PfBlocker
-
Hi,
I'm new user of pfSense but pretty savvy from a networking perspective.
Worked on this again today and I think I solved it (but in a brazen show of poor troubleshooting skills I'm not sure which bit fixed it)
I changed the right php.ini file located in /usr/local/etc/ so that
suhosin.memory_limit = 16384000000
This got rid of the warnings on the increase in the php memory space I attempted to apply.
I left max table entries at 10,000,000
I went into the interface config for the WAN and added a gateway to it. I suspect this might have been the main problem that was causing it to fail as it fixed other strange problems I was getting.
After that, it all started working. Thought I should post here in case it helps someone else. It's DEFINITELY worth doing incremental changes here however to get it right with the minimum overhead. I'm just massively impatient…
G
-
suhosin.memory_limit = 16384000000
Maybe yo're applying really big lists. on amd64 pfblocker php limit is 250Mb.
Thank's for posting a manual fix for those who needs to apply ruge lists :)
-
Is there a way to determine how old the built in lists are that PFBLocker is currently running with?
How often does one really need to update those lists? Does an ISP's whole IP block really get reassigned to another country very often?
I cound't find that information when I searched around here.
Thanks
-
It stopped being updated since this list got paid.
For now, no other lists in mind. :(
-
I saved all my lists locally. They don't change often, but there are changes. The old countryblock package still has a decent list.
-
Hi tommyboy, do you have a list newer then the latest provided by country block? ???
-
Ok, so I found out today that pfBlocker thinks www.facebook.com or 173.252.100.16 is in Europe somewhere.
So now my question is how do I get my hands on the lists that pfBLocker is using so I can view them in the raw format?
And if I edit that file/files can I replace the current ones by hand?
Thanks.
-
Hi tommyboy, do you have a list newer then the latest provided by country block? ???
I don't think it's newer but it's reliable. I've been using it this whole time.
-
@briand72:
Ok, so I found out today that pfBlocker thinks www.facebook.com or 173.252.100.16 is in Europe somewhere.
So now my question is how do I get my hands on the lists that pfBLocker is using so I can view them in the raw format?
And if I edit that file/files can I replace the current ones by hand?
Thanks.
cidr lists are on /usr/local/pkg/ dir.
South_America_cidr.txt
Oceania_cidr.txt
North_America_cidr.txt
Europe_cidr.txt
Asia_cidr.txt
Africa_cidr.txt -
So I tried to search some but too many pages lol.
On the widget, what determines the "Packets" count?
Initially I thought it would keep a rolling count of blocked packets but it seems to go up and down. Like right now it says 6 but in a few min it will say 0.
I feel kind of dumb asking because I'm sure it's answered some place obvious.
Everything I could find makes me think rolling count but why would it go to 0 so often, shouldn't it keep growing if anything?
FWIW I am on 2.1 latest snap.
-
So I tried to search some but too many pages lol.
On the widget, what determines the "Packets" count?
Initially I thought it would keep a rolling count of blocked packets but it seems to go up and down. Like right now it says 6 but in a few min it will say 0.
I feel kind of dumb asking because I'm sure it's answered some place obvious.
Everything I could find makes me think rolling count but why would it go to 0 so often, shouldn't it keep growing if anything?
FWIW I am on 2.1 latest snap.
Mine does this also. At first I thought it was because I occasionally clear my firewall logs. But it just happened and coincided with a modem going down and resetting which has started to happen here. Will keep watching unless anyone else knows.
-
Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well. Its not a big deal to me. As long as its up and running is all that matters. :-D
-
Anytime interfaces are reset, brought down ect will reset the counters. If you run snort and it does an update to the rules, it will flush the counters.. There are many things that will reset it. I am not sure what other packages you are running but this could lead to the counters clearing as well. Its not a big deal to me. As long as its up and running is all that matters. :-D
Some of that makes sense but in my case I have only that one package running and can just simply keep the home page up for 5 min and often it will reset to 0, or simply just hopping around in the menus, say I look at some logs, double check vpn status etc and later go back home (not making any actual changes during any of this) it will be reset.
I agree it's not a super big deal but kind of defeats the point of the widget to me as that is what I was interested in about it. I rather not have to parse through logs to see if all the sudden my box is getting a big hit from trouble makers.
Don't get me wrong though. I am grateful of the app and still learning it and other options but is a bit of a tease lol
-
check you logs. are you getting reset interfaces? is there any other activity causing this? If you change settings in other areas that can affect the interfaces or monitoring ect it will cause them to reset. I wonder if you are getting alarms on these interfaces.. I never have the widget reset buy just moving around in the webgui.. only if i actually make changes to interfaces, pfblocker, snort, ect..
-
I am receiving an error:
Dashboard page - pfBlocker widget
it is reading '500 - Internal Server Error'This is also reported here:
http://forum.pfsense.org/index.php?topic=54262.0running: 2.0.2-RELEASE (amd64)
packages:
OpenVPN tap Bridging Fix
pfBlocker
RRD Summary -
Upon investigating another error I was experiencing, see here:
http://forum.pfsense.org/index.php/topic,57113.0.htmlI switched from Chrome to IE, in IE the 500 error is gone and the dashboard widget works as expected.
Maybe the pfBlocker and Traffic Graph bug are related….. both show errors in Chrome but work in IE
-
I get this error
php: : There were error(s) loading the rules: /tmp/rules.debug:39: cannot define table pfBlockerEmerging_Block_IP: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [39]: table <pfblockeremerging_block_ip>persist file "/var/db/aliastables/pfBlockerEmerging_Block_IP.txt"
I have deleted the file, but it still shows up on the pfblocker widget on the frontpage of PFsense.
It keeps giving me errors of the list is gone, but before I deleted it, it was still there.
Very weird problem…</pfblockeremerging_block_ip>
-
Cannot remove lists from pfblocker widget….
How to do?? They dont go away when deleted from the lists tab in the config GUI.
-
Deleted and reinstalled. Lists are gone.
-
Did a package delete and rebooted….
Jan 4 22:05:27 php: : There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"
Jan 4 22:05:27 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:35: cannot define table pfBlockerTopSpammers: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [35]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"
I think it has issues with 2.0.2 release…..</pfblockertopspammers></pfblockertopspammers>
