Country Block

tommyboy180

Does this plugin makes any sense on a pfsense installation with no inbound WAN rules?
When everything incoming is being blocked, does this package add something?
Does it work outbound?

And secondly, where can i find the logs for this package, Enable logging is checked?

This questions have been answered many time in this topic. Please search next time.

It does make sense. You can't prevent a DDoS/DoS attack even if you block all incoming. What about port scans, or any unwanted traffic? This does that.
It does block outbound. Logs are stored in the firewall logs.

There are 2 billion users connected to the Internet - China is the leader and U.S. is second
There are 2015 more devices connected than people
There are 260 billion Facebook views per month
There are 68,000 hacker tools on the web
Botnet sends out 69 billion messages every day
Samsung smart phones were shipped with malware
U.S. customs confiscated 5.6 million fake chips
Social networking exploitation is expected to take over email exploitation
There are 50 billion devices online - 2 trillion GB of data
There is an average of 10 million lines of code in the average car coming off the assembly line
There are 25 million apps
There are millions of malicious web sites every year - 95% of threats comes from web sites
Attacks have moved down from the application layer to the BIOS and CPU layer
There are 2000 new root kits per da
MacAfee labs get about 200,000 malicious codes to review every day
There are about 65 million malware out in the wild (Mobile malware, Botnet infections, and new malware every sites per day)
We are 95% unprotected - Security is not being built into apps etc.

Counutryblock gives you that much more power to help secure your network even more. Turn that 95% unprotected into 30% unprotected.

Nachtfalke

Hi,

I am using i386 release and installed Country Block today the first time:

I got this in System Logs:

Oct 7 21:59:54 	php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '1', the output was '0 table deleted. 98 18 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152'
Oct 7 21:59:53 	php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'
Oct 7 21:59:27 	php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '1', the output was '0 table deleted. 96 18 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150'
Oct 7 21:59:26 	php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'
Oct 7 21:58:15 	php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '1', the output was '0 table deleted. 94 18 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148'
Oct 7 21:58:14 	php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'
Oct 7 21:57:45 	php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '1', the output was '0 table deleted. 92 18 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146'
Oct 7 21:57:44 	php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'
Oct 7 21:57:33 	php: /packages/countryblock/countryblock.php: The command 'rm errorOUT.txt' returned exit code '1', the output was 'rm: errorOUT.txt: No such file or directory'
Oct 7 21:57:33 	php: /packages/countryblock/countryblock.php: The command 'rm -R /usr/local/www/packages/countryblock/lists' returned exit code '1', the output was 'rm: /usr/local/www/packages/countryblock/lists: No such file or directory'
Oct 7 21:57:23 	php: /packages/countryblock/countryblock.php: The command 'rm errorOUT.txt' returned exit code '1', the output was 'rm: errorOUT.txt: No such file or directory'
Oct 7 21:57:22 	php: /packages/countryblock/countryblock.php: The command 'rm -R /usr/local/www/packages/countryblock/lists' returned exit code '1', the output was 'rm: /usr/local/www/packages/countryblock/lists: No such file or directory'
Oct 7 21:56:32 	php: /packages/countryblock/countryblock.php: The command 'rm errorOUT.txt' returned exit code '1', the output was 'rm: errorOUT.txt: No such file or directory'
Oct 7 21:56:32 	php: /packages/countryblock/countryblock.php: The command 'rm -R /usr/local/www/packages/countryblock/lists' returned exit code '1', the output was 'rm: /usr/local/www/packages/countryblock/lists: No such file or directory'
Oct 7 21:49:02 	php: : The command '/usr/local/pkg/pf/countryblock.sh start' returned exit code '1', the output was 'not running root: Countryblock was found not running Status: 404 Not Found Content-type: text/html No input file specified. 0 table deleted. 89 18 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144'

In countries I selected all countries but mine (Germany), then I clicked on "commit countries" and then enabled county block and then "Save/Update"

On the bottom I see this:

Current Status = NOT running
no IP address found for __csrf_magic
You are blocking 0 Networks

I am using two WAN and one LAN.
WAN1 and WAN2 is in LoadBalancing (if this is neccessary).

Am I doing something wrong ?

D0X

Ok, thanks for that response. I should have searched better.

An issue I encountered is the following;

The package regularly stops working, or doesn't work at all after restarting.
It says it is enabled and all, but I still can access websites form blocked countries.
When it does work it does not log it's actions in the regular firewall log?

I am blocking 212 countries, just for testing purposes.

edit:

Two minutes after enabling the Country Blocker service it just stops.

