Country Block

[kilthro]

I just updated to your latest version and I am having the same issue. It will stop running after a bit and then I have to manually start it. I added the cron job like a couple a posts above ( was running that cron setting before with no issue) and it still will not stay running.

I dont know if Snort is updating the FW rules/states and then cron isnt properly re-enabling country block after the change. Over the past week it has been working just fine. Just all this after the update version 1.6. I was running 1.4 prior.

I am on the latest 2.0 beta build that has been posted.

Is there anything you need from me that may assist with isolating the issue?

[tommyboy180]

@kilthro:

I just updated to your latest version and I am having the same issue. It will stop running after a bit and then I have to manually start it. I added the cron job like a couple a posts above ( was running that cron setting before with no issue) and it still will not stay running.

I dont know if Snort is updating the FW rules/states and then cron isnt properly re-enabling country block after the change. Over the past week it has been working just fine. Just all this after the update version 1.6. I was running 1.4 prior.

I am on the latest 2.0 beta build that has been posted.

Is there anything you need from me that may assist with isolating the issue?

List of packages installed please. Also do you have traffic shaping running?
I need to figure this out. I'm home now so I can work on this for the next couple of hours.

[chpalmer]

Just came home and Country Block is not running…

Have this in my logs.

Last 50 system log entries
Oct 1 10:14:12 syslogd: kernel boot file is /boot/kernel/kernel
Oct 1 17:28:47 root: rc.update_bogons.sh is beginning the update cycle.
Oct 1 17:28:49 root: Bogons file downloaded: no changes.
Oct 1 18:10:00 check_reload_status: check_reload_status is starting

1.2.3R with only Country Block and Cron installed as packages.

I use dynamic dns.

I have a vip for a static IP I have.

Im on cable.

If I think of anything else Ill add it later...

:)

[tommyboy180]

@chpalmer:

Just came home and Country Block is not running…

Have this in my logs.

Last 50 system log entries
Oct 1 10:14:12 syslogd: kernel boot file is /boot/kernel/kernel
Oct 1 17:28:47 root: rc.update_bogons.sh is beginning the update cycle.
Oct 1 17:28:49 root: Bogons file downloaded: no changes.
Oct 1 18:10:00 check_reload_status: check_reload_status is starting

1.2.3R with only Country Block and Cron installed as packages.

I use dynamic dns.

I have a vip for a static IP I have.

Im on cable.

If I think of anything else Ill add it later...

:)

Edit:
When the Bogons update cron job is run the firewall settings get re-applied and that is why countryblock was stopped. To counter this you can have countryblock run after this.
This may be why everyone is having difficulty with keeping the package running, a cron job is running that affects the firewall thus killing countryblock.

[tommyboy180]

Version 1.7 is available.

Changes:

• Complete UI overhaul

• Changed execution process

Hopefully these changes will help those people that are having trouble keeping the package running.

To upgrade Uninstall Countryblock, reboot, and then install the newest version.

[robfantini]

thank you for the update. we are lucky to have you working on this package.

0.1.6 would not stay running.

0.1.7 has been up approx an hour without a  problem…

one question - i enabled logging.  do I need to setup log rotation ?

[Supermule]

I have never seen updates come this fast…....;)

[tommyboy180]

@robfantini:

thank you for the update. we are lucky to have you working on this package.

0.1.6 would not stay running.

0.1.7 has been up approx an hour without a  problem…

one question - i enabled logging.   do I need to setup log rotation ?

Thank you. I hope it keeps running.
As far as log rotation goes: unless you are blocking a huge amount of networks and need to keep track of a couple days worth then no. Blocking a couple countries may increase your log size significantly depending on your networks, however. It's really Dependant on how many entries are being produced and how much you need to keep track of.

Thank you Supermule :)  I got off work early today and I wanted to fix this problem that some people were having with the last update.

[kilthro]

I dont have traffic shaping running

Packages are
Country Block
Cron
DarkStat
nmap
snort

I will give the updated version a try and see if that resolves it.

Thanks so much for your support and quick updates on this package. :-)

[robfantini]

After a few hours CB is still running.

Here is one thing to check:

when I  click 'Country Block' under 'Firewall' section in Pfsense the 'Enable Country Block' is 'on'

when I add countries, the 'Enable Country Block' is unchecked or 'off' at the top of the screen.
so for now if you add/change countries , reclick the 'Enable Country Block'

CB for us is working a lot better.

[mgc6288]

@tommyboy180:

Version 1.7 is available.

Changes:

• Complete UI overhaul

• Changed execution process

Hopefully these changes will help those people that are having trouble keeping the package running.

To upgrade Uninstall Countryblock, reboot, and then install the newest version.

Outstanding.  Like the new UI and cron is still tickin'.  Thanks!

[kilthro]

Well so far so good. It has been running for 3 hours now and its still up and not stopped. :-) So your changes seem to have corrected the issue. Thanks!

The only thing that doesnt seem to be automatic is if I change the firewall states with another package or clear it ect in settings which resets the current table which kills country block (as its mentioned in the package that it will), it doesn't seem like country block will start on its own with the cron job entry.  When I make the changes mentioned, I will let it sit there for 10 minutes and it will not start back up. Once I start it manually it seems to stay running.  So I am unclear why it will not start back up. I guess as long as I know I make changes and check to start it back up it should stay up and running without issue i suppose.

