Country Block

tommyboy180

I'm going to have to go to the datacenter to do what you say. It won't be for another week because on Tuesday I'm leaving on a much needed vacation to Mexico. l'm going to eat, drink, and do NOTHING.

Any way, I do have a few questions.

What version of Country Block is supposed to be installed. Did you renumber it when you made the last changes? I wanted to look at that.

Since I can't go to the datacenter yet, I tried to whiteliast the IP blocked under Russia. It wouldn't work. I put the IP as IP_Number/32. Did I do something wrong?

Thanks!

The version of countryblock will be the same. I didn't version bump the package.
Yes, /32 is the correct syntax, your example is correct. You can test it by pinging the address to see if if its blocked given you are blocking outbound. Always test it by pinging the address from the pfsense console. Just member to have outbound blocked as well.

Supermule

Pls bump the version Tom!! So everyone gets aware… :)

sdnorman

I just visited www.countryipblocks.net and it appears they will be suspending services due to a lack of funds.

Stefano

Bummer

Wow, that's too bad. Once I had everything set up and working, I was going to donate $20. I do understand their time is worth something.

I think they had a great idea and I really think there is a demand for it.

tommyboy180

I just donated to the site. I hope more people will too.

Bummer

Yeah, I just donated too. Hopefully they'll get the few remaining bugs out.

We'll see what happens.

Quasar

After upgrading pfsense to snapshot built on 16.06.2011 "save/update" button is not active (I mean pressing this button doesn't do anytyhing).
In system logs often appers this:
php: : The command '/usr/local/pkg/pf/countryblock.sh start' returned exit code '1', the output was 'not running root: Countryblock was found not running Status: 404 Not Found Content-type: text/html No input file specified. 0 table deleted. 77 20 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124'

How to solve it?… Before upgrading pfsense (and auto-reinstalling CB) CB worked perfect!

Bummer

On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.

jamesidauto.net

Tom,

I'm running CountryBlock on:

2.0-RC2 (i386)
built on Tue Jun 7 20:06:07 EDT 2011 and am not sure the package is working.

I've blocked all countries except the USA and enabled the "Block outbound" option under the settings tab. The status at the bottom of the config page says:

Current Status = Running
You are blocking 72902 Networks

As a test, I browsed pages in China, Russia and India (e.g. http://india.gov.in/default.php), for example, and have no issues doing so.

I've deleted the package and reinstalled and have rebooted my pfSense box as well but no change.

Ideas?

Cheers,
James L

Bummer

Try blocking inbound also and then see if you can access those pages.

jamesidauto.net

Unless I'm missing something, there isn't an explicit block inbound option.

I am blocking inbound by having the package running with the countries selected aren't I?

Thanks
James L

tommyboy180

It sounds like you ran countryblock and then checked outbound. Outbound must be checked before you run countryblock. Make sure block outbound is checked then re-commit the countries and Save/update. That should solve your problem.

jamesidauto.net

Thanks Tom …. that worked.

I assume these preferences are maintained across reboots and pfSense Firmware Upgrades?

Thanks
James L

tommyboy180

@jamesL2012:

Thanks Tom …. that worked.

I assume these preferences are maintained across reboots and pfSense Firmware Upgrades?

Thanks
James L

Yup. No problem!

Bummer

Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.

I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?

Any ideas?

tommyboy180

@Bummer:

Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.

I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?

Any ideas?

Are you sure that ip is responding. It doesn't respond to ICMP and port 80 for me. The best way to see if whitelisting is working is to ping that address (without CIDR) in the pfsense console. If it's not blocked then you will have normal behavior. If it is blocked then pfsense will say "operation not permitted".
Try that.

Bummer

I know that it's blocked, because when the country is blocked, so is the IP. The only way I can allow the IP to work is by unblocking country India. So when the country of India is blocked, the people using that Ip can't get in, even after I white-list it.

The only way I can allow them access is to not block the country India.

Quasar

@Bummer:

On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.

I mean, I can't start Country Block. Pressing "save/update" doesn't start CB.
And how can I solve this problem (I see it every first time I visit 'Country Block' section web-interface):
'/tmp/rules.debug:79: cannot load "/usr/local/www/packages/countryblock/lists/countries.txt": No such file or directory'

Status of CB is always "not running".

Sorry for my english..

ghm

@Bummer:

The only way I can allow them access is to not block the country India.

Yes the list is not perfect - I just had a case where a German IP got blocked, had to allow European Union to let it access. Reverse IP Check clearly said it's a German IP. Works for me but shows that the lists may have some errors (blocks moving I guess).

Spy Alelo

Anyone having issues when saving/committing countries? I had a write error and I was able to login to the shell and run 'mount -u -w /' to get country block to save the settings.