Oct 7 22:15:49	root: Countryblock was found not running

edit 2:

Upon stopping and starting the service again, this shows up in the log:

Oct 7 22:35:25	php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'
Oct 7 22:35:16	php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'
Oct 7 22:34:55	php: /packages/countryblock/countryblock.php: The command 'rm errorOUT.txt' returned exit code '1', the output was 'rm: errorOUT.txt: No such file or directory'
Oct 7 22:34:55	php: /packages/countryblock/countryblock.php: The command 'rm -R /usr/local/www/packages/countryblock/lists' returned exit code '1', the output was 'rm: /usr/local/www/packages/countryblock/lists: No such file or directory'
Oct 7 22:34:49	php: /packages/countryblock/countryblock.php: The command 'rm errorOUT.txt' returned exit code '1', the output was 'rm: errorOUT.txt: No such file or directory'
Oct 7 22:34:49	php: /packages/countryblock/countryblock.php: The command 'rm -R /usr/local/www/packages/countryblock/lists' returned exit code '1', the output was 'rm: /usr/local/www/packages/countryblock/lists: No such file or directory'
Oct 7 22:33:43	php: /packages/countryblock/countryblock.php: The command 'rm errorOUT.txt' returned exit code '1', the output was 'rm: errorOUT.txt: No such file or directory'
Oct 7 22:33:43	php: /packages/countryblock/countryblock.php: The command 'rm -R /usr/local/www/packages/countryblock/lists' returned exit code '1', the output was 'rm: /usr/local/www/packages/countryblock/lists: No such file or directory'

edit3:

After a night of sleep I reinstalled my whole pfsense box.
Coutry Block still refuses to work.
The message below:

Current Status = NOT running
no IP address found for __csrf_magic
You are blocking 0 Networks

I tried to enable it several times, like in the howto, and did reboot the box.
It displays this in the system log:

php: /packages/countryblock/countryblock.php: The command 'sh execute.sh' returned exit code '1', the output was '0 table deleted. 77 16 rm: /tmp/rules.debug.tmp: No such file or directory rm: /tmp/rules.debug.tmp: No such file or directory 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123'

I am getting the feeling this package doesn't like me or is just way to much beta.

mentalhemroids

I had to do a fresh install of 2.0 to get Country and IP Blocker to stop giving messages in the system log. After that it seems like Country Blocker is working okay; I am still getting this message in the system log Oct 8 08:04:06 php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'

I've tested previously posted sites and they are getting blocked. For me it seems to work better after a clean 2.0 install.

** Update **
I am getting these messages on both servers though and the Country Block still says it is running; if I say SAVE/UPDATE it starts working again.

Oct 8 19:18:36 root: Countryblock was found not running
Oct 8 19:18:29 root: Countryblock was found not running

Update After telling it to SAVE/UPDATE the service stopped again… does it seem related to the alarms?
Oct 9 07:19:53 root: Countryblock was found not running
Oct 9 07:19:47 root: Countryblock was found not running
Oct 9 07:19:40 check_reload_status: Reloading filter
Oct 9 07:19:40 check_reload_status: Reloading filter
Oct 9 07:19:30 apinger: alarm canceled: WAN(70.239..) *** down ***
Oct 9 07:19:30 apinger: ALARM: WAN(70.239..) *** down ***
Oct 9 07:19:12 root: Countryblock was found not running
Oct 9 07:19:08 root: Countryblock was found not running
Oct 9 07:19:00 check_reload_status: Reloading filter
Oct 9 07:19:00 check_reload_status: Reloading filter
Oct 9 07:18:50 apinger: alarm canceled: WAN(70.239..) *** down ***
Oct 9 07:18:50 apinger: ALARM: WAN(70.239..) *** down ***
Oct 9 07:17:32 root: Countryblock was found not running
Oct 9 07:17:31 dhclient: Creating resolv.conf
Oct 9 07:17:31 dhclient: RENEW
Oct 9 07:17:27 root: Countryblock was found not running
Oct 9 07:17:20 check_reload_status: Reloading filter
Oct 9 07:17:20 check_reload_status: Reloading filter
Oct 9 07:17:10 apinger: alarm canceled: WAN(70.239..) *** down ***
Oct 9 07:17:10 apinger: ALARM: WAN(70.239..) *** down ***
Oct 9 07:12:46 php: /packages/countryblock/countryblock.php: The command 'rm lists/temp' returned exit code '1', the output was 'rm: lists/temp: No such file or directory'

Luzemario

Hello,

My machine is a Celeron 1.7GHz with 256MB ram only. I am getting the error below:

Current Status = NOT running
/tmp/rules.debug:87: cannot define table countryblock: Cannot allocate memory
You are blocking 0 Networks

What are the minimum prerequisites for 0.2.4 version?

Thanks

tommyboy180

There are no minimum requirements; It all depends on your usage. You can either minimize countryblock's usage or expand your RAM.

Luzemario

Sorry… An memory module was badly inserted, giving only 128MB of ram to system.

I am wondering how much ram memory CIDR table needs to get loaded.

