Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    pfSense Packages
    143
    896
    1.1m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      asbirim
      last edited by

      Hi, I added support to insert portlist file. this way peoples can customize installations with pre defined rules from their web sites.

      you can deploy port list file with adding #PORT_LIST_PF text to begin of file.

      i hope you will include this changes to next release and it will helpful to others.

      example port list file: safeports.txt

      
#PORT_LIST_PF
21#ftp
22#ssh
25#smtp
53#dns
67#dhcp
80#http
110#pop
443#https
587#new smtp
1433#sql server
3306#mysql
3389#rdp

      replace bellow code in your /usr/local/pkg/pfblocker.inc

      add this function to after pfblocker_Range2CIDR function

      
function pfblocker_Range2Ports($port_min, $port_max) {
	#function called without any args
	if ($port_min == "" || $port_max == "")
		return "";
	#function called with same ip in min and max
	if ($port_min == $port_max)
		return $port_min;
	$bas=intval($port_min);
	$start_port+=1;//skip first value because its already processed
	$res="";
	$end_port=intval($port_max);
	for($i=$start_port;$i<=$end_port;$i++) {
		$res.="$i\n";
	}
	if($res!="") 
		return $res;
}

      changes begins at "#print $list['aliasname'].$list['action']." ".$alias." ".$row['url']."
      ";"

      
#print $list['aliasname'].$list['action']." ".$alias." ".$row['url']."
";
			if ($alias != "pfBlocker" && $list['action'] != "" && $list['action'] != 'Disabled' && $pfblocker_enable == "on") {
				$isPortList=FALSE;
				#remove empty lists files if any
				if (is_array($list['row']))
				foreach ($list['row'] as $row) {
					#print $list['aliasname'].$list['action'].$list['cron']." ".$alias." ".$row['url']."$update_local
";
					if ($row['url'] != "") {
						$md5_url = md5($row['url']);
						if (file_exists($pfbdir."/".$md5_url.".txt")) {
							$f=file($pfbdir.'/'.$md5_url.'.txt');
							${$alias}.= file_get_contents($pfbdir.'/'.$md5_url.'.txt');
							if ($f[0]=="#PORT_LIST_PF\n") {
								$new_file=${$alias};
								$new_file=str_replace("#PORT_LIST_PF\n","",$new_file);
								$new_file=str_replace("#PORT_LIST_PF ","",$new_file);
								$isPortList=TRUE;
							}
						}
						else {
							if ($row['format'] == "gz")
								$url_list= gzfile($row['url']);
							else
								$url_list= file($row['url']);
							#extract range lists
							$new_file="";

							if (is_array($url_list)) {
								if ($url_list[0]=="#PORT_LIST_PF\n") {
									$isPortList=TRUE;
									$new_file="##PORT_LIST_PF\n";

									foreach ($url_list as $line) {

										# port format 80
										if (preg_match("/(\d+)/",$line,$matches)){
											${$alias}.= $matches[1]."\n";
											$new_file.= $matches[1]."\n";
										}

										# Port range 20-23

										if (preg_match("/(\d+)-(\d+)/",$line,$matches)){
											$plist = pfblocker_Range2Ports($matches[1],$matches[2]);
											if ($plist != ""){
												${$alias}.= $plist;
												$new_file.= $plist;
											}
										}
									}

								}
								else {
									foreach ($url_list as $line) {

										# CIDR format 192.168.0.0/16
										if (preg_match("/(\d+\.\d+\.\d+\.\d+\/\d+)/",$line,$matches)){
										${$alias}.= $matches[1]."\n";
										$new_file.= $matches[1]."\n";
										}
										# Single ip addresses 
										if (preg_match("/(\d+\.\d+\.\d+\.\d+)\s+/",$line,$matches)){
										${$alias}.= $matches[1]."/32\n";
										$new_file.= $matches[1]."/32\n";
										}
										# Network range 192.168.0.0-192.168.0.254
										if (preg_match("/(\d+\.\d+\.\d+\.\d+)-(\d+\.\d+\.\d+\.\d+)/",$line,$matches)){
											$cidr= pfblocker_Range2CIDR($matches[1],$matches[2]);
											if ($cidr != ""){
												${$alias}.= $cidr."\n";
												$new_file.= $cidr."\n";
											}
										}

									}
								}
							}
							if ($new_file != "")
								file_put_contents($pfbdir.'/'.$md5_url.'.txt',$new_file, LOCK_EX);
						}
					}
				}

