

Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

After a bit of experimentation, I've been able to isolate what appears to cause IP-Blocklist to change to a disabled state. It happens every time the pfSense filter gets reloaded (at least it does with my install). If I select 'Filter Reload' in the Status menu (and then press the 'Reload Filter' button), IP-Blocklist will change to a disabled state. Presumably this will happen when the filter periodically/automatically reloads. Thx…

tommyboy180

@Slab:

@Slab:

Hi …sorry to resurrect this, but it seems that I am having the exact same problem on the non-embedded version of pfSense. I am running 2.0-RC1-i386 (no snapshots/updates applied). I was able to confirm that last night the status showed running, and this morning it shows not running. "Enable IP-Blocklist" is always checked. If I click 'Save' it changes the status to running again. This has happened several times over the course of the last three days (new install), and I haven't determined if there is a fixed time frame when the status changes.

I am running a vanilla install with only the IP-Blocklist and Snort packages added. Thanks...

After a bit of experimentation, I've been able to isolate what appears to cause IP-Blocklist to change to a disabled state. It happens every time the pfSense filter gets reloaded (at least it does with my install). If I select 'Filter Reload' in the Status menu (and then press the 'Reload Filter' button), IP-Blocklist will change to a disabled state. Presumably this will happen when the filter periodically/automatically reloads. Thx…

Correct. This is one of the down sides to the package as it 'injects' the pfctl tables into the firewall rules. This is the way the package has always been. I have been looking for a way to make the package more resilient however I have not found that method as of yet. Perhaps I need to start talking to some of the senior devs to find this solution.

bubba

Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

I have not installed any other packages besides ipblocklist
I can add list url using the http://iblocklist….gz links
But when I check enable ip-blocklist and save/update nothing happens
If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
I know this is an issue as I see it discussed here, I have tried:
reinstalling the package
uninstall, reboot, install the package
edit a firewall rule, save, enable ip-blocklist
edit a firewall rule, save, reboot, enable ip-blocklist
Ran pfsense updates to the current update
uninstall, reinstall ip-blocklist package after running the updates.
Reboot, resave, etc.

Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
Thanks!

Supermule

Using FF or IE??

@bubba:

Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

I have not installed any other packages besides ipblocklist
I can add list url using the http://iblocklist….gz links
But when I check enable ip-blocklist and save/update nothing happens
If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
I know this is an issue as I see it discussed here, I have tried:
reinstalling the package
uninstall, reboot, install the package
edit a firewall rule, save, enable ip-blocklist
edit a firewall rule, save, reboot, enable ip-blocklist
Ran pfsense updates to the current update
uninstall, reinstall ip-blocklist package after running the updates.
Reboot, resave, etc.

Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
Thanks!

bubba

ahhhh no kidding! IE. I just went into FF and it's working beautifully! wow thanks! ;D

@Supermule:

Using FF or IE??

@bubba:

Hello, I'm a pfsense newbie. I recently converted because I came across this forum and loved the idea of the ipblocklist add-on. ok so I installed on a hard drive using pfsense-2.0-RC1-i389-20110226-1530.iso.gz. Install wouldn't boot so my final solution was to create 2 partitians and then for some reason it finally worked. (which is why I'm scared to have to reinstall pfsense). First thing I did after I got pfsense up and running was install the ipblock package but whatever I try I cannot get it enabled.

I have not installed any other packages besides ipblocklist
I can add list url using the http://iblocklist….gz links
But when I check enable ip-blocklist and save/update nothing happens
If it's not running usually a reboot will fix "current status = running" but I'm always blocking 0 and enable doesn't stay checked.
I know this is an issue as I see it discussed here, I have tried:
reinstalling the package
uninstall, reboot, install the package
edit a firewall rule, save, enable ip-blocklist
edit a firewall rule, save, reboot, enable ip-blocklist
Ran pfsense updates to the current update
uninstall, reinstall ip-blocklist package after running the updates.
Reboot, resave, etc.

Is there anything else I can try...I really want to get this working. Should I reinstall pfsense?
Thanks!

bubba

ok maybe another dumb question but…
I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
I have the following lists:
http://iblocklist.dbnservers.net/files/bt_spyware.gz
http://iblocklist.rlcassidy.net/files/bt_ads.gz
http://ibl.gamechaser.net/files/bt_level2.gz
http://iblocklist.rlcassidy.net/files/bt_level3.gz
http://iblocklist.dbnservers.net/files/bt_level1.gz

So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

Thanks in advance!

Slab

@bubba:

ok maybe another dumb question but…
I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
I have the following lists:
http://iblocklist.dbnservers.net/files/bt_spyware.gz
http://iblocklist.rlcassidy.net/files/bt_ads.gz
http://ibl.gamechaser.net/files/bt_level2.gz
http://iblocklist.rlcassidy.net/files/bt_level3.gz
http://iblocklist.dbnservers.net/files/bt_level1.gz

So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

Thanks in advance!

