Country Block

Bummer

On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.

jamesidauto.net

Tom,

I'm running CountryBlock on:

2.0-RC2 (i386)
built on Tue Jun 7 20:06:07 EDT 2011 and am not sure the package is working.

I've blocked all countries except the USA and enabled the "Block outbound" option under the settings tab. The status at the bottom of the config page says:

Current Status = Running
You are blocking 72902 Networks

As a test, I browsed pages in China, Russia and India (e.g. http://india.gov.in/default.php), for example, and have no issues doing so.

I've deleted the package and reinstalled and have rebooted my pfSense box as well but no change.

Ideas?

Cheers,
James L

Bummer

Try blocking inbound also and then see if you can access those pages.

jamesidauto.net

Unless I'm missing something, there isn't an explicit block inbound option.

I am blocking inbound by having the package running with the countries selected aren't I?

Thanks
James L

tommyboy180

It sounds like you ran countryblock and then checked outbound. Outbound must be checked before you run countryblock. Make sure block outbound is checked then re-commit the countries and Save/update. That should solve your problem.

jamesidauto.net

Thanks Tom …. that worked.

I assume these preferences are maintained across reboots and pfSense Firmware Upgrades?

Thanks
James L

tommyboy180

@jamesL2012:

Thanks Tom …. that worked.

I assume these preferences are maintained across reboots and pfSense Firmware Upgrades?

Thanks
James L

Yup. No problem!

Bummer

Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.

I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?

Any ideas?

tommyboy180

@Bummer:

Hey Tommy, I haven't written, I thought I'd take a rest for a week. But I'm back to try and resolve the issue below.

I'm still having problems whitelisting IPs. When I unblock a country, the people can gain access. But if I try whitelisting one IP for a country, they can't access anything. For instance, the IP 113.19.25.109 from India I put in as 113.19.25.109/32, but it didn't work. Am I doing something wrong?

Any ideas?

Are you sure that ip is responding. It doesn't respond to ICMP and port 80 for me. The best way to see if whitelisting is working is to ping that address (without CIDR) in the pfsense console. If it's not blocked then you will have normal behavior. If it is blocked then pfsense will say "operation not permitted".
Try that.

Bummer

I know that it's blocked, because when the country is blocked, so is the IP. The only way I can allow the IP to work is by unblocking country India. So when the country of India is blocked, the people using that Ip can't get in, even after I white-list it.

The only way I can allow them access is to not block the country India.

Quasar

@Bummer:

On my version of pfSense it never has done anything. As long as Couinty Block says it's active, it is. I know that it blocks the countries, I just haven't been able to set it up to whitelist certain IPs. In that respect, it doesn't work.

I mean, I can't start Country Block. Pressing "save/update" doesn't start CB.
And how can I solve this problem (I see it every first time I visit 'Country Block' section web-interface):
'/tmp/rules.debug:79: cannot load "/usr/local/www/packages/countryblock/lists/countries.txt": No such file or directory'

Status of CB is always "not running".

Sorry for my english..

ghm

@Bummer:

The only way I can allow them access is to not block the country India.

Yes the list is not perfect - I just had a case where a German IP got blocked, had to allow European Union to let it access. Reverse IP Check clearly said it's a German IP. Works for me but shows that the lists may have some errors (blocks moving I guess).

Spy Alelo

Anyone having issues when saving/committing countries? I had a write error and I was able to login to the shell and run 'mount -u -w /' to get country block to save the settings.

tommyboy180

@Spy:

Anyone having issues when saving/committing countries? I had a write error and I was able to login to the shell and run 'mount -u -w /' to get country block to save the settings.

Are you using embedded?

Spy Alelo

yeah, but it always worked fine until now.

tommyboy180

Should be good!

chpalmer

CIDR.php wont load this evening so the install fails for me…

Ill try again later.

tommyboy180

@chpalmer:

CIDR.php wont load this evening so the install fails for me…

Ill try again later.

Thank you. I'm having issue with the host. Pfsense does not host binary files anymore so it must be hosted somewhere.
Check back in 2 hours.

chpalmer

Thanks Tom! Working now. :)

cmb

Tom, you can just send me or Jim P. binaries and we'll get them uploaded.