Country Block
-
Well so far so good. It has been running for 3 hours now and its still up and not stopped. :-) So your changes seem to have corrected the issue. Thanks!
The only thing that doesnt seem to be automatic is if I change the firewall states with another package or clear it ect in settings which resets the current table which kills country block (as its mentioned in the package that it will), it doesn't seem like country block will start on its own with the cron job entry. When I make the changes mentioned, I will let it sit there for 10 minutes and it will not start back up. Once I start it manually it seems to stay running. So I am unclear why it will not start back up. I guess as long as I know I make changes and check to start it back up it should stay up and running without issue i suppose.
I do have this cron entry
minute: 0
hour: *
mday: *
month: *
wday: *
who: root
command: /usr/local/etc/rc.d/countryblock.shfor every 5 min use
Minute: */5*/2 # every 2 min etc.
-
Well so far so good. It has been running for 3 hours now and its still up and not stopped. :-) So your changes seem to have corrected the issue. Thanks!
The only thing that doesnt seem to be automatic is if I change the firewall states with another package or clear it ect in settings which resets the current table which kills country block (as its mentioned in the package that it will), it doesn't seem like country block will start on its own with the cron job entry. When I make the changes mentioned, I will let it sit there for 10 minutes and it will not start back up. Once I start it manually it seems to stay running. So I am unclear why it will not start back up. I guess as long as I know I make changes and check to start it back up it should stay up and running without issue i suppose.
I do have this cron entry
minute: 0
hour: *
mday: *
month: *
wday: *
who: root
command: /usr/local/etc/rc.d/countryblock.shfor every 5 min use
Minute: */5*/2 # every 2 min etc.
I changed the 0 to */1 and then reset the states and it killed country block and waited a minute and it started back up. That seemed to do the trick. Thanks alot.
I -
Glad to know I was not crazy, well to some degree. Tommy, thanks for looking into this. I love this package, I really feel you have developed something that should be a standard option in most firewalls but is not.
Thanks for the quick replies and fast updates. Hands down to you…
Thanks again,
Matt
-
Nice new interface tommy appreciate it.
Gotta question for you though, i see that there are a few packages related to dns (country block,dns blacklist), is it possible to get something like OpenDNS but locally? mostly the custom shortcuts andstats (top domains etc)? if so how hard would it be?
-
Nice new interface tommy appreciate it.
Gotta question for you though, i see that there are a few packages related to dns (country block,dns blacklist), is it possible to get something like OpenDNS but locally? mostly the custom shortcuts andstats (top domains etc)? if so how hard would it be?
I'm really not sure. Countryblock uses CIDR ranges which works nicely with the firewall and is really easy to script. As far as DNS stuff goes, I have no idea. I bet you could modify the DNS blacklist package to support what you are looking for.
I'm glad to see that people are getting better results with the latest version. Thank you all for your support.
-
The DNS Blacklist doesnt have anything at the GUI end for doing what I want, it would have to be done under the hood and I was thinking of something that would be easy for all, even those with out programming skills, though I am willing to learn.
I was thinking the tinyDNS package could do this but I gave up on it when I messed up DNS on my network (didnt get very far before doing this >:(), waiting until I can get a test system ready before trying it again, if I do get it working I plan on doing an FAQ/Tutorial on it as no one has made one publicly available that I could find.
-
regarding cron .
with CB getting closer to real stable, it is probably a bad thing to run the cron start job very often.
I may be wrong, as happens not infrequently , but the 1-st part of the script /usr/local/www/packages/countryblock/execute.sh
{{{
pfctl -t countryblock -T kill
}}}
seems to disable the countryblock rules .shortly after the rules are enabled.
so the more stable this great package gets, the less frequent the cronjob should be run.
Also
/usr/local/www/packages/countryblock/execute.sh should be improved if possible to check if the countryblock rules are active. then restart only if needed.Maybe someone who knows about pfctl could help with the script?
thanks again to the author for this package. I owe you some beer.
-
regarding cron .
with CB getting closer to real stable, it is probably a bad thing to run the cron start job very often.
I may be wrong, as happens not infrequently , but the 1-st part of the script /usr/local/www/packages/countryblock/execute.sh
{{{
pfctl -t countryblock -T kill
}}}
seems to disable the countryblock rules .shortly after the rules are enabled.
so the more stable this great package gets, the less frequent the cronjob should be run.
Also
/usr/local/www/packages/countryblock/execute.sh should be improved if possible to check if the countryblock rules are active. then restart only if needed.Maybe someone who knows about pfctl could help with the script?
thanks again to the author for this package. I owe you some beer.
