PfBlocker

_igor_

i did the following:

deinstalled pfblocker, adjusted table size, installed pfblocker, started:

php: /pkg_edit.php: [pfblocker] pfblocker_xmlrpc_sync.php is starting.
Jul 19 17:27:00	check_reload_status: Reloading filter
Jul 19 17:27:00	check_reload_status: Syncing firewall
Jul 19 17:27:00	php: /pkg_edit.php: Starting pfBlocker sync process.
Jul 19 17:27:00	check_reload_status: Syncing firewall
snip
	php: /pkg_edit.php: [pfblocker] pfblocker_xmlrpc_sync.php is starting.
Jul 19 14:03:42	check_reload_status: Reloading filter
Jul 19 14:03:42	php: /pkg_edit.php: Starting pfBlocker sync process.
Jul 19 14:03:38	php: /pkg_edit.php: [pfblocker] pfblocker_xmlrpc_sync.php is starting.
Jul 19 14:03:38	check_reload_status: Reloading filter
Jul 19 14:03:38	check_reload_status: Syncing firewall
Jul 19 14:03:38	php: /pkg_edit.php: Starting pfBlocker sync process.
Jul 19 14:03:38	check_reload_status: Syncing firewall
Jul 19 14:03:13	check_reload_status: Syncing firewall
Jul 19 14:03:12	check_reload_status: Reloading filter
Jul 19 14:03:12	check_reload_status: Syncing firewall
Jul 19 14:03:12	php: /pkg_mgr_install.php: No pfBlocker action during boot process.
Jul 19 14:03:12	php: /pkg_mgr_install.php: No pfBlocker action during boot process.
Jul 19 14:03:00	check_reload_status: Syncing firewall
Jul 19 14:02:58	php: /pkg_mgr_install.php: Beginning package installation for pfBlocker.
Jul 19 14:02:58	check_reload_status: Syncing firewall
Jul 19 14:02:44	check_reload_status: Reloading filter
Jul 19 14:02:43	php: /pkg_mgr_install.php: No pfBlocker action during boot process.

No errors, but Status is down. It shows cdir-entries, but no packets.

marcelloc

@_igor_:

No errors, but Status is down. It shows cdir-entries, but no packets.

What action did you selected on pfblocker list? Did you enabled the service after installing?

_igor_

top spammers selected, activated.

LinuxTracker

@marcelloc:

Do you know about android ads on free apps? it's really annoying!

If your phone is rooted you can d/l AdFree from the Google store.
https://play.google.com/store/apps/details?id=com.bigtincan.android.adfree&hl=en

My Android is WiFi-only so I can Alias-block the below servers that AdFree was missing.

65.52.2.0/24 69.89.31.0/24 96.44.173.0/24 50.16.243.250/32

If you want; I can dig out the host file AdFree creates in my phone, but you may need to be rooted to use it.

and

I updated my Skype ad-block list.
http://dl.dropbox.com/u/71477228/blacklistedads.txt

I removed 2 IPs that were hampering OfficeHelp from loading properly.
I also added a bunch of ranges that my scripts collected since last post.
The new IPs came from resolving ads2.msads.net (against 6 DNS servers every 6 min for 3 weeks).

Edit: Looks like MS added a bunch of new ad servers today.
questionmarket / adsafeprotected-admob-doubleclick / choices.truste.com

List is updated.

marcelloc

Thanks Linuxtracker, the adfree worked very nice. :)

TommyTheKid

I guys, I have been very happy with the pfBlocker until I had to restore my firewall config. (failed CF due to bandwidthd).

When I brought up the firewall after "restoring" the configuration xml file, I got errors like this:

There were error(s) loading the rules: /tmp/rules.debug:163: macro 'pfBlockerTopSpammers' not defined
/tmp/rules.debug:163: syntax error
/tmp/rules.debug:164: macro 'pfBlockerDSHIELD' not defined
/tmp/rules.debug:193: macro 'pfBlockerTopSpammers' not defined
/tmp/rules.debug:193: syntax error
/tmp/rules.debug:194: macro 'pfBlockerDSHIELD' not defined
/tmp/rules.debug:202: macro 'pfBlockerTopSpammers' not defined
/tmp/rules.debug:202: syntax error
/tmp/rules.debug:203: macro 'pfBlockerDSHIELD' not defined
pfctl: Syntax error in config file: pf rules not loaded The line in question reads [163]: block  in  quick  on $WAN  from   $pfBlockerTopSpammers to any  label "USER_RULE: pfBlockerTopSpammers auto rule"

I assume that something is not getting backed up/restored properly. I had to disable pfBlocker and reload the firewall to get it to pass packets. Any ideas?

