PfBlocker

slagr

make sure you are using the same version on both.

gui was designed to fit tabs and prevent combolist.

also check pfblocker applied rules on wan or lan.

you need at least one rule on interface you want to apply rules.

if you don't mind, post your rules screenshot.

note: pfblocker use native pfsense functions to help admins. So if you have rules not working, check what is going wrong with your box.

1. I'm sure.
2. Can see only combobox (uninstalled, rebooted, cleared config.xml before rebooting - no changes.)
3. See my screen shots
4. I have one (the same) rule in both cases.
5. Attached.
6. Where can I read how to use pfsense native functions ? I'm a pfsense novice.

Thanks for the help.

global_settings_bad.jpg_thumb

rules_bad.jpg_thumb

system_bad.jpg_thumb

LinuxTracker

Since I installed pfBlocker, Aliases seem kind of wonky.
I've searched the thread+forum, but couldn't find the right answer to my problem.

If I create an alias in Firewall -> Aliases; the alias doesn't show up in the dropdown list (in Rules -> Destination -> Address field).
Only the Aliases created in pfBlocker are available.

If I type out the Alias Name (correctly) I get:

I've tried rebooting pfSense after creating the Alias but it didn't help.
Am I missing something?

marcelloc

slarg,

I think your are not on latest version, it should be

2.0-RELEASE
built on Tue Sep 13 17:05:32 EDT 2011

update it to release version, then test again.

marcelloc

LinuxTracker,

Port alias must be applied on port field, not in host field. ;)

LinuxTracker

@marcelloc:

LinuxTracker,
Port alias must be applied on port field, not in host field. ;)

Edited for block-headedness.

Yep. You is right on, you are.

I sho nuff stepped into that one.

andrew0401

Why does pfBlock create duplicate rules (or at least they look like duplicates to me) and where does it log to? The dashboard widget is showing an increase in packet count but I seem unable to find out what is causing it.

Andrew

RonpfS

@andrew0401:

Why does pfBlock create duplicate rules (or at least they look like duplicates to me) and where does it log to? The dashboard widget is showing an increase in packet count but I seem unable to find out what is causing it.

Andrew

pfBlocker package log to Status: System logs: System
Just click Enable Logging under Firewall: pfBlocker for list action that are NOT Alias only.
The pfBlocker auto generated rules will log events under Status: System logs: Firewal.

When you use a pfBlocker Alias in your custom Firewall rules, select Log packets that are handled by this rule

You can see more details in the firewall logs when you enable Show raw filter logs under Status: System logs: Settings

andrew0401

pfBlocker package log to Status: System logs: System

*** Thanks for the info

Just click Enable Logging under Firewall: pfBlocker for list action that are NOT Alias only.

*** Already set

The pfBlocker auto generated rules will log events under Status: System logs: Firewal.

*** Not found them

When you use a pfBlocker Alias in your custom Firewall rules, select Log packets that are handled by this rule

*** Already set

You can see more details in the firewall logs when you enable Show raw filter logs under Status: System logs: Settings

*** Still no sign of anything that matchs

Also why are all the rules duplicated?

Andrew

marcelloc

Also why are all the rules duplicated?

Can you take a screenshot of this duplicates?

*** Still no sign of anything that matchs

It will log as firewall rules, no extra info about pfBlocker package.

slagr

@marcelloc:

slarg,

I think your are not on latest version, it should be

2.0-RELEASE
built on Tue Sep 13 17:05:32 EDT 2011

update it to release version, then test again.

marcelloc, thank you. That was the problem. It works just fine now.
Thanks again for the excellent package.

andrew0401

Duplicate rules on the WAN - if I delete one set then everything still works - but as soon as I open the pfblocker screen they reappear.

Also - when causes the count in the dashboard widget reset to zero?

Andrew

![New Picture.jpg](/public/imported_attachments/1/New Picture.jpg)
![New Picture.jpg_thumb](/public/imported_attachments/1/New Picture.jpg_thumb)

marcelloc

Do you have modified description rules? try to delete all pfblocker rules and then reaply config.

also check what version of pfBlocker you are using. Current version is 1.0

Everytime you apply rules, pfSense reset counters.

Just for suggestion, spyware and Adverts works better with action deny outbound, so while browsing pfsense reject connections to these sites/links.

andrew0401

Deleted all rules.

Checked I am using version 1.0

Changed spyware & ads to deny outbound

Now have duplicate rule on WAN for TopSpammers but the new deny oubounds rules appear only once on the LAN tab

So partially fixed!

Thanks

Andrew

darklogic

Something I have noticed on my pulsemaps wordpress plugin. I have pfblocker enabled and I only allow US IP's. I been seeing on the pulsemaps data that I am getting alot of web activity from Japan in the areas of Nagano, Okaya, Suwa, Mt Kyogatake, and Ina. I also noticed some activity from Dubai which is in Saudi Arabia next toUnited Arab Emirates, and some activity from Australia from New South Wales near Narellan, Richmond, and Sydney.

I have no IP's to go by. I can only see locations that have access my website. I am currently blocking eveything but the US.

Any ideas?

Thanks

marcelloc

Change the way you apply rules.

Unselect everything but USA and choose action alias only.

After this, apply this alias on your wan rules.

Example:

Allow src pfBlockerAmerica dst wan_subnet port 80

kilthro

I wanted to let you know that i finally upgraded to the latest release of pfsense (been on a rc release of 2.0 forever since its been solid for me) which also forced me to go ahead and move away from countryblock and upgrade to this package. I want to say thanks and let you know that I was able to install this package, block everything except for United states, and all is going great so far. The inbound was blocked with no issue. The only thing is the outbound. It would never add the rules to the table to block those no matter what i selected in the package. I just created my own rules with the alias of the countries from pfblocker and all is working great. The counter on the widget works on both inbound and outbound :-).

Thanks so much for putting this together!!!!!
Donation incoming too. :-)

marcelloc

@kilthro:

I was able to install this package, block everything except for United states

take a look on post above yours.
If your are blocking everything except United states, It`s better changing the way you apply rules.

@kilthro:

Thanks so much for putting this together!!!!!
Donation incoming too. :-)

Thank you ;D

kilthro

@marcelloc:

@kilthro:

I was able to install this package, block everything except for United states

take a look on post above yours.
If your are blocking everything except United states, It`s better changing the way you apply rules.

[
[/quote]

Thank you ;D

Sorry let me rephrase. I am successfully blocking everything but the US as I planned. So it is working just fine. There is no issue. All networks appear to be blocked except for US and thats good!!!

marcelloc

Yes, I understood that.

The suggestion was just to use less resources from firewall.

Allow access to 40.000 network and block anything else is less work then block all countries CIDRs and allow what is not matched.

kilthro

Oh i c. That makes sense. Right now seems to be ok but if I see performance issues, I will take that in mind and change it up.