PfBlocker
-
I'll see what I can do with a performance/requirements chart. I'm sure it's going to take a while to create the chart.
-
Okay, another question…
When making a white list for IPs, do you use any type of delimiter? Or do you just list them in a column like below?
213.238.8.10/32
193.148.0.35/32
206.123.63.32/32Thanks!
-
I'll see what I can do with a performance/requirements chart. I'm sure it's going to take a while to create the chart.
If it's going to be a major pain to do, perhaps it wont be worth it :-\
Just looking from the standpoint of the end user, I think it would be very helpful is all. If I can help in any way let me know, will be glad to do so.
-
When making a white list for IPs, do you use any type of delimiter? Or do you just list them in a column like below?
213.238.8.10/32
193.148.0.35/32
206.123.63.32/32One network per line, just like gui says.
-
If it's going to be a major pain to do, perhaps it wont be worth it.
Just looking from the standpoint of the end user, I think it would be very helpful is all. If I can help in any way let me know, will be glad to do so.Pfsense is not for end users, it's for firewall admins or small networks admins. You must know about tcp/ip and what you need or want in a firewall.
If we do a chart, the next question will be about someone that followed that chart and is not happy about the results.
It's unnecessary in my opinion.
-
I don't think any amount of experience or knowledge of tcp/ip would give you a good idea of the amount of system resources consumed by firewall rules. That is more dependent on the specific software, and combination of software. Since pfsense has a common software platform with only minor variations, I think a chart would be somewhat accurate, but it's of course up to the user to use their common sense.
If the consensus is that it's unnecessary, that's fine. I don't agree that a working knowledge of tcp/ip has anything to do with the subject, however.
-
I agree with marcelloc. Creating a chart is unnecessary a will not reflect real world scenarios on a real world budget for home use. It would be extremely difficult to account for all platforms that pfsense is compatible with.
Kamel,
marcelloc is right. This package was created to assist networks admins and professionals. Having performance issues at home on is not a concern. The fact of the matter is that all performance issues can be solved with hardware. Every single IP added to a list consumes RAM. Packets entering and exiting the firewall requires processing power. Furthermore, pfblocker uses native pfsense software and knowing this you can conclude that if your firewall isn't performing at the level that you need then it is a hardware issue and not pfsense at fault.You have some good ideas but you're missing the fundamentals. pfsense does appeal to and is compatible with many platforms but when it comes to the best performance many platforms will not perform better than other platforms.
Also you don't need to know the inner workings of TCP/IP to work with pfsense but if you're going to manage pfsense in an environment where pfsense thrives then you better know everything about TCP/IP and so much more. marcelloc was using TCP/IP as an example of what a network administrator would know at a minimum to understand how to properly manage a firewall since this package was created for network administrators.
-
Forgive me if my comments seemed a bit tasteless. I got the impression marcelloc was insinuating that my abilities were insufficient. I know I shouldn't have so I apologize for that.
I still believe it would be a good idea (and should be relatively simple to add) to check if there are enough firewall entries available for the amount of rules pfblocker applying before you submit. This was actually my primary concern, the idea of system resource usage was only secondary to this.
-
Forgive me if my comments seemed a bit tasteless. I got the impression marcelloc was insinuating that my abilities were insufficient. I know I shouldn't have so I apologize for that.
I'm not insinuating anything. I'm here to help the project just like everybody.
I'm sorry if my post sound offensive. It was not my intention.I'm improving some help messages on package gui to help even more admins.
PfBlocker checks the ammount of entries in a list before apply, but it Does not sum all lists. I will try to include this in version 1.0.1. You maybe still getting this error if you have many rules or aliases. Just like the chart, we can get close to all situations but not all. -
I have two pfsense v.2 instances, i386 (2 different networks). pfBlocker has been installed on both ones.
It works just fine on one instance, and doesn't work on another - it doesn't block anything at all.
I have disabled all existing firewall rules, have checked tables in Diagnostics->Tables (they exist indeed) - everything looks just fine.
But when trying accessing internal network (WAN interface was selected for inbound rules), I'm not being blocked from the target
network which is supposed to be blocked. Tried adding custom rules list - no luck, added a country to block list - no luck to see it working.
The only difference between these 2 instances is that on pfBlocker has a combobox menu selector, another one has tabs.
Both were installed from GUI. I'm totally lost. Any ideas how to check why it didn't work ? -
make sure you are using the same version on both.
gui was designed to fit tabs and prevent combolist.
also check pfblocker applied rules on wan or lan.
you need at least one rule on interface you want to apply rules.
if you don't mind, post your rules screenshot.
note: pfblocker use native pfsense functions to help admins. So if you have rules not working, check what is going wrong with your box.
-
Forgive me if my comments seemed a bit tasteless. I got the impression marcelloc was insinuating that my abilities were insufficient. I know I shouldn't have so I apologize for that.