NOTE that I also have an HA pair (CARP/XMLRPC), but this appears to have its own XMLRPC settings.

~tommy

marcelloc

Tommy,

If you were using alias only action on your lists, pfblocker install/uninstall process will not remove your custom rules.
Second point is that pfblocker is disabled by default after install, you need to access it's gui and enable it.

att,

Marcello Coutinho

mbp

I'm also having the same issue(s) as igor. I have max table entries set to 999999999. Reinstalled package 2 times. Restored configuration as well. I just installed pfSense itself maybe a day ago (new build). I'm using the Primary Threats blocklist from i-blocklist. I have also tried selecting country blocks. All show red arrow pointing down. :(

marcelloc

mbp,

check pfblocker wiki at doc.pfsense.org/index.php/Pfblocker

att,
Marcello Coutinho

marcelloc

Country IP Blocks is considering offering free ACLs to pfblocker users

kilthro

thats awesome news!

mbp

@marcelloc:

mbp,

check pfblocker wiki at doc.pfsense.org/index.php/Pfblocker

att,
Marcello Coutinho

Found the problem! Thank you! For the folks hunting through google. Here you have it:

I Can't see any pflblocker rule applyed, whats wrong?
pfblocker requires at least one firewall entry (any interface) for it to be active. One way to verify is to check the front page widget.

tommyboy180

We got mentioned on the teksyndicate youtube feed!

http://www.youtube.com/watch?v=Q0JFfpG4BWI&feature=player_detailpage#t=1020s

Woot!

kilthro

Awesome!!!

I have said it before and I will say it again. This package was what introduced me and brought me to pfsense to begin with. I couldn't imagine now having a firewall running without this package. Thanks for all the hard work that has gone into this Tommyboy180 and Marcelloc.. Linux tracker thanks for the lists. :-)

AudiAddict

Awesome package! Works perfectly so far.

Some feature requests, which I hope you can add to make it even better:

1) Traffic being blocked by pfblocker logged in a different tab (instead of the firewall log?) Easy to debug if something is being blocked by my own rules or the pfblocker app.
I do know that you can see that if something is blocked by pfblocker you can see that by looking at the details, but when you have allot of blocked records it's hard to filter

2) Users are complaing specific sites are being blocked. Is there a whitelisting feature available to ignore certain websites? Or do I have to enter them in a alias in my firewall manualy?

3) I'm using squid (transparant) would it be possible to send some kind of message to the user that the site has been blocked? Now they get a connection error which makes the user think internet is not working (they call the helpdesk). Would love to send some kind of squid access denied error page or something like that.

4) I can set more interfaces on the outbound part, this allows me to block access to certain sites (outbound) in countries on my network. The problem is that I only want to block access to these users on my WIFI interface and not my LAN (which doesn't need that much security). Would it be possible to set the outbound interface on the country tabs instead of all outbound selections?

5) Ignore tab –> where I can enter my own ip for outbound and my servers for inbound? Just to make 100 % sure these do not get blocked?

marcelloc

Audiaudict,

Except for the log tab, all features you've requested can be done with "alias only" list action and firewall rules.

AudiAddict

Can you explain how this works ? Are you talking about the general aliasses in pfsense? Or the list tab in pfblocker?

Is there some documentation available about this?

ceama

@S_D:

I think I've answered my own question just now. If the comment field for the rule you create contains the Alias name then the widget counter goes up correctly…. :)

Excuse my ignorance here, but could you be so kind to tell me exactly how you solved this? You mention an alias name in the comment field. I may be having the same or similar problem with pfblocker. Thanks for the tip on how to get the web configuator started from SSH to turn off pfblocker when the system hangs at boot.

LinuxTracker

Came across a new list of malware IPs

http://labs.alienvault.com/labs/index.php/projects/open-source-ip-reputation-portal/download-ip-reputation-database/

Looks like either the gzip ver or the plain ver - of the Generic Format - would load fine in pfBlocker.

Haven't tried it yet - will give it a go tonight and post back how it loads.

marcelloc

@ceama:

Could you be so kind to tell me exactly how you solved this? You mention an alias name in the comment field. I may be having the same or similar problem with pfblocker.

take a look on list action description:

While creating rules with this list, keep aliasname in the beggining of rule description and do not end description with 'rule'.
custom rules with 'Aliasname something rule' description will be removed by package.

pfblocker create aliases and rules on pfsense with your lists.
If you change action to alias only, pfblocker will create only the alias part, and no rules. This way, when you create your own rules, configure it`s description with 'aliasname custom1' for example to get widget working.

att,
Marcello Coutinho