				//if($isPortList==TRUE)
				//	echo "$alias port list $new_file";

				#check custom network list
				if (pfb_text_area_decode($list['custom']) != "")
					${$alias}.=pfb_text_area_decode($list['custom'])."\n";
				#save alias file if not empty
				if (${$alias} == ""){
					unlink_if_exists($pfb_alias_dir.'/'.$alias.'.txt');
					}
				else{
					file_put_contents($pfb_alias_dir.'/'.$alias.'.txt',${$alias}, LOCK_EX);
					file_put_contents($pfsense_alias_dir.'/'.$alias.'.txt',${$alias}, LOCK_EX);
					#create alias
					if($isPortList==TRUE) {
						$new_file=str_replace("#PORT_LIST_PF\n","",$new_file);
						$new_file=str_replace("#PORT_LIST_PF ","",$new_file);
						$new_file=str_replace("\n"," ",$new_file);
						$new_file=trim($new_file);
						$new_aliases_list[]=$alias;
						$new_aliases[]=array("name"=> $alias,
									 "url"=> "",
									 "updatefreq"=> "32",
									 "address"=>"$new_file",
									 "descr"=> "pfBlocker user list",
									 "type"=> "port",
									 "detail"=> "DO NOT EDIT THIS ALIAS");
					}
					else {
						$new_aliases_list[]=$alias;
						$new_aliases[]=array("name"=> $alias,
									 "url"=> $web_local.'?pfb='.$alias,
									 "updatefreq"=> "32",
									 "address"=>"",
									 "descr"=> "pfBlocker user list",
									 "type"=> "urltable",
									 "detail"=> "DO NOT EDIT THIS ALIAS");
						#Create rule if action permits
						switch($list['action']){
							case "Deny_Both":
								$rule = $base_rule;
								$rule["type"] = $deny_action_inbound;
								$rule["descr"]= "$alias auto rule";
								$rule["source"]= array("address"=> $alias);
								$rule["destination"]=array("any"=>"");
								if ($pfblocker_config['enable_log'])
									$rule["log"]="";
								$deny_inbound[]=$rule;
							case "Deny_Outbound":
								$rule = $base_rule;
								$rule["type"] = $deny_action_outbound;
								$rule["descr"]= "$alias auto rule";
								$rule["source"]=array("any"=>"");
								$rule["destination"]= array("address"=> $alias);
								if ($pfblocker_config['enable_log'])
									$rule["log"]="";
								$deny_outbound[]=$rule;					
								break;
							case "Deny_Inbound":
								$rule = $base_rule;
								$rule["type"] = $deny_action_inbound;
								$rule["descr"]= "$alias auto rule";
								$rule["source"]= array("address"=> $alias);
								$rule["destination"]=array("any"=>"");
								if ($pfblocker_config['enable_log'])
									$rule["log"]="";
								$deny_inbound[]=$rule;					
								break;
							case "Permit_Outbound":
								$rule = $base_rule;
								$rule["type"] = "pass";
								$rule["descr"]= "$alias auto rule";
								$rule["source"]=array("any"=>"");
								$rule["destination"]= array("address"=> $alias);
								if ($pfblocker_config['enable_log'])
									$rule["log"]="";
								$permit_outbound[]=$rule;					
								break;
							case "Permit_Inbound":
								$rule = $base_rule;
								$rule["type"] = "pass";
								$rule["descr"]= "$alias auto rule";
								$rule["source"]= array("address"=> $alias);
								$rule["destination"]=array("any"=>"");
								if ($pfblocker_config['enable_log'])
										$rule["log"]="";
								$permit_inbound[]=$rule;					
								break;
						}
					}
				}
			#mark pfctl aliastable for cleanup
			if (!in_array($alias, $aliases_list)) 
				$aliases_list[]=$alias;
			}
		else{
			#unlink previous pfblocker alias list if any
			unlink_if_exists($pfb_alias_dir.'/'.$alias.'.txt');
			}
		}
		#update pfsense alias table

      end at "#update pfsense alias table"

      1 Reply Last reply Reply Quote 0
      • S
        Supermule Banned
        last edited by

        So that way Pfblocker only works on specified ports and not on all??

