Country Block
-
Thank you for the new version Tommyboy180.
-
-
has anybody got this going on embedded yet? i'm getting hit with terrible spam and this would come in extremely handy.
i've changed my embedded to rw, did the install but it still complains. i've tried to create countries.txt etc and they get deleted the minute i try to commit countries in the gui.
i'd really appreciate some help with this as i've had to close down my mail server to stop spam coming in (even with spam assasin!) -
i got it going but could the author or anybody else let me know if i am doing anything wrong or opening a hole as i am not a coder.
i simply edited the config file like:$N = count($aCountry);
$myFile = "countries.txt";
conf_mount_rw();
$fh = fopen($myFile, 'w+');
$output = "**You selected $N Countries";for($i=0; $i < $N; $i++)
{
//echo($aCountry[$i] . " ");
fwrite($fh, $aCountry[$i] . "\n");
conf_mount_rw();
}
echo("");
}
}and away it went. it's running ok now. thank you.**
-
i got it going but could the author or anybody else let me know if i am doing anything wrong or opening a hole as i am not a coder.
i simply edited the config file like:$N = count($aCountry);
$myFile = "countries.txt";
conf_mount_rw();
$fh = fopen($myFile, 'w+');
$output = "**You selected $N Countries";for($i=0; $i < $N; $i++)
{
//echo($aCountry[$i] . " ");
fwrite($fh, $aCountry[$i] . "\n");
conf_mount_rw();
}
echo("");
}
}and away it went. it's running ok now. thank you.**
Awesome! You saved me a couple hours on my day off. I will make the changes and commit this in the CountryBlock package and the IPBlocklist package.
-
hey, no probs! thanks for your efforts and what a great package!
i still can't get the logging to work (tick box etc) so there must be another bit in there to change to rwthink the last bit above is meant to be "ro" instead of "rw"
-
The logging uses a feature already built into pfsense. It logs just like anything else, so you logs should show up under the Firewall logs.
-
i've edited it again and put the conf_mount_rw(); at the very begining of the php script and the conf_mount_ro(); at the end and it works fine now
conf_mount_rw();
mwexec("touch countries.txt");
//$myFile = "countries.txt";
//$fh = fopen($myFile, 'a+');if(isset($_POST['formSubmit']))
{
$aCountry = $_POST['formCountry'];if(isset($_POST['formOutbound']))
{
$output2 = " and Outbound access is BLOCKED.";
exec("touch OUTBOUND");
}
else
{
$output2 = " and Outbound access is ALLOWED.";
exec("rm OUTBOUND");
}if(isset($_POST['formlogging']))
{
exec("touch logging");
}
else
{
exec("rm logging");
}if(empty($aCountry))
{
$output = "**You didn't select any Countries.";
exec("rm countries.txt");
}
else
{$N = count($aCountry);
$myFile = "countries.txt";
$fh = fopen($myFile, 'w+');
$output = "**You selected $N Countries";for($i=0; $i < $N; $i++)
{
//echo($aCountry[$i] . " ");
fwrite($fh, $aCountry[$i] . "\n");
}
echo("");
}
}
conf_mount_ro
?>**** -
Excellent! Great work and thank you.
-
and what a great peice of code too. that cheeky little bleeder from taiwan is now being blocked good and proper! thank you!
-
um….there's a bit of a difference between the full & embedded versions. running on a full version with the same packages eg snort etc, country block runs. with the embedded. it stops after 5 mins. i'll play a bit more i think.
-
um….there's a bit of a difference between the full & embedded versions. running on a full version with the same packages eg snort etc, country block runs. with the embedded. it stops after 5 mins. i'll play a bit more i think.
I don't have any experience with embedded so any help is appreciated. I wonder what the difference is, hopefully there is a fix that we can implement.
-
I don't have any experience with embedded so any help is appreciated. I wonder what the difference is, hopefully there is a fix that we can implement.
The only real difference is if you must write to something other than /var you must conf_mount_rw() first and conf_mount_ro() afterwards.
-
@cmb:
I don't have any experience with embedded so any help is appreciated. I wonder what the difference is, hopefully there is a fix that we can implement.
The only real difference is if you must write to something other than /var you must conf_mount_rw() first and conf_mount_ro() afterwards.