I'm not insinuating anything. I'm here to help the project just like everybody.
I'm sorry if my post sound offensive. It was not my intention.I'm improving some help messages on package gui to help even more admins.
PfBlocker checks the ammount of entries in a list before apply, but it Does not sum all lists. I will try to include this in version 1.0.1. You maybe still getting this error if you have many rules or aliases. Just like the chart, we can get close to all situations but not all.Increasing my firewall rules limit worked fine and it's fast with no issues (assuming I disable some other services to reduce my RAM consumption). I will admit, it was a bit of a pain figuring out what was wrong at first. Even many searches going by, it seemed people were referring to things like memory etc. I hadn't realized the number of rules in the blocklists were impacted by the number of firewall rules or I would have known what to do immediately.
In any case, thanks for that – I think it will be a simple enough but helpful addition. I know for me personally, I'll never make the mistake again :P
-
it doesn't block anything at all.
This may sound silly, but do you have any catch-all rules that might be allowing the traffic to pass before the pfblocker rules have a chance to block it?
-
Just loaded pfBlocker - initially it seemed to be just what we needed - (had a recent flurry of far eastern IP addresses appearing in the logs) - but whilst it works it seems that SquidGuard has stopped working.
Just me or have I missed a thread somewhere?
Andrew
-
it doesn't block anything at all.
This may sound silly, but do you have any catch-all rules that might be allowing the traffic to pass before the pfblocker rules have a chance to block it?
For wan interface I disabled all rules, but not pfBlocker test one.
Don't have any floating rules for now. I'm trying to have as clean as possible system for testing. -
make sure you are using the same version on both.
gui was designed to fit tabs and prevent combolist.
also check pfblocker applied rules on wan or lan.
you need at least one rule on interface you want to apply rules.
if you don't mind, post your rules screenshot.
note: pfblocker use native pfsense functions to help admins. So if you have rules not working, check what is going wrong with your box.
1. I'm sure.
2. Can see only combobox (uninstalled, rebooted, cleared config.xml before rebooting - no changes.)
3. See my screen shots
4. I have one (the same) rule in both cases.
5. Attached.
6. Where can I read how to use pfsense native functions ? I'm a pfsense novice.Thanks for the help.
-
Since I installed pfBlocker, Aliases seem kind of wonky.
I've searched the thread+forum, but couldn't find the right answer to my problem.If I create an alias in Firewall -> Aliases; the alias doesn't show up in the dropdown list (in Rules -> Destination -> Address field).
Only the Aliases created in pfBlocker are available.
If I type out the Alias Name (correctly) I get:
I've tried rebooting pfSense after creating the Alias but it didn't help.
Am I missing something? -
slarg,
I think your are not on latest version, it should be
2.0-RELEASE
built on Tue Sep 13 17:05:32 EDT 2011update it to release version, then test again.
-
LinuxTracker,
Port alias must be applied on port field, not in host field. ;)
-
LinuxTracker,
Port alias must be applied on port field, not in host field. ;)Edited for block-headedness.
Yep. You is right on, you are.
I sho nuff stepped into that one.
-
Why does pfBlock create duplicate rules (or at least they look like duplicates to me) and where does it log to? The dashboard widget is showing an increase in packet count but I seem unable to find out what is causing it.
Andrew
-
Why does pfBlock create duplicate rules (or at least they look like duplicates to me) and where does it log to? The dashboard widget is showing an increase in packet count but I seem unable to find out what is causing it.
Andrew
pfBlocker package log to Status: System logs: System
Just click Enable Logging under Firewall: pfBlocker for list action that are NOT Alias only.
The pfBlocker auto generated rules will log events under Status: System logs: Firewal.When you use a pfBlocker Alias in your custom Firewall rules, select Log packets that are handled by this rule
You can see more details in the firewall logs when you enable Show raw filter logs under Status: System logs: Settings
-
pfBlocker package log to Status: System logs: System
*** Thanks for the info
Just click Enable Logging under Firewall: pfBlocker for list action that are NOT Alias only.
*** Already set
The pfBlocker auto generated rules will log events under Status: System logs: Firewal.
*** Not found them
When you use a pfBlocker Alias in your custom Firewall rules, select Log packets that are handled by this rule
*** Already set
You can see more details in the firewall logs when you enable Show raw filter logs under Status: System logs: Settings
*** Still no sign of anything that matchs
Also why are all the rules duplicated?
Andrew
-
Also why are all the rules duplicated?
Can you take a screenshot of this duplicates?
*** Still no sign of anything that matchs
It will log as firewall rules, no extra info about pfBlocker package.
-
slarg,
I think your are not on latest version, it should be
2.0-RELEASE
built on Tue Sep 13 17:05:32 EDT 2011update it to release version, then test again.
marcelloc, thank you. That was the problem. It works just fine now.