Great suggestion! Checking to see if it's running before processing is easy but if changes are made while it's running then the firewall entries for countryblock need to be deleted and re-added. If this isn't done then duplicate data will be written to the firewall config resulting is lower performance and very possibly syntax errors in the config.
Since all updates to the config are done via the GUI I can move this code to the php page and leave it out of the script. I will change the script to see if it's running before processing.Give me some time to make the changes and test since today is my birthday! Thanks again for the helpful suggestion.
Edit: I will also add a log system log entry every time the script is run and whether the processes are already running of if countryblock had to be started back up.
-
Congrats Tom!! ;) Rest and enjoy your day!
-
well happy bday!!!!!!
Again thanks for the continued updates
-
I have a question on the selectable interfaces. I will be installing some additional NICs in the box so that my personal PC is separate from the server. Currently I don't select outbound because it blocks some pages I try to view and I'd really like to have this feature for my server. Thus, I assume I would want to uncheck the WAN and my personal interface and just have my server interface checked, correct? Just curious.
-
I have a question on the selectable interfaces. I will be installing some additional NICs in the box so that my personal PC is separate from the server. Currently I don't select outbound because it blocks some pages I try to view and I'd really like to have this feature for my server. Thus, I assume I would want to uncheck the WAN and my personal interface and just have my server interface checked, correct? Just curious.
Not checking your WAN interface will leave you vulnerable to attack from your blocked counties. However, yes. If you do not select your WAN and your LAN, then you will be able to enforce outbound access, on the DMZ, to the countries while still being able to access them on your LAN.
For a customized configuration you can always edit /usr/local/www/packages/countryblock/execute.sh to give you more control over how you want to block access to the countries. -
Is there a way to get notified when Country Block stops? I keeps not running for me, and I can't tell if it's because of something I did or not.
-
@Bai:
Is there a way to get notified when Country Block stops? I keeps not running for me, and I can't tell if it's because of something I did or not.
I am working on email notifications for the next version. Right now I'm looking at gmail support only.
-
with gmail support, will it support google apps users?
-
-
google apps users use @yourdomain.com but other than that it is googles servers (smtp.gmail.com, smtp.googlemail.com etc)
-
google apps users use @yourdomain.com but other than that it is googles servers (smtp.gmail.com, smtp.googlemail.com etc)
Yes that's right. That's how I setup my email. I'm not sure, it should. I'm using smtp.gmail.com as the gateway, so as long as it authenticates it will work.
I hope to have this out soon, so you will be able to test here shortly. -
well since google is making all gapps accounts full (almost) google accounts, one can log in at gmail.com with their full email address and get ones email.
I will be glad to be the first tester!
-
I've got email working right now. I was able to use any SMTP gateway, so email will not be restricted to gmail. So far I have successfully tested yahoo SMTP and gmail SMTP, but there isn't a reason why any SMTP gateway won't work.
Right now this is only on php4 and if I'm not mistaken php5 is on pfsense BETA 2. I don't have BETA 2 so I will need a tester here in a couple days if anyone wants to help out. -
I'm still having trouble with CB staying running. Is there anything I should look at?
-
@Bai:
I'm still having trouble with CB staying running. Is there anything I should look at?
Which version of CB are you using?
And PfSense version?
-
Not checking your WAN interface will leave you vulnerable to attack from your blocked counties. However, yes. If you do not select your WAN and your LAN, then you will be able to enforce outbound access, on the DMZ, to the countries while still being able to access them on your LAN.
For a customized configuration you can always edit /usr/local/www/packages/countryblock/execute.sh to give you more control over how you want to block access to the countries.I see. So to block all incoming I just keep the WAN checked and then if I check "Block outbound" and uncheck my personal LAN then my server and son's computer will be outbound blocked but mine will be unaffected even though all incoming is blocked? Just clarifying. Thanks.
-
Not checking your WAN interface will leave you vulnerable to attack from your blocked counties. However, yes. If you do not select your WAN and your LAN, then you will be able to enforce outbound access, on the DMZ, to the countries while still being able to access them on your LAN.
For a customized configuration you can always edit /usr/local/www/packages/countryblock/execute.sh to give you more control over how you want to block access to the countries.I see. So to block all incoming I just keep the WAN checked and then if I check "Block outbound" and uncheck my personal LAN then my server and son's computer will be outbound blocked but mine will be unaffected even though all incoming is blocked? Just clarifying. Thanks.