Thank you very much.
- 8 days later
-
I have noticed that some IP's from other Countries have been getting blocked by SNORT even though I have the entire country set to block and country block package was verified to be running. I have never seen this before until now. This could be nothing, but I raise the question that if the country block is basically blocking the IP already, why now is SNORT even getting the opportunity to block the IP? Logic tells me that the country block package would simply overide any other decision the firewall would make on handdle the incoming connection and then simple discard the connection or auto block it from everthing. The only other option or idea I have is that maybe this is a new range of IP's not listed for those countries from the countryipblock.net website??? Maybe something to look into maybe not. Just thought I should say something.
The IP's below belong to Korea the republic and china according to countryipblock.net
121.176.124.65
123.159.194.21Thanks for any help or ideas.
-
I have noticed that some IP's from other Countries have been getting blocked by SNORT even though I have the entire country set to block and country block package was verified to be running. I have never seen this before until now. This could be nothing, but I raise the question that if the country block is basically blocking the IP already, why now is SNORT even getting the opportunity to block the IP? Logic tells me that the country block package would simply overide any other decision the firewall would make on handdle the incoming connection and then simple discard the connection or auto block it from everthing. The only other option or idea I have is that maybe this is a new range of IP's not listed for those countries from the countryipblock.net website??? Maybe something to look into maybe not. Just thought I should say something.
The IP's below belong to Korea the republic and china according to countryipblock.net
121.176.124.65
123.159.194.21Thanks for any help or ideas.
The pf Firewall follows rules in the order they are written to the config. SNORT rules must come before the countryblock rules. You can verify this by looking at /tmp/rules.debug.
What I think you are seeing the the same IP. Both packages block the IP but SNORT is the first to encounter based on your rule set. -
ok, so basically one way or another they will get blocked even though SNORT seen the incoming connection first. I just never noticed this before. Is it because the CountryBlock is sending information to the logs now?
Thanks,
-
ok, so basically one way or another they will get blocked even though SNORT seen the incoming connection first. I just never noticed this before. Is it because the CountryBlock is sending information to the logs now?
Thanks,
No the logs are separate. It's just the order that the rules are handled.
-
Ok, well thanks for explanning to me on what was happening.
Take Care,
Matt
-
-
First off, this is an AWESOME package, thank you for putting in the time and effort to make it what it is!
Question - mine will randomly report 'not running'. My DSL provider is AT&T and they change my IP randomly - sometimes twice a day (not the modem, its a result of something else they are experimenting with here in town). I think this is the cause, but I'm not sure. Logs don't report anything of interest, but that seems to be the correlation.
Is there a way to auto-start it, or to keep it from needing to be restarted every time this happens?
-
First off, this is an AWESOME package, thank you for putting in the time and effort to make it what it is!
Question - mine will randomly report 'not running'. My DSL provider is AT&T and they change my IP randomly - sometimes twice a day (not the modem, its a result of something else they are experimenting with here in town). I think this is the cause, but I'm not sure. Logs don't report anything of interest, but that seems to be the correlation.
Is there a way to auto-start it, or to keep it from needing to be restarted every time this happens?
You can have it start via a cron job. I'm not sure why it stops even if your IP changes, the only thing that causes the package to stop is a change in the firewall configuration. What you can do have a cron job run every minute or 5 minutes to run the package. That would keep it running all the time .
-
Is there a way to auto-start it, or to keep it from needing to be restarted every time this happens?
What I did is after I installed the Cron package, I created an auto start like this:
minute: 0
hour: *
mday: *
month: *
wday: *
who: root
command: /usr/local/etc/rc.d/countryblock.sh -
Thanks guys, I appreciate it.
Like I said, I don't know if it's the IP change but it seems to happen about that time. I put in the cron job, thanks a bunch!
And thanks again for the wonderful package and all the hard work you put into it!
- 9 days later
-
tommyboy180, when Traffic Shaping and country block are installed on the same pfsense firewall, it causes a 404 to be displayed when you attempt to view the traffic shaping panel and Country Block fails to run with an invalid syntax error.
