Country Block

tommyboy180

pfctl is used to inspect every packet that enters and exits FreeBSD. If those rules were on the disk in swap then you can image how slow inspection would take. Your entire network would slow to a crawl. This is why RAM is the only respectable option with our current technology.

Luzemario

It's clear for me now. Thanks! ;D

cmb

WARNING: Adding a heads up here, I wasn't able to fully troubleshoot the issue given it was repeatedly crashing both firewalls in a production setup, but something about the way this package modifies PF tables is able to cause recurring kernel panics in some circumstances. Seems to be only with larger rulesets given I've only seen it once (on a box that has a couple dozen interfaces and around 400 NAT and firewall rules). In this case, the package was installed but wasn't actually configured. But it still mucks with the ruleset and tables, and something it does causes serious stability problems with recurring panics that were immediately resolved by uninstalling the package.

Sorry I don't have any more to go on than that, tommyboy. If you create about 20 dummy VLANs, assign those as interfaces, and add a bunch of rules, you may be able to easily replicate. I haven't tried.

Also the way it modifies the rules file outside the normal rules process is really, really ugly and prone to race conditions. That may be the cause of the panics, or related at least. Short of using the existing package hooks in filter.inc, which aren't ideal for this kind of setup but certainly better than trying to manually hack the rules, I don't know of a perfect alternative.

I would NOT run this on any critical production system until that problem can be tracked down and resolved in the package. Those with small rulesets are probably safe given no one else seems to have seen this. But as always, take caution with packages labeled as anything other than stable, beta packages have the possibility of regressing the stability of your entire system to beta quality or worse.

tommyboy180

Thank you for the warning! I will look into it. I know it's kind of crazy how the rule sets are modified but I was never able to get countryblock working any other way. What would be a good package or file to look at that would help me with this problem?

cmb

@tommyboy180:

What would be a good package or file to look at that would help me with this problem?

I was trying to think of a good one when I posted that, but there isn't one that's really related to what you're doing. Squid adds its own things to the filter, though I'm not sure how offhand or if that's a good example (it's much different, so probably not).

tommyboy180

What about the rules page? Are there any functions that I should pay attention to? I'm amusing I would store that info in the config but can the config be used that way?
Sorry for the basic questions but this is taking me back to square one.

marcelloc

Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

I will take a look on this and see if I can help.

tommyboy180

@marcelloc:

Is possible to store blocked country network ranges on alias? This way XML store will be reached very easy.

Just an idea, create a rule on countryblock selected interfaces and stick it just like bogus networks option Does?

I will take a look on this and see if I can help.

That is an idea I had myself. My only concern is if we can use that to create a table in pfctl the same way i do in the current version. Unless there is a better way, the pfctl table allows the user selected countries to be manipulated easily and be addressed separately than the other firewall rules.

marcelloc

So if networks been stored on alias and read by countryblock While creating or updating the table could be a 50% goal?

tommyboy180

I think that would be more than 50%. Basically if we can reach that functionality while moving away from the injection script then I would say that's a 90% solution.

cmb

The way I typically set up country blocking is with URL table aliases, just pasting in the countryblocks URL. That's limited to one country per alias though.

marcelloc

Great idea! :)

I will try to create this url table alias via php and then apply it to a rule.

Thanks for that.

marcelloc

I looked at countryblock package code and saw many system calls to files and filters and many javascripts.

To reach our goal to write most config to xml, I decided to use pfsense's framework and replace countryblock list from letters to continents.

Alias auto insertion is done and I'm very close to reach rule creation. As Url Table alias feature also implements a table on firewall rules, I think is better to use pfsenses already done functions instead of rewriting everything.

tommyboy,
I know that you spent many many hours on package evolution, but I think it's time to adapt this package to 2.0 features.

I'm planning to create a countryblock-dev package, so we can test it more deeply.

Please, feedback.

countryblock_03.png_thumb

tommyboy180

It looks great! You're really going out of your way here and I really appreciate your help!
If you get it to a point where you have stable operation please send some files my way. I would like to take a look at what you have done.

pfsense_isti

Hi,

I use PFSense 2.0 on a small Alix-Board.

My Questions:

As I know there was a tab (Reiter) also for Mail to avoid Spams. In my version I have seen it no longer… Why?
This CountryBlock denies traffic from these countries. Is there any way to block IN THESE countries I chosen for being blocked.

Thank you for your help and the many hours you spent with thr development.

Rergards,

I.

tommyboy180

@pfsense_isti:

Hi,

I use PFSense 2.0 on a small Alix-Board.

My Questions:

As I know there was a tab (Reiter) also for Mail to avoid Spams. In my version I have seen it no longer… Why?

This CountryBlock denies traffic from these countries. Is there any way to block IN THESE countries I chosen for being blocked.

Thank you for your help and the many hours you spent with thr development.

Rergards,

I.

The mail tab never blocked SPAM. It would send you an email if countryblock stopped working but since that time this package works relatively stable.
To answer your second question, no. If you are in that country then I would not recommend doing that. You may experience negative effects.

marcelloc

HI all,

I've just finished countryblock rule creation. ;D

I will fix instalation and publish countryblock-dev package today.

Now contryblock only uses pfsense native options, so I think stable state will be very soon.

tommyboy180

Sweet. Where do you get the countryblock IP ranges from? Same lists in the current version?

marcelloc

Direct from countryipblocks.net site during package installation.

If any network changes, all we need is reinstall package.

marcelloc

So, Let's start testing. countryblock-dev 0.4 is out! :)

I did last commit to it right now.

I think gui is fine, what we need to test is pfsense table update time.

att,
Marcello Coutinho