PfBlocker

francisuk22

More list's if interested to you

http://www.stopforumspam.com (need to upload to an External webserver)
http://www.nothink.org/honeypots.php (very useful for Malware, SSH, IRC)
http://www.okean.com/thegoods.html (fed up with the amount of spam from Chinese and Korean? This will keep them out!)

S_D

Hi there,

I think I've an issue with pfBlocker, when used with a IPv6 tunnel and a DHCP IPv4 WAN address:

http://forum.pfsense.org/index.php/topic,60146.0.html

Could anyone please offer any thoughts on this?

Many thanks,

Simon

elterrible

@elterrible:

one of linuxtracker's lists (alias only, with corresponding firewall rules) is set to update every day.

30 12 * * 0,2,4 root /usr/bin/nice -n20 /etc/rc.update_urltables

Mar 10 12:30:42 php: : /etc/rc.update_urltables: pfBlockerp2p does not need updated.
Mar 10 12:30:42 php: : /etc/rc.update_urltables: Starting URL table alias updates
Mar 10 12:30:01 php: : /etc/rc.update_urltables: Sleeping for 41 seconds.
Mar 10 12:30:01 php: : /etc/rc.update_urltables: Starting up.

i ran a few tests with dropbox and some random ip addresses. pfblocker doesnt seem to be updating after it initially pulls the ip's from the list. any ideas? thanks.

marcelloc

@elterrible:

i ran a few tests with dropbox and some random ip addresses. pfblocker doesnt seem to be updating after it initially pulls the ip's from the list. any ideas? thanks.

IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

traxxus

Are the "Top spammers" list also automatically updatet ???
I ask because i can't define an update interval.

And what's the "source" of the list for the "Top spammers"?

marcelloc

@traxxus:

Are the "Top spammers" list also automatically updatet ???

Since blocklists got paid, there is no update anymore.

fragged


Crash report begins.  Anonymous machine information:

amd64
8.3-RELEASE-p7
FreeBSD 8.3-RELEASE-p7 #1: Thu Apr  4 13:16:33 EDT 2013     root@snapshots-8_3-amd64.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262

I keep getting this error report all the time on 2.1 for the past month or so. Nothing interesting going on in the system log.

elterrible

@marcelloc:

IIRC, there is a pfblocker php script for list update running on cron if you define a update schedule.

you're right, but looking at the logs, it seems like the rc.update_urltables script is the one invoking the update. it just never updates, for whatever reason.

traxxus

@marcelloc:

@traxxus:

Are the "Top spammers" list also automatically updatet ???

Since blocklists got paid, there is no update anymore.

Could you implement another source? I mean the top spammers list is useless if no updates are available.

This one:
http://ipinfodb.com/ip_country_block.php#blocklist

There also directlinks available. China for example:
http://ipinfodb.com/country_query.php?country=CN&output=simple&filename=blocklist.txt

godbolt

This is a great package. Very useful. My apologies in advance if this has already been answered, but I was just wondering exactly what the packets column in the dashboard widget was. It seems to count up for a while then rest to zero. Is it packets dropped per hour or per day?

fragged

The package count zero's on filter reload if my memory serves me right. Could be some other regularly happening event also.

traxxus

Same here. Package count goes back to zero in dashboard widget. Don't know when or why.

kilthro

When ever you filter reload or package updates anything that soft refreshes will reset it back to 0 as the interface resets.. same thing will happen changing network settings… I have never seen the widget reset on its own without either changing system setting/network setting/updates ect.

godbolt

Thanks for the reply. Filter reload explains it. Every once and a while I change some rules. I guess I just didn't notice the connection.

Cino

@fragged:


Crash report begins.  Anonymous machine information:

amd64
8.3-RELEASE-p7
FreeBSD 8.3-RELEASE-p7 #1: Thu Apr  4 13:16:33 EDT 2013     root@snapshots-8_3-amd64.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262
 in /usr/local/pkg/pfblocker.inc on line 262

I keep getting this error report all the time on 2.1 for the past month or so. Nothing interesting going on in the system log.

I've had the same issue for the past couple of months. I haven't dug deeper to see if it causing any problems

thebiznes

New to pfblocker had used country blocker earlier before moving to untangle.

New to software routers although have been running a untangle box for some time, but I wanted the flexibility of routing with pfsense and filtering with Untangle in Bridge mode. Also I wanted squid for web caching as it's paid option in Untangle so I have them working in ESXI and virtual box. The performance is much better in esxi though.

The problem I have with pfblocker is that I can't block on inbound the default without selecting block on both. The rule in the firewall just doesn't appear and the dashboard widget just displays a red down arrow. Which I take as not on.

The only way to get some of the functionality is either block both or permit outbound. Please could someone clarify exactly what "permit outbound" this means.

1/ Does this as I have read, allow user to get to sites on the list, but block incoming traffic by default?

2/ Any ideas why I can't block inbound traffic without selecting both. I have it set on Wan inbound and Lan outbound?

3/ With one of the list an ads one. With block both it actually stops my email service. I can see the IP in the list. Is there a way to whitelist that IP to allow?

Because of my lack of understanding of this package. Should I just resort back to the country block part and forego the lists?

Probably a question to myself the last one, but if it protects then it would be a nice feature to use.

Lists I am using Level1, Level2, Level3 Ads, Edu, Spyware, Hacked and Dshield and top spammers.

Any advice would be appreciated :)

fragged

pfBlocker doesn't add any inbound rules for interfaces with no allow rules as there's a default deny all rule in place.

thebiznes

I meant when selecting pfblocker I cant use block inbound the default as stated on the page without the dashboard widget showing down and the firewall rules showing nothing there also. The only way I can get any thing working is block both inbound and outbound and Permit outbound.

The packets are they attempts? The ad one seems to draw more traffic to the firewall especially in permit outbound. For the minute I have disabled pfblocker until I can understand it's workings.

fragged

The package simply adds firewall rules based on your settings. That's all. I have no idea how the widget works for the status arrows, but the numbers are blocked connections matching any IP in that particular list. You can enable logging for the pfBlocker rules to see what it does on the System -> Firewall log.

In short, check firewall rules and log instead of the widget for what is actually going on.

marcelloc

@fragged:

That's all. I have no idea how the widget works for the status arrows,

It ckecks based on description rules applied to rules, if you have an alias with no rules, it will show as down. If you have rules applied to aliases, then it will show up and get the couter hit from pf.