I do have this cron entry
minute: 0
hour: *
mday: *
month: *
wday: *
who: root
command: /usr/local/etc/rc.d/countryblock.sh

[robfantini]

@kilthro:

Well so far so good. It has been running for 3 hours now and its still up and not stopped. :-) So your changes seem to have corrected the issue. Thanks!

The only thing that doesnt seem to be automatic is if I change the firewall states with another package or clear it ect in settings which resets the current table which kills country block (as its mentioned in the package that it will), it doesn't seem like country block will start on its own with the cron job entry.  When I make the changes mentioned, I will let it sit there for 10 minutes and it will not start back up. Once I start it manually it seems to stay running.  So I am unclear why it will not start back up. I guess as long as I know I make changes and check to start it back up it should stay up and running without issue i suppose.

I do have this cron entry
minute: 0
hour: *
mday: *
month: *
wday: *
who: root
command: /usr/local/etc/rc.d/countryblock.sh

for every 5 min use
Minute: */5

*/2  # every 2 min etc.

[kilthro]

@robfantini:

@kilthro:

Well so far so good. It has been running for 3 hours now and its still up and not stopped. :-) So your changes seem to have corrected the issue. Thanks!

The only thing that doesnt seem to be automatic is if I change the firewall states with another package or clear it ect in settings which resets the current table which kills country block (as its mentioned in the package that it will), it doesn't seem like country block will start on its own with the cron job entry.  When I make the changes mentioned, I will let it sit there for 10 minutes and it will not start back up. Once I start it manually it seems to stay running.  So I am unclear why it will not start back up. I guess as long as I know I make changes and check to start it back up it should stay up and running without issue i suppose.

I do have this cron entry
minute: 0
hour: *
mday: *
month: *
wday: *
who: root
command: /usr/local/etc/rc.d/countryblock.sh

for every 5 min use
Minute: */5

*/2  # every 2 min etc.

I changed the 0 to */1 and then reset the states and it killed country block and waited a minute and it started back up. That seemed to do the trick. Thanks alot.
I

[darklogic]

Glad to know I was not crazy, well to some degree. Tommy, thanks for looking into this. I love this package, I really feel you have developed something that should be a standard option in most firewalls but is not.

Thanks for the quick replies and fast updates. Hands down to you…

Thanks again,

Matt

[XIII]

Nice new interface tommy appreciate it.

Gotta question for you though, i see that there are a few packages related to dns (country block,dns blacklist), is it possible to get something like OpenDNS but locally? mostly the custom shortcuts andstats (top domains etc)? if so how hard would it be?

[tommyboy180]

@XIII:

Nice new interface tommy appreciate it.

Gotta question for you though, i see that there are a few packages related to dns (country block,dns blacklist), is it possible to get something like OpenDNS but locally? mostly the custom shortcuts andstats (top domains etc)? if so how hard would it be?

I'm really not sure. Countryblock uses CIDR ranges which works nicely with the firewall and is really easy to script. As far as DNS stuff goes, I have no idea. I bet you could modify the DNS blacklist package to support what you are looking for.

I'm glad to see that people are getting better results with the latest version. Thank you all for your support.

[XIII]

The DNS Blacklist doesnt have anything at the GUI end for doing what I want, it would have to be done under the hood and I was thinking of something that would be easy for all, even those with out programming skills, though I am willing to learn.

I was thinking the tinyDNS package could do this but I gave up on it when I messed up DNS on my network (didnt get very far before doing this >:(), waiting until I can get a test system ready before trying it again, if I do get it working I plan on doing an FAQ/Tutorial on it as no one has made one publicly available that I could find.

[robfantini]

regarding cron  .

with CB getting closer to real stable, it is probably a bad thing to run the cron start job very often.

I may be wrong, as happens not infrequently , but  the 1-st part of the script /usr/local/www/packages/countryblock/execute.sh
{{{
pfctl -t countryblock -T kill
}}}
seems to disable the  countryblock rules .

shortly after the rules are enabled.

so the more stable this great package gets, the less frequent the cronjob should be run.

Also
/usr/local/www/packages/countryblock/execute.sh should be improved  if possible to check if the countryblock rules are active.  then restart only if needed.

Maybe someone who knows about pfctl could help with the script?

thanks again to the author for this package.  I owe you some beer.

[tommyboy180]

@robfantini:

regarding cron  .

with CB getting closer to real stable, it is probably a bad thing to run the cron start job very often.

I may be wrong, as happens not infrequently , but  the 1-st part of the script /usr/local/www/packages/countryblock/execute.sh
{{{
pfctl -t countryblock -T kill
}}}
seems to disable the  countryblock rules .

shortly after the rules are enabled.

so the more stable this great package gets, the less frequent the cronjob should be run.

Also
/usr/local/www/packages/countryblock/execute.sh should be improved  if possible to check if the countryblock rules are active.  then restart only if needed.

Maybe someone who knows about pfctl could help with the script?

thanks again to the author for this package.  I owe you some beer.

Great suggestion! Checking to see if it's running before processing is easy but if changes are made while it's running then the firewall entries for countryblock need to be deleted and re-added. If this isn't done then duplicate data will be written to the firewall config resulting is lower performance and very possibly syntax errors in the config.
Since all updates to the config are done via the GUI I can move this code to the php page and leave it out of the script. I will change the script to see if it's running before processing.

Give me some time to make the changes and test since today is my birthday! Thanks again for the helpful suggestion.

Edit: I will also add a log system log entry every time the script is run and whether the processes are already running of if countryblock had to be started back up.