        1 Reply Last reply Reply Quote 0
        • A
          asbirim
          last edited by

          No, not like that,

          this way you can add port alias to firewall or just block ports

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @asbirim:

            this way you can add port alias to firewall or just block ports

            On current version, you can use alias only option and create your own rules using, port aliases, connection limit, limiter, etc, etc ,etc.

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • E
              elterrible
              last edited by

              thanks for the great package.  have been playing around with it for a couple months now, but just realized something a little odd.  i have a few iblocklist and linuxtracker lists, but i've never seen them update (at least the system log doesn't say so).  anyone else have the same issue?  i know the iblocklist lists are updated weekly at least and linuxtracker used to update his twice a week.  any help would be much appreciated.

              1 Reply Last reply Reply Quote 0
              • marcellocM
                marcelloc
                last edited by

                What update frequency did you applied to this list?

                Can you install cron package and check if pfblocker schedules are there?

                Treinamentos de Elite: http://sys-squad.com

                Help a community developer! ;D

                1 Reply Last reply Reply Quote 0
                • E
                  elterrible
                  last edited by

                  the lists (alias only, with corresponding firewall rules) are set to update every day.  there seem to be two jobs in cron that relate to this:

                  0  *  *  *  *  root  /usr/local/bin/php -q /usr/local/www/pfblocker.php cron
                  30  12  *  *  0,2,4  root  /usr/bin/nice -n20 /etc/rc.update_urltables

                  and here are snippets of the logs that relate to those jobs:

                  Feb 17 12:30:53 php: : /etc/rc.update_urltables: pfBlockerlevel1 does not need updated.
                  Feb 17 12:30:53 php: : /etc/rc.update_urltables: pfBlockerNorthAmerica does not need updated.
                  Feb 17 12:30:53 php: : /etc/rc.update_urltables: Starting URL table alias updates
                  Feb 17 12:30:01 php: : /etc/rc.update_urltables: Sleeping for 51 seconds.
                  Feb 17 12:30:01 php: : /etc/rc.update_urltables: Starting up.
                  Feb 16 23:00:23 php: : [pfblocker] pfblocker_xmlrpc_sync.php is starting.
                  Feb 16 23:00:23 check_reload_status: Reloading filter
                  Feb 16 23:00:23 check_reload_status: Syncing firewall
                  Feb 16 23:00:01 php: : Starting pfBlocker sync process.

                  the update_urltables job has never said that a list was updated.  and the pfblocker sync has only repeated those four lines every day.

                  thanks.

                  1 Reply Last reply Reply Quote 0
                  • T
                    traxxus
                    last edited by

                    Hi

                    I have added the package "Ads" and want to block it, but on this site: http://www.hardwareluxx.de/community/forum.php for example i can see the ads.

                    Is there a mistake by me, or anythign else?

                    1 Reply Last reply Reply Quote 0
                    • M
                      mint64
                      last edited by

                      why does pfBlocker set it's rules in LAN instead of WAN? or is it just me? I'm asking because the Ip's that i want to block still connect to my pfSense machine and i want to stop that.

                      1 Reply Last reply Reply Quote 0
                      • T
                        traxxus
                        last edited by

                        @mint64:

                        why does pfBlocker set it's rules in LAN instead of WAN? or is it just me? I'm asking because the Ip's that i want to block still connect to my pfSense machine and i want to stop that.

                        pfSense put the rules only into LAN when you choose "deny both" by "List action" in pfBlocker i think.

                        1 Reply Last reply Reply Quote 0
                        • F
                          francisuk22
                          last edited by

                          Thanks for all the work!

                          Once thing i would like to share is my Mobile Broadband UK list as im badly getting targeted by them http://francisuk22.webspace.virginmedia.com/ukmobilebroadband.txt this hopefully will keep the mobile hackers out! (Please note this might only work for UK and Ireland but im just in the middle of getting my webhost up and running so ill share it asap from another webserver.

                          EE UK (Including: EE, Orange and T-Mobile)
                          O2 UK
                          Vodafone UK
                          3 UK

                          Please choose "Deny_Inbound" by "List action (Deny Inbound Will deny access from selected lists to your network) as for some reason Google blocked but ill look into this more over the weekend :)

                          Also malware patrol is a free, automated and user contributed system for checking URLs for the presence of Viruses, Trojans, Worms, or any other software considered Malware. The list is available in 29 formats. If you need another format please let us know

                          http://www.malware.com.br/cgi/submit?action=list

                          Works but what is it picking up?