Just a guess …but perhaps peerblock is giving you the total IP addresses in each subnet that is blocked in addition to any individual IP addresses that may be blocked, while IP-Blocklist is only counting each subnet (not the address totals within each subnet) plus any individual IP addresses that may be blocked...

tommyboy180

@Slab:

@bubba:

ok maybe another dumb question but…
I'm running peerblock on my computer right now. It only has the 3 default lists running (p2p, spyware, ads) and says it is blocking 776,905,708 IPs

My pfsense firewall with ipblocklist is also running and it says "you are blocking 351,073 network/IPs"
I have the following lists:
http://iblocklist.dbnservers.net/files/bt_spyware.gz
http://iblocklist.rlcassidy.net/files/bt_ads.gz
http://ibl.gamechaser.net/files/bt_level2.gz
http://iblocklist.rlcassidy.net/files/bt_level3.gz
http://iblocklist.dbnservers.net/files/bt_level1.gz

So what I don't understand is why is peerblock still getting activity, and also why are the ip numbers so much lower in ipblock when I'm using the same lists plus more.

Thanks in advance!

Just a guess …but perhaps peerblock is giving you the total IP addresses in each subnet that is blocked in addition to any individual IP addresses that may be blocked, while IP-Blocklist is only counting each subnet (not the address totals within each subnet) plus any individual IP addresses that may be blocked...

That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

bubba

ok thanks. So it would be best to keep running peerblock then as well I assume…

One other problem I'm having is when Level1 list is running and I go to yahoo.ca or yahoo.com I cannot perform a search (on both IE and FF). If I delete level1 it works. So as an experiment I added "Search Engines" http://list.iblocklist.com/?list=pfefqteoxlfzopecdtyw to the whitelist. Now yahoo is functioning just fine. So is this ok to use something that is meant to be blocked as something to allow? Anyone have issues with yahoo and level1 list? Is there a better list I should use to make search engines work? I'd prefer not to have to create one.

@tommyboy180:

That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

tommyboy180

@bubba:

ok thanks. So it would be best to keep running peerblock then as well I assume…

One other problem I'm having is when Level1 list is running and I go to yahoo.ca or yahoo.com I cannot perform a search (on both IE and FF). If I delete level1 it works. So as an experiment I added "Search Engines" http://list.iblocklist.com/?list=pfefqteoxlfzopecdtyw to the whitelist. Now yahoo is functioning just fine. So is this ok to use something that is meant to be blocked as something to allow? Anyone have issues with yahoo and level1 list? Is there a better list I should use to make search engines work? I'd prefer not to have to create one.

@tommyboy180:

That is correct. Each network get converted to CIDR. So the count reflects the networks and not the IPs. I can't change this.
You may still see traffic on your peerblock (on the client) behind pfsense because of the outbound traffic.

It wouldn't hurt to keep running peerblock but I think you misunderstood. Some of the outbound traffic will try to go to the blocked IP addresses. This is because of the peer sources and data that torrents give your torrent client to talk to other peers. So your peerblock will log those outbound attempts even though the IP-Blocklist package will still block those packets. You're covered either way. If you're paranoid then just run both.

As far as the yahoo thing goes, sure that's fine. That's what the whitelist is for. If yahoo is being blocked in the level1 and you need access then keep using the search engine list for your whitelist. That's the proper way of doing things. It's like permanently allowing yahoo within your peerblock. I do the same for banking sites and alike.

Take care!

mxx

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

tommyboy180

@mxx:

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

Level1 List is exactly that.

mxx

Oh, thank you! I must have confused something in that description then. Will take another look.
Sorry to have asked the obvious..

mxx

@tommyboy180:

@mxx:

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

Level1 List is exactly that.

Hmm..

is this it?

List name: level1
Author: Bluetack
Author's website: bluetack.co.uk
Author's description:
Companies or organizations who are clearly involved with trying to stop filesharing.
Companies which anti-p2p activity has been seen from.
Companies that produce or have a strong financial interest in copyrighted material.
Government ranges or companies that have a strong financial interest in doing work for governments.
Legal industry ranges.
IPs or ranges of ISPs from which anti-p2p activity has been observed.

So judging from its description it's a p2p enhancing blocklist, not designed to BLOCK FILESHARING (or at least make it more difficult).

I'm looking for a list that carries ip's of -for example- known torrent tracker sites and block that…

tommyboy180

@mxx:

@tommyboy180:

@mxx:

Hi,

does anyone know an ip blocklist that actually harms p2p instead of making it "more secure" (by blocking companies known to work for the MPAA?)
Something like a list for blocking known torrent trackers or something like that?

I searched and searched the net but all I could find was related to the opposite.

Thank you very much!

Level1 List is exactly that.

Hmm..

is this it?

List name: level1
Author: Bluetack
Author's website: bluetack.co.uk
Author's description:
Companies or organizations who are clearly involved with trying to stop filesharing.
Companies which anti-p2p activity has been seen from.
Companies that produce or have a strong financial interest in copyrighted material.
Government ranges or companies that have a strong financial interest in doing work for governments.
Legal industry ranges.
IPs or ranges of ISPs from which anti-p2p activity has been observed.

So judging from its description it's a p2p enhancing blocklist, not designed to BLOCK FILESHARING (or at least make it more difficult).

I'm looking for a list that carries ip's of -for example- known torrent tracker sites and block that…

lol. I completely miss understood you. You want a list that blocks P2P, correct?

Not sure. I guess you would have to google that. Pfsense 2.0 has layer 7 support so you will be able to block all P2P without using a list. This may be the better solution for you.