PfBlocker

marcelloc

1.) Have its own log tab so you can quickly and easily see what has been blocked

pfblocker just create firewall rules with log options selected, so there is no way to distinct from other firewall log rules

@S_D:

2.) On the dashboard widget breakdown the blocked stats to incoming/outgoing

No plans for that yet.

jp141

Ok thanks for the update.

Keep up the great work ;D

jp141

@marcelloc:

Pfsense is trying to update urltables applied by pfblocker during boot.

I'll try to find a way to prevent this if there is no link/ip/webserver up.

Hi marcelloc,

I am also getting this issue, it is preventing pfsense fully booting, if I go in via SSH and force the web configurator to start then disable pfblocker the system continues to boot fine.

I have multi wan, not sure if that is the issue?

I just get this for each list in the startup log:

php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerDshield.txt.tmp' 'https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerDshield'' returned exit code '1', the output was 'fetch: transfer timed out'

Once the system has booted I can start pfblocker with no issues.

Edit: this is on nanobsd if it matters and the latest pfblocker (only installed today)
I can also see "No pfBlocker action during boot process." in the logs a couple of times so it is obviously trying to delay but going wrong somewhere.

S_D

One little bug, Marcelloc.

When i use a list with deny inbound (for example), the widget 'packets' (blocked) counter counts up. However, if I just alias a list, and reference that in a firewall wall (even if that rule is logged) then the packet counter doesn't work at all (the field remains blank).

Is this by design or a bug?

If so, I guess I could work around it by using deny inbound, and then modifying the resulting rule in the rulebase to point to the one LAN host that I want. However, will this modification be remembered, or will it revert to it's default 'all/all/all' settings??

S_D

I think I've answered my own question just now. If the comment field for the rule you create contains the Alias name then the widget counter goes up correctly…. :)

marcelloc

@S_D:

I think I've answered my own question just now. If the comment field for the rule you create contains the Alias name then the widget counter goes up correctly…. :)

That's it, You need to follow alias name pattern to get a working widget. :)

eri--

@marcelloc:

@jp141:

1.) Have its own log tab so you can quickly and easily see what has been blocked

pfblocker just create firewall rules with log options selected, so there is no way to distinct from other firewall log rules

You could create the rules with 'label pfBlocker' and get stats based on that.
pf(4) allows that and this will give you stats.

marcelloc

@ermal:

You could create the rules with 'label pfBlocker' and get stats based on that.
pf(4) allows that and this will give you stats.

Is it possible to include label on firewall rules gui?

eri--

Yes, the description that you put on the rules transforms into the label option behind.
Beaware that is limited to 64 chars in pf(4)

marcelloc

Maybe it's the way I get rules counters on widget. I'll see how can I use it in logs.

Thanks ermal for this tip.

LinuxTracker

I've read some of the posts regarding the Level 1 block list.

I have to say, the L1 the biggest list I use and I use a lot of lists.

My experience is that pfBlocker loads faster and more reliably when it has more efficient lists to work with.
For Level 1 - I converted it into CIDR and then broke that into 3 separate lists. It really helped.

You can try it yourself and see if performance improves.
Here's a converted L1 from Bluetack/IBlocklist - that I did last March.
The urls below will plug directly into pfBlocker-> Lists, or into Aliases.

http://dl.dropbox.com/u/71477228/P2P_0-68.txt
http://dl.dropbox.com/u/71477228/P2P_69-193.txt
http://dl.dropbox.com/u/71477228/P2P_194-255.txt

FYI: To do this, I use Bluetack's Blocklist converter.
http://www.bluetack.co.uk/converter/

It's old and always takes me a few tries to get it right.
It's the only online tool I've found that will do the conversion properly.

.

LinuxTracker

My in-laws are traveling cross country and I was forced to start using Skype.
The thing is, I despise ads.

So, I've puzzled out the list of servers that deliver ads to Skype.

It was tricky, because Microsoft has ad servers and Microsoft services (like Hotmail) in the same IP blocks - and the IPs can switch every 5-10 minutes.
I had to write a couple of bash scripts to compile and separate ad-serving IPs from the service IPs.

Important -> You'll need to block outbound LAN connections for HTTP and HTTPS.

You can download the list from here. You could also use the url directly in pfBlocker or in Aliases.
http://dl.dropbox.com/u/71477228/blacklistedads.txt

It'll be updated when/if new ad servers make themselves known.

marcelloc

@LinuxTracker:

So, I've puzzled out the list of servers that deliver ads to Skype.

good job :)

Do you know about android ads on free apps? it's really annoying!

ypmict

Hi there.. good day.. I am new to this pfBlocker, how to apply the pfBlocker rules to grouped interface, such as if i have grouped multiple WAN interface on pfSense setting..

thank you very much…

marcelloc

@ypmict:

how to apply the pfBlocker rules to grouped interface

Change list action to alias only and create rules the way you want.

_igor_

pfblocker began to fill my logs with "php: : There were error(s) loading the rules: /tmp/rules.debug:17: cannot define table pfBlockerNorthAmerica: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [17]: table <pfblockernorthamerica>persist file "/var/db/aliastables/pfBlockerNorthAmerica.txt".

Seemed to work stable till today. The only thing i did was entering an own blocklist and put USA to my list.

Disabling the North America rules resolved the filling of systemlog, but the blocking remains down. :(

At the dashboard the widget shows all blockings as "down", say a red arrow.

New errors came up too:
php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerTopSpammers.txt.tmp' > '/var/db/aliastables/pfBlockerTopSpammers.txt'' returned exit code '1', the output was ''
Jul 18 19:27:32 php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerNorthAmerica.txt.tmp' > '/var/db/aliastables/pfBlockerNorthAmerica.txt'' returned exit code '1', the output was ''</pfblockernorthamerica>

marcelloc

Did you increased max_table_entries on system -> advanced?

you may need to disable lists before increase max_table value.

_igor_

yes. I increased the max tables before. I had pfblocker disabled before i increased the max tables.

marcelloc

try to increase to a higher value.

_igor_

increased to 400000, but still all Blockings down. :(