System activity (CountryBlocks not running):

last pid: 61581; load averages: 0.00, 0.00, 0.00 up 0+02:26:21 13:27:14
104 processes: 2 running, 85 sleeping, 17 waiting

Mem: 40M Active, 34M Inact, 40M Wired, 32M Buf, 108M Free
Swap: 512M Total, 512M Free

PID USERNAME PRI NICE SIZE RES STATE TIME WCPU COMMAND
11 root 171 ki31 0K 8K RUN 140:01 98.19% idle
56575 root 48 0 34140K 21968K piperd 0:07 1.66% php
12 root -32 - 0K 136K WAIT 0:47 0.00% {swi4: clock}
0 root 76 0 0K 56K sched 0:41 0.00% {swapper}
12 root -68 - 0K 136K WAIT 0:10 0.00% {irq11: vr0 ehci0}
6364 root 76 20 3656K 1496K wait 0:05 0.00% sh
45484 root 44 0 3316K 1336K select 0:05 0.00% apinger
56548 root 76 0 33116K 19020K accept 0:04 0.00% php
50217 root 44 0 6588K 4808K kqread 0:03 0.00% lighttpd
12 root -68 - 0K 136K WAIT 0:02 0.00% {irq10: ral0 uhci}
14 root -16 - 0K 8K - 0:02 0.00% yarrow
60024 dhcpd 44 0 8436K 5100K select 0:01 0.00% dhcpd
4 root -8 - 0K 8K - 0:01 0.00% g_down
22 root 44 - 0K 8K syncer 0:01 0.00% syncer
3 root -8 - 0K 8K - 0:01 0.00% g_up
27717 root 44 0 4944K 2512K select 0:01 0.00% syslogd
2 root -8 - 0K 8K - 0:01 0.00% g_event
2651 root 64 20 7824K 5880K select 0:01 0.00% {siproxd}

tommyboy180

Like I said it depends on your usage. If you block a small country range then you won't need much RAM at all, but if you're blocking large ranges then you will need more RAM.

Luzemario

Thanks for the info. Usually I let only my country unblocked (Brazil), leaving all other countries checked. Despite this, I can't understand why I have 512MB of swap, and it is not used during table loading. Could you explain how loading is done (it is a RAM-only function)?

Thank you for your time.

tommyboy180

pfctl is used to inspect every packet that enters and exits FreeBSD. If those rules were on the disk in swap then you can image how slow inspection would take. Your entire network would slow to a crawl. This is why RAM is the only respectable option with our current technology.

Luzemario

It's clear for me now. Thanks! ;D

cmb

WARNING: Adding a heads up here, I wasn't able to fully troubleshoot the issue given it was repeatedly crashing both firewalls in a production setup, but something about the way this package modifies PF tables is able to cause recurring kernel panics in some circumstances. Seems to be only with larger rulesets given I've only seen it once (on a box that has a couple dozen interfaces and around 400 NAT and firewall rules). In this case, the package was installed but wasn't actually configured. But it still mucks with the ruleset and tables, and something it does causes serious stability problems with recurring panics that were immediately resolved by uninstalling the package.

Sorry I don't have any more to go on than that, tommyboy. If you create about 20 dummy VLANs, assign those as interfaces, and add a bunch of rules, you may be able to easily replicate. I haven't tried.

Also the way it modifies the rules file outside the normal rules process is really, really ugly and prone to race conditions. That may be the cause of the panics, or related at least. Short of using the existing package hooks in filter.inc, which aren't ideal for this kind of setup but certainly better than trying to manually hack the rules, I don't know of a perfect alternative.

I would NOT run this on any critical production system until that problem can be tracked down and resolved in the package. Those with small rulesets are probably safe given no one else seems to have seen this. But as always, take caution with packages labeled as anything other than stable, beta packages have the possibility of regressing the stability of your entire system to beta quality or worse.

tommyboy180

Thank you for the warning! I will look into it. I know it's kind of crazy how the rule sets are modified but I was never able to get countryblock working any other way. What would be a good package or file to look at that would help me with this problem?

cmb

@tommyboy180:

What would be a good package or file to look at that would help me with this problem?

I was trying to think of a good one when I posted that, but there isn't one that's really related to what you're doing. Squid adds its own things to the filter, though I'm not sure how offhand or if that's a good example (it's much different, so probably not).

tommyboy180

What about the rules page? Are there any functions that I should pay attention to? I'm amusing I would store that info in the config but can the config be used that way?
Sorry for the basic questions but this is taking me back to square one.

marcelloc

Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

I will take a look on this and see if I can help.

tommyboy180

@marcelloc:

Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

I will take a look on this and see if I can help.

That is an idea I had myself. My only concern is if we can use that to create a table in pfctl the same way i do in the current version. Unless there is a better way, the pfctl table allows the user selected countries to be manipulated easily and be addressed separately than the other firewall rules.

marcelloc

So if networks been stored on alias and read by countryblock While creating or updating the table could be a 50% goal?

tommyboy180

I think that would be more than 50%. Basically if we can reach that functionality while moving away from the injection script then I would say that's a 90% solution.

cmb

The way I typically set up country blocking is with URL table aliases, just pasting in the countryblocks URL. That's limited to one country per alias though.