PfBlocker

marcelloc

@lpallard:

There is an exclusion list in squidguard and a "whitelist" in snort so what can I do in pfblocker ???

You can create an exception list and allow it on blocker.

or

Change pfblocker action to alias only and create you own rules and aliases the way you need.

pftdm007

[quote]You can create an exception list and allow it on blocker.[/quote]

OK I figured out that you could create an exception list just as it was possible to create custom blocking lists..  But what confuses me is that these choices are the only ones available:

[code]Note:
'Deny Both' - Will deny access on Both directions.
'Deny Inbound' - Will deny access from selected lists to your network.
'Deny Outbound' - Will deny access from your users to ip lists you selected to block.
'Permit Inbound' - Will allow access from selected lists to your network.
'Permit Outbound' - Will allow access from your users to ip lists you selected to block.
'Disabled' - Will just keep selection and do nothing to selected Lists.
'Alias Only' - Will create an alias with selected Lists to help custom rule assignments.[/code]

Deny Both - I understand this will block the traffic TO & FROM the IP's so this is totally the opposite to what I want to do.
Deny Inbound - Unless I dont understand, accessing websites requires both inbound & outbound so if I block incoming traffic, the sites wont work.
Deny Outbound - Again unless I dont understand, accessing websites requires both inbound & outbound so if I block outgoing traffic, the sites wont work.
Disabled - Useless for my scenario..
Alias Only - I have no clue about this one.  Will read some documentation soon, or better maybe buy the pfsense book.

So I am left with only these two options but each of them does only half of the job, that is, allow traffic in either direction.  So to combine them, do I need to duplicate my list, in one of them I select Permit outbound, and the other one I select permit inbound?

Permit Inbound
Permit Outbound

Shouldnt the choice Permit both be present in the dropdown list??

marcelloc

Hi,

traxxus has suggested moving pfblocker old country lists to one free list http://www.ipdeny.com/ipblocks/

I can do it on my free time but if somebody needs it faster, consider donating to speed up new package versions.

att,
Marcello Coutinho

ttblum

Hello,

I have had two routers running pfBlocker that, when booted after a power outage, all inside hosts have lost internet access after the router came back up.

I can reproduce this on a test router, so far with the following conditions:

pfSense nanobsd version 2.0.3
pfBlocker version 1.0.2
WAN: Static IP
Gateway monitoring: disabled

If the internet connection to the router is severed before bootup (without losing link light), then no traffic from the inside is allowed to go through the router (even if internet connectivity is restored to the router after bootup). An attempted connection to yahoo.com looks like:

tcp 98.139.183.24:80 <- 192.168.1.100:51349 CLOSED:SYN_SENT
tcp 192.168.1.100:51349 -> 98.139.183.24:80 SYN_SENT:CLOSED

No traffic from the inside is shown as being blocked in the firewall logs.

The following is logged on bootup:

Jun 3 09:45:37 php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerTopSpammers.txt.tmp' 'https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerTopSpammers'' returned exit code '1', the output was 'fetch: transfer timed out'
Jun 3 09:45:32 php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' 'https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerSouthAmerica'' returned exit code '1', the output was 'fetch: transfer timed out'
Jun 3 09:45:27 php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerAsia.txt.tmp' 'https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerAsia'' returned exit code '1', the output was 'fetch: transfer timed out'
Jun 3 09:45:22 php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerAfrica.txt.tmp' 'https://127.0.0.1:443/pfblocker.php?pfb=pfBlockerAfrica'' returned exit code '1', the output was 'fetch: transfer timed out'
Jun 3 09:49:21 php: : Restarting/Starting all packages.
Jun 3 09:49:21 php: : No pfBlocker action during boot process.
Jun 3 09:49:21 php: : No pfBlocker action during boot process.
Jun 3 09:49:21 php: : No pfBlocker action during boot process.
Jun 3 09:49:21 php: : No pfBlocker action during boot process.

justsomeguy6575

I can't get pfblocker to load this list doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt

Has anyone used this list before?

pftdm007

I recently added new lists in pfblocker. Immediately, pfsense started displaying errors in yellow at the top of the window:


[filter_load]There were error(s) loading the rules:

/tmp/rules.debug:151: macro pfBlockerpfblockerallowed not defined/tmp/rules.debug:151: syntax error
/tmp/rules.debug:159: macro pfBlockeresurveillance not defined/tmp/rules.debug:159: syntax error
/tmp/rules.debug:160: macro pfBlockerdropedrop not defined
/tmp/rules.debug:162: macro pfBlockerlevel1 not defined/tmp/rules.debug:162: syntax error
/tmp/rules.debug:172: macro pfBlockeresurveillance not defined/tmp/rules.debug:172: syntax error
/tmp/rules.debug:173: macro pfBlockerdropedrop not defined/tmp/rules.debug:175: macro pfBlockerlevel1 not defined
/tmp/rules.debug:175: syntax errorpfctl: Syntax error in config file: pf rules not loaded The line in question reads [151]: pass in log quick on $WAN reply-to ( re0 WAN-IP ) from $pfBlockerpfblockerallowed to any keep state label USER_RULE: pfBlockerpfblockerallowed auto rule

What happens?

marcelloc

@lpallard:

What happens?