Thanks again for the excellent package. -
Duplicate rules on the WAN - if I delete one set then everything still works - but as soon as I open the pfblocker screen they reappear.
Also - when causes the count in the dashboard widget reset to zero?
Andrew
![New Picture.jpg](/public/imported_attachments/1/New Picture.jpg)
![New Picture.jpg_thumb](/public/imported_attachments/1/New Picture.jpg_thumb) -
Do you have modified description rules? try to delete all pfblocker rules and then reaply config.
also check what version of pfBlocker you are using. Current version is 1.0
Everytime you apply rules, pfSense reset counters.
Just for suggestion, spyware and Adverts works better with action deny outbound, so while browsing pfsense reject connections to these sites/links.
-
Deleted all rules.
Checked I am using version 1.0
Changed spyware & ads to deny outbound
Now have duplicate rule on WAN for TopSpammers but the new deny oubounds rules appear only once on the LAN tab
So partially fixed!
Thanks
Andrew
-
Something I have noticed on my pulsemaps wordpress plugin. I have pfblocker enabled and I only allow US IP's. I been seeing on the pulsemaps data that I am getting alot of web activity from Japan in the areas of Nagano, Okaya, Suwa, Mt Kyogatake, and Ina. I also noticed some activity from Dubai which is in Saudi Arabia next toUnited Arab Emirates, and some activity from Australia from New South Wales near Narellan, Richmond, and Sydney.
I have no IP's to go by. I can only see locations that have access my website. I am currently blocking eveything but the US.
Any ideas?
Thanks
-
Change the way you apply rules.
Unselect everything but USA and choose action alias only.
After this, apply this alias on your wan rules.
Example:
Allow src pfBlockerAmerica dst wan_subnet port 80
-
I wanted to let you know that i finally upgraded to the latest release of pfsense (been on a rc release of 2.0 forever since its been solid for me) which also forced me to go ahead and move away from countryblock and upgrade to this package. I want to say thanks and let you know that I was able to install this package, block everything except for United states, and all is going great so far. The inbound was blocked with no issue. The only thing is the outbound. It would never add the rules to the table to block those no matter what i selected in the package. I just created my own rules with the alias of the countries from pfblocker and all is working great. The counter on the widget works on both inbound and outbound :-).
Thanks so much for putting this together!!!!!
Donation incoming too. :-) -
I was able to install this package, block everything except for United states
take a look on post above yours.
If your are blocking everything except United states, It`s better changing the way you apply rules.Thanks so much for putting this together!!!!!
Donation incoming too. :-)Thank you ;D
-
I was able to install this package, block everything except for United states
take a look on post above yours.
If your are blocking everything except United states, It`s better changing the way you apply rules.[
[/quote]Thank you ;D
Sorry let me rephrase. I am successfully blocking everything but the US as I planned. So it is working just fine. There is no issue. All networks appear to be blocked except for US and thats good!!!
-
Yes, I understood that.
The suggestion was just to use less resources from firewall.
Allow access to 40.000 network and block anything else is less work then block all countries CIDRs and allow what is not matched.
-
Oh i c. That makes sense. Right now seems to be ok but if I see performance issues, I will take that in mind and change it up.
-
Firstly, thank you for the excellent package. I greatly enjoy using 3rd party lists to do IP blocking and have pfblocker configured and running the way I like it. That said, I do have a couple questions.
-
I prefer to block inbound and outbound connections on all interfaces and use pfblocker aliases with 2 floating rules to do this. Is this the preferred method or is there another way I am missing?
-
Not directly a pfblocker question, but in what order are floating rules applied? Do they come before or after the individual interface rules?
Thank you very much for all your hard work!
-
-
- I prefer to block inbound and outbound connections on all interfaces and use pfblocker aliases with 2 floating rules to do this. Is this the preferred method or is there another way I am missing?
Define action as alias only and create your rules. That's the best way.
-
This seems like a very good package. However I'm having trouble getting lists to work properly.
I can make a list with this url in gz format and it works fine and creates an alias:
http://list.iblocklist.com/?list=bt_spyware&fileformat=p2p&archiveformat=gzFor some reason no matter what I try I can't get this list to load in either txt or gz format. No alias is created and nothing is blocked.
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklistAny ideas? Thanks
-
For some reason no matter what I try I can't get this list to load in either txt or gz format. No alias is created and nothing is blocked.
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklistThis list is in txt format and returns only ips, not CIDR or ip ranges.
so,
:)
version 1.0.1 is out with:
-
fixed pfBlocker to check lists with single ips
-
updated country ip files
-
Return of Deny Both action(Inbound and Outbound)
-
Improved some GUI info
-
-
Wow.. thanks marcello! New version seems to work great.
Nice work, thanks again