PfBlocker
-
I'll include this ini_set('memory_limit', '250M') patch when pfblocker detects a x64 version.
marcelloc,
Just wanted to report back. After using the above now for the last 6 days. I don't see that affecting anything.
-
countryipblocks.net released a new bogon network list on their site,
check this out. :)
http://forum.pfsense.org/index.php/topic,44867.msg233407.html#msg233407
-
I had to do a configuration restore today and I'm not getting any php memory error(s) so far. This includes reinstalling all packages. So, ini_set("memory_limit", "250M") in /usr/local/pkg/pfblocker.inc seems to not be needed here anymore, well at least so far. Will report back if I start to get the php memory error(s). But I wonder why it is working fine now without editing /usr/local/pkg/pfblocker.inc ?
-
when you apply a new list, pfblocker may increase memory usage do download list and apply it to alias.
when you upgrade downloaded files are not removed. The ini_set("memory_limit", "250M") will be merged to next release and used when x64 instalation is detected.
Thanks for your feedback :)
-
Great, Thanks :)
-
I'm seeing double entries for each rules list auto generated by pfblocker under firewall's rules… Is that's normal?
-
If you checked deny both, then will be two rules with the same list on each interface firewall rules.
Can you check if they are identical?
-
All of my rules are set to "Deny Inbound"
-
Hi there. I'm running into a problem syncing my two pfSense 2.0.1 systems. The aliases do not appear to be synced when I make a change within pfBlocker. If I add an alias by hand, that syncs fine. Here is the error being reported in the log of the slave system when I try to turn on the TopSpammers rule:
php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerTopSpammers.txt.tmp' > '/var/db/aliastables/pfBlockerTopSpammers.txt'' returned exit code '1', the output was ''
Any hints or thoughts?
Thanks!
-
biogoon,
I'll try to simulate it this weekend.
-
All of my rules are set to "Deny Inbound"
I have no duplicates here, can you send screenshots of your configuration as well system version?
-
I think I may have found a small bug with the package… I haven't re-read all 22 pages but did some searching within the topic and couldn't find it.
I'm using squid to improve web performance and for logging.. I have setup a couple of list within pfBlocker to block inbound(WAN) and outbound(LAN) Since squid uses localhost, i figured it would need to be a floating rule for it to catch. After reading a few post, but hunch was right..
After creating the floating rules, they seem to work.. But anytime I make a change within the pfBlocker config pages or just re-save, it deleted the floating rules. I'm thinking this is because pfBlocker deletes and re-creates the Alias's when the configuration its save..
I tried to create a new alias and nest the pfBlockers alias's into it but pfSense didn't like that.. I thought about creating brand new url table alias but then that would be a waste of memory.
any thoughts?
-
What description did you configured on floating rule?
If it was pfBlockeraliasname something rule, then pfBlocker will remove it.
Try 'pfBlockeraliasname for squid' and see if it survive an apply
-
I tried that and it didn't work, but "pfBlocker-aliasname for Squid" does.. The '-' made the difference.. As always, thank you!!
-
I'm using squid to improve web performance and for logging.. I have setup a couple of list within pfBlocker to block inbound(WAN) and outbound(LAN) Since squid uses localhost, i figured it would need to be a floating rule for it to catch. After reading a few post, but hunch was right..
Can you please explain. Does this mean if one is using Squid and pfBlocker. A floating rule for Squid is need in order for Squid to use the lists used in pfBlocker?
-
Can you please explain. Does this mean if one is using Squid and pfBlocker. A floating rule for Squid is need in order for Squid to use the lists used in pfBlocker?
Yes, read this topic.
http://forum.pfsense.org/index.php/topic,44479.0.html
-
Yes, read this topic.
http://forum.pfsense.org/index.php/topic,44479.0.html
Thanks, just read it but do not fully understand. Maybe once I add the floating rule(s), I will.
-
pfSense is a statefull firewall, so all rules are applied where connections begin.
Squid does not use LAN or WAN rules but localhost rules as it starts communications to web servers locally.
The only way to apply rules on localhost, is using floating rules.
This way squid wil not be able to connect to any China web site if firewall is blocking access to China's ips.
-
Thanks for that explanation, I understand it better :) But I'm still not sure how the floating rule(s) show be properly created.
Like this?:
Action: Reject
Interface: WAN
Direction: any
Protocol: any
Source: any
Destination: pfBlockerAliasname
Description: pfBlockerAliasname-SquidSorry if these are obvious questions.
-
Change interface to any and direction to out.
