PfBlocker

darklogic

Something I have noticed on my pulsemaps wordpress plugin. I have pfblocker enabled and I only allow US IP's. I been seeing on the pulsemaps data that I am getting alot of web activity from Japan in the areas of Nagano, Okaya, Suwa, Mt Kyogatake, and Ina. I also noticed some activity from Dubai which is in Saudi Arabia next toUnited Arab Emirates, and some activity from Australia from New South Wales near Narellan, Richmond, and Sydney.

I have no IP's to go by. I can only see locations that have access my website. I am currently blocking eveything but the US.

Any ideas?

Thanks

marcelloc

Change the way you apply rules.

Unselect everything but USA and choose action alias only.

After this, apply this alias on your wan rules.

Example:

Allow src pfBlockerAmerica dst wan_subnet port 80

kilthro

I wanted to let you know that i finally upgraded to the latest release of pfsense (been on a rc release of 2.0 forever since its been solid for me) which also forced me to go ahead and move away from countryblock and upgrade to this package. I want to say thanks and let you know that I was able to install this package, block everything except for United states, and all is going great so far. The inbound was blocked with no issue. The only thing is the outbound. It would never add the rules to the table to block those no matter what i selected in the package. I just created my own rules with the alias of the countries from pfblocker and all is working great. The counter on the widget works on both inbound and outbound :-).

Thanks so much for putting this together!!!!!
Donation incoming too. :-)

marcelloc

@kilthro:

I was able to install this package, block everything except for United states

take a look on post above yours.
If your are blocking everything except United states, It`s better changing the way you apply rules.

@kilthro:

Thanks so much for putting this together!!!!!
Donation incoming too. :-)

Thank you ;D

kilthro

@marcelloc:

@kilthro:

I was able to install this package, block everything except for United states

take a look on post above yours.
If your are blocking everything except United states, It`s better changing the way you apply rules.

[
[/quote]

Thank you ;D

Sorry let me rephrase. I am successfully blocking everything but the US as I planned. So it is working just fine. There is no issue. All networks appear to be blocked except for US and thats good!!!

marcelloc

Yes, I understood that.

The suggestion was just to use less resources from firewall.

Allow access to 40.000 network and block anything else is less work then block all countries CIDRs and allow what is not matched.

kilthro

Oh i c. That makes sense. Right now seems to be ok but if I see performance issues, I will take that in mind and change it up.

trafficking

Firstly, thank you for the excellent package. I greatly enjoy using 3rd party lists to do IP blocking and have pfblocker configured and running the way I like it. That said, I do have a couple questions.

I prefer to block inbound and outbound connections on all interfaces and use pfblocker aliases with 2 floating rules to do this. Is this the preferred method or is there another way I am missing?
Not directly a pfblocker question, but in what order are floating rules applied? Do they come before or after the individual interface rules?

Thank you very much for all your hard work!

marcelloc

I prefer to block inbound and outbound connections on all interfaces and use pfblocker aliases with 2 floating rules to do this. Is this the preferred method or is there another way I am missing?

Define action as alias only and create your rules. That's the best way.

justsomeguy6575

This seems like a very good package. However I'm having trouble getting lists to work properly.

I can make a list with this url in gz format and it works fine and creates an alias:
http://list.iblocklist.com/?list=bt_spyware&fileformat=p2p&archiveformat=gz

For some reason no matter what I try I can't get this list to load in either txt or gz format. No alias is created and nothing is blocked.
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist

Any ideas? Thanks

marcelloc

For some reason no matter what I try I can't get this list to load in either txt or gz format. No alias is created and nothing is blocked.
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklist

This list is in txt format and returns only ips, not CIDR or ip ranges.

so,

:)

version 1.0.1 is out with:

fixed pfBlocker to check lists with single ips
updated country ip files
Return of Deny Both action(Inbound and Outbound)
Improved some GUI info

justsomeguy6575

Wow.. thanks marcello! New version seems to work great.

Nice work, thanks again

vg8open

Thank you for a great package! I just have one minor request for this package. Can you add more granular options for the list update frequency? Something like the attached image?

Thanks,

-Brian

schedule.PNG_thumb

KongGulerod

Thanx for a great package - I like how it integrates and uses pfSense 2.0 firewall aliases and WAN/LAN rules :-)

A small observation and fix request (latest pfSense 2.0 release + latest pfBlocker):

After placing the pfBlocker widget on the bottom part of my long pfSense 2.0 dashboard page with vertical scrollbar, I observed that the dashboard page/scrollbar automatically reverted back to the top of the page at a fixed interval (every 5-10 secs).

This is a bit annoying if I am looking at data from a widget in the bottom part of the dashboard page - and every 5-10 seconds the page jumps to the top (internal pfBlocker refresh?) and I have to manually use the scrollbar/mouse/arrow-keys to navigate back down to the bottom of the page.

If I temp. removed the pfBlocker widget from dashboard the mis-behaviour went away also.

Hope you can reproduce this scenario and look forward to next release :-)

marcelloc

I observed that the dashboard page/scrollbar automatically

Thanks for the feedback.

I`ve removed scroll call in widget.

reinstall package in about 15 minutes.

If you have many widgets, consider testing widescreen package. It may help you.

AhnHEL

Reinstalled and now I'm not getting any CIDRs or Packets in the widget.

![Screen Shot 2011-12-20 at 1.47.33 PM.png](/public/imported_attachments/1/Screen Shot 2011-12-20 at 1.47.33 PM.png)
![Screen Shot 2011-12-20 at 1.47.33 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2011-12-20 at 1.47.33 PM.png_thumb)

marcelloc

fixed javascript again, try reinstall in 15 minutes.

LEPM

pf 2.0 i386 + squid+squidguard+pfblocker 1.0 and 1.0.1 works very well (deny inbound)

pfblocker 1.0.1+ deny both, crash pfsense!!
reboot and crash,crash…
changing to deny inbound,works well again

marcelloc

Can you be more specific on what kind of crash you have?

I'm using deny both with no issues or crashes.
Boot process is fine too.

KongGulerod

@marcelloc:

I`ve removed scroll call in widget.
reinstall package in about 15 minutes.

Seems to work fine now… no forced scrolling to the top when refreshing numbers.

Thanx !!