That is correct. You should be able to test this easily by accessing a site located in one of the countries and using a proxy located in the country. That's how I have been checking to make sure I understand how it works (I'm a visual learner).
-
Version 1.8 Released
Changes:
-
Email notifications
-
New cron script
-
System logging
Thank you all for your support. The new cron script (/usr/local/etc/rc.d/countryblock.sh) checks if it's running before doing anything. If it's running it exits, if not it will send you an email telling you it's restarting, make a system log entry, and the restart countryblock.
Email notifications use SMTP. Any SMTP sever works, not just gmail like I originally planned. Your email password is stored in plain text in a file called email_send.php for those who are paranoid.
Thanks again everyone. -
-
wow thats awesome!!!
Gonna give it a try. Thanks for the updates!!!!
-
The hits just keep on comin!
Thanks much TB - strong work indeed!
-
Which version of CB are you using?
And PfSense version?
Newest of both. 1.7 and 1.2.3
It's still running today from yesterday. So I'm guessing my problem is that I can't always tell when something will make a firewall change and force me to restart CB.
Is there any way to have CB be part of the firewall restart? Surely there has to be some sort of hook for that.
-
@Bai:
Which version of CB are you using?
And PfSense version?
Newest of both. 1.7 and 1.2.3
It's still running today from yesterday. So I'm guessing my problem is that I can't always tell when something will make a firewall change and force me to restart CB.
Is there any way to have CB be part of the firewall restart? Surely there has to be some sort of hook for that.
It's possible. I have been trying to make countryblock more integrated since the day I started development. I never figured it out. I'm hoping that I will soon or someone will.
-
Trying out the email config: entered in the applicable settings, clicked Save, and this error appears:
Couldn't write values to file!
Navigating again to the email tab reveals this line:
Your settings have already been set. Would you like to overwrite your email settings?
Warning: file_get_contents(email_config.html): failed to open stream: No such file or directory in /usr/local/www/packages/countryblock/email.php on line 172
Uninstalling / re-installing doesn't seem to help :(
-
Trying out the email config: entered in the applicable settings, clicked Save, and this error appears:
Couldn't write values to file!
Navigating again to the email tab reveals this line:
Your settings have already been set. Would you like to overwrite your email settings?
Warning: file_get_contents(email_config.html): failed to open stream: No such file or directory in /usr/local/www/packages/countryblock/email.php on line 172
Uninstalling / re-installing doesn't seem to help :(
Are you leaving a field blank? If so which field?
EDIT: Which browser are you using? -
Are you leaving a field blank? If so which field?
EDIT: Which browser are you using?Yep, leaving Username and Password blank, as my ISP doesn't require that info. I can just use Gmail, if that will satisfy CB ?
Using Chrome.
EDIT: works great with Gmail (all fields filled in).
Thanks tho :)
-
All fields must be filled in for the email function to work.
Dont forget that for it to be able to restart CB you must have started it at least once. -
Could you post your gmail settings?
-
@DigitalJer set SMTP Auth = No and see if that works
@robfantini
You did the quote wrong.But heres the info you requested:
SMTP Auth = Yes
SMTP Security = Yes
Host = smtp.gmail.com (this is for gmail and GApps users)
Port = 465
User name = your full username (test@gmail.com)
Password = your password
Use HTML Formatting = Yes
From Email address = your full username (test@gmail.com)
To Email address = email you are sending notifications to
Subject = whatever you want -
@DigitalJer set SMTP Auth = No and see if that works
@robfantini
You did the quote wrong.But heres the info you requested:
SMTP Auth = Yes
SMTP Security = Yes
Host = smtp.gmail.com (this is for gmail and GApps users)
Port = 465
User name = your full username (test@gmail.com)
Password = your password
Use HTML Formatting = Yes
From Email address = your full username (test@gmail.com)
To Email address = email you are sending notifications to
Subject = whatever you wantthank you, that worked. I had been using the wrong port.
-
I get this when trying…
Parse error: syntax error, unexpected $end in /usr/local/www/packages/countryblock/email_send.php on line 6
-
I get this when trying…
Parse error: syntax error, unexpected $end in /usr/local/www/packages/countryblock/email_send.php on line 6
I had that happen until I filled in all fields , pressed save.
SMTP auth could not be set to no. Originally I wanted to use our local LAN mail server . I could only use my gmail smtp account.
-
any smtp account should work.
For the smtp auth did you still fill in the username and password when it was set to no?
-
nope….used mail instead of smtp...