                          Another useful website :) http://www.selectrealsecurity.com/public-block-lists

                          2.0.2-RELEASE (amd64) - Dell OptiPlex GX520 SFF @ Intel P4 HT 3.0GHz
                          Cisco SR224 24-port Switch (4 PCs, 1 Wireless AP, 2 Consoles)

                          1 Reply Last reply Reply Quote 0
                          • F
                            francisuk22
                            last edited by

                            More list's if interested to you

                            http://www.stopforumspam.com (need to upload to an External webserver)
                            http://www.nothink.org/honeypots.php (very useful for Malware, SSH, IRC)
                            http://www.okean.com/thegoods.html (fed up with the amount of spam from Chinese and Korean? This will keep them out!)

                            2.0.2-RELEASE (amd64) - Dell OptiPlex GX520 SFF @ Intel P4 HT 3.0GHz
                            Cisco SR224 24-port Switch (4 PCs, 1 Wireless AP, 2 Consoles)

                            1 Reply Last reply Reply Quote 0
                            • S
                              S_D
                              last edited by

                              Hi there,

                              I think I've an issue with pfBlocker, when used with a IPv6 tunnel and a DHCP IPv4 WAN address:

                              http://forum.pfsense.org/index.php/topic,60146.0.html

                              Could anyone please offer any thoughts on this?

                              Many thanks,

                              Simon

                              1 Reply Last reply Reply Quote 0
                              • E
                                elterrible
                                last edited by

                                @elterrible:

                                one of linuxtracker's lists (alias only, with corresponding firewall rules) is set to update every day.

                                30   12   *   *   0,2,4   root   /usr/bin/nice -n20 /etc/rc.update_urltables

                                Mar 10 12:30:42 php: : /etc/rc.update_urltables: pfBlockerp2p does not need updated.
                                Mar 10 12:30:42 php: : /etc/rc.update_urltables: Starting URL table alias updates
                                Mar 10 12:30:01 php: : /etc/rc.update_urltables: Sleeping for 41 seconds.
                                Mar 10 12:30:01 php: : /etc/rc.update_urltables: Starting up.

                                i ran a few tests with dropbox and some random ip addresses.  pfblocker doesnt seem to be updating after it initially pulls the ip's from the list.  any ideas?  thanks.

                                1 Reply Last reply Reply Quote 0
                                • marcellocM
                                  marcelloc
                                  last edited by

                                  @elterrible:

                                  i ran a few tests with dropbox and some random ip addresses.  pfblocker doesnt seem to be updating after it initially pulls the ip's from the list.  any ideas?  thanks.

                                  IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

                                  Treinamentos de Elite: http://sys-squad.com

                                  Help a community developer! ;D

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    traxxus
                                    last edited by

                                    Are the "Top spammers" list also automatically updatet  ???
                                    I ask because i can't define an update interval.

                                    And what's the "source" of the list for the "Top spammers"?

                                    1 Reply Last reply Reply Quote 0
                                    • marcellocM
                                      marcelloc
                                      last edited by

                                      @traxxus:

                                      Are the "Top spammers" list also automatically updatet  ???

                                      Since blocklists got paid, there is no update anymore.

                                      Treinamentos de Elite: http://sys-squad.com

                                      Help a community developer! ;D

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        fragged
                                        last edited by 

                                        
Crash report begins.  Anonymous machine information:

amd64
8.3-RELEASE-p7
FreeBSD 8.3-RELEASE-p7 #1: Thu Apr  4 13:16:33 EDT 2013     root@snapshots-8_3-amd64.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262

                                        I keep getting this error report all the time on 2.1 for the past month or so. Nothing interesting going on in the system log.

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          elterrible
                                          last edited by

                                          @marcelloc:

                                          IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

                                          you're right, but looking at the logs, it seems like the rc.update_urltables script is the one invoking the update.  it just never updates, for whatever reason.

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            traxxus
                                            last edited by

                                            @marcelloc:

                                            @traxxus:

                                            Are the "Top spammers" list also automatically updatet  ???

                                            Since blocklists got paid, there is no update anymore.

                                            Could you implement another source? I mean the top spammers list is useless if no updates are available.

                                            This one:
                                            http://ipinfodb.com/ip_country_block.php#blocklist

                                            There also directlinks available. China for example:
                                            http://ipinfodb.com/country_query.php?country=CN&output=simple&filename=blocklist.txt

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post