-
tommyboy180, when Traffic Shaping and country block are installed on the same pfsense firewall, it causes a 404 to be displayed when you attempt to view the traffic shaping panel and Country Block fails to run with an invalid syntax error.
I found a quick fix and will be pushing an update soon.
-
I love you.
-
Hi there,
Great package, just wanted to check which interfaces this creates the rules on?
Cheers
J
-
Heyy Tommy….:) Was I spot on or what??? :D
See ya ;)
-
Hi there,
Great package, just wanted to check which interfaces this creates the rules on?
Cheers
J
This affects all interfaces.
-
Hi Tommy, this is a really great package - thanks for putting time into developing it! ;D
If possible in some future release it would be great to be able to apply the country block settings per interface, even better if it could be down to the Virtual IP level. I'm sure like many others, we have various services running on different Virtual IPs, some need to be open to the world, but others could be very heavily limited to 1 or 2 countries so being able to block countries down to the Virtual IP level would really help.
Thanks again,
Jon -
(if im posting in the wrong area just let me know)
Thanks Tommy for a great package, i am a huge fan and it and deployed this on every firewall i build…....ok now of for the question ;D
i have a Dell power edge 1850 dual xeons 3.0's and 2g ram and about 35gb of disk space running 1.2.3. Release. (Mind you this is first time i have seen this) We had the original config for this on a "Alix" board and just moved the config file over to the larger servers on a fresh install.
Issue: Committing the country's to the block list is fine however when i Enable Country Block i receive the following error:
Current Status = NOT running
/tmp/rules.debug:44: syntax error
You are blocking 0 Networksif anyone in the community has any ideas please let me know....Thanks again.....
-
(if im posting in the wrong area just let me know)
Thanks Tommy for a great package, i am a huge fan and it and deployed this on every firewall i build…....ok now of for the question ;D
i have a Dell power edge 1850 dual xeons 3.0's and 2g ram and about 35gb of disk space running 1.2.3. Release. (Mind you this is first time i have seen this) We had the original config for this on a "Alix" board and just moved the config file over to the larger servers on a fresh install.
Issue: Committing the country's to the block list is fine however when i Enable Country Block i receive the following error:
Current Status = NOT running
/tmp/rules.debug:44: syntax error
You are blocking 0 Networksif anyone in the community has any ideas please let me know....Thanks again.....
Just to make sure do you have the latest version of countryblock installed?
Also what other pages are you running? Traffic shaping? -
Version 0.1.4 on the C.B. and i am not running shaping, packages listed below: btw we are running the FW transparent.
Package Name Category Package Version
Country Block Firewall 0.1.4
Dashboard System 0.8.8
IP-Blocklist Firewall 0.2.2thanks for the FAST reply. ;)
-
Then its not a firewall any more and doesnt do any blocking….;)
-
We got it…thanks again Tommy, great package.
it was a bad config file......Thanks
-
We got it…thanks again Tommy, great package.
it was a bad config file......Thanks
Thank you for your support!
-
Yup….NP the config was from an embedded alix board and did not work when imported to a full hardware install..........from what i am told its a "Known" issue. Your package is awesome and it does the Job 100%! thanks again. The folks here at Bluegrassnet appreciate it!
-
i wanted to say thanks for this package!!! its fantastic. This package is what got me introduced to pfsense since i needed something to block all of china and korea from my web servers. I have it added to cron to make sure it runs all the time as well.
I did have a question, is there any way to have this package to show up on the services screen?
I have that widget added to my main log in (dashboard) page on 2.0 and it would be good to see right there if it is running or not.
Just thought I would ask.
-
i wanted to say thanks for this package!!! its fantastic. This package is what got me introduced to pfsense since i needed something to block all of china and korea from my web servers. I have it added to cron to make sure it runs all the time as well.
I did have a question, is there any way to have this package to show up on the services screen?
I have that widget added to my main log in (dashboard) page on 2.0 and it would be good to see right there if it is running or not.
Just thought I would ask.
It's not really a service that is running to block the countries, so having this package show up in the services will not be possible. The way it works is by basically injecting a couple lines of deny rules to your fw config so being able to track the current status of the package will have to be done via other means. If you know php I would love the extra help!
There are still many changes to come and I haven't forgotten about that update deltaend!
I do appreciate the support, so thank you!