Maybe something with the list that pfblocker code could not detect or get around.

pftdm007

@marcelloc:

@lpallard:

What happens?

Maybe something with the list that pfblocker code could not detect or get around.

Do you need something specific to help debugging? Logs?
I didnt do anything out of the ordinary so I think this shouldnt happen unless the package was in beta stage which is not.

marcelloc

Did you removed pfblocker lists before deleting custom firewall rules?

pf is complaining about 4 missing aliases.

justsomeguy6575

@justsomeguy6575:

I can't get pfblocker to load this list doc.emergingthreats.net/pub/Main/RussianBusinessNetwork/RussianBusinessNetworkIPs.txt

Has anyone used this list before?

Any ideas on this list? Also pfsense says it detected a crash and this is the info it contains:

Crash report begins. Anonymous machine information:

i386
8.3-RELEASE-p8
FreeBSD 8.3-RELEASE-p8 #1: Tue Jun 11 06:34:27 EDT 2013 root@snapshots-8_3-i386.builders.pfsense.org:/usr/obj.pfSense/usr/pfSensesrc/src/sys/pfSense_SMP.8

Crash report details:

PHP Errors:
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262
in /usr/local/pkg/pfblocker.inc on line 262

Filename: /var/crash/minfree
2048

ttblum

Hi, I meant to add that this only happens when pfBlocker is installed and active.

I have had two routers running pfBlocker that, when booted after a power outage, all inside hosts have lost internet access
after the router came back up.

NextPerception

I have searched around for an answer but I apologize if this has been answered elsewhere. My google-fu sometimes fails me.
I am trying to set pfblocker so that it's rules apply for all ports except a few that I have manually NATed. I can accomplish this beautifully for a short while by moving the selected firewall rules that are linked to my NAT entries higher in the rules list than the automatically generated pfblocker rules. This unfortunately then reverts back a few hours later to having the pfblocker rules at the top of the list again. I suspect it is reverting when pfblocker updates it's lists. Is there a way to either
1. Keep the selected NAT rules above the pfblocker auto generated rules even after pfblocker updates or
2. Have pfblocker ignore certain ports or
3. Accomplish my desired behavior a different way?

Thanks in advance!

Edit: Also, all these rules are in the WAN tab

Deadringers

Just a quick question on this..

with the block list I can see countries like china trying to send me spam emails (from looking at the logs).
And that's great! :)

But if I browse to a Chinese website does this mean that the pfblocker package won't block it as it has been initiated by myself?

zenny

Hi:

This is an excellent package. Thanks to developers for their hard work. BTW, I am encoutering the following:

06-24-13 10:33:54 [ There were error(s) loading the rules: /tmp/rules.debug:26: table name too long, max 31 chars - The line in question reads [26]: table persist file /var/db/aliastables/pfBlockerspamhausdshieldiblocklist.txt]
06-24-13 10:37:47 [ There were error(s) loading the rules: /tmp/rules.debug:28: table name too long, max 31 chars - The line in question reads [28]: table persist file /var/db/aliastables/pfBlockerspamhausdshieldiblocklist.txt]

Which table is it referring to? And where to make changes?

fragged

@zenny:

Hi:

This is an excellent package. Thanks to developers for their hard work. BTW, I am encoutering the following:

06-24-13 10:33:54 [ There were error(s) loading the rules: /tmp/rules.debug:26: table name too long, max 31 chars - The line in question reads [26]: table persist file /var/db/aliastables/pfBlockerspamhausdshieldiblocklist.txt]
06-24-13 10:37:47 [ There were error(s) loading the rules: /tmp/rules.debug:28: table name too long, max 31 chars - The line in question reads [28]: table persist file /var/db/aliastables/pfBlockerspamhausdshieldiblocklist.txt]

Which table is it referring to? And where to make changes?

pfBlockerspamhausdshieldiblocklist.txt is probably too long of a name for the list to work.

zenny

@fragged:

@zenny:

Hi:

This is an excellent package. Thanks to developers for their hard work. BTW, I am encoutering the following:

06-24-13 10:33:54 [ There were error(s) loading the rules: /tmp/rules.debug:26: table name too long, max 31 chars - The line in question reads [26]: table persist file /var/db/aliastables/pfBlockerspamhausdshieldiblocklist.txt]
06-24-13 10:37:47 [ There were error(s) loading the rules: /tmp/rules.debug:28: table name too long, max 31 chars - The line in question reads [28]: table persist file /var/db/aliastables/pfBlockerspamhausdshieldiblocklist.txt]

Which table is it referring to? And where to make changes?

pfBlockerspamhausdshieldiblocklist.txt is probably too long of a name for the list to work.

Thanks. Changing alias to 'spammers' and rebooting worked (without a reboot, the config didn't reload, for developer's attention).

SkyNET

Hi Guys,

Quick question about pfBlocker regarding rules.
Under "Rules" there are all the pfblocker auto rules.

Its about when I change the order of blocking.
Lets say Subnet A is allowed to connect to asia and Subnet B is not. (See picture)

Every day, the rules are checked and reloaded, and Subnet A is set to the bottom of the list again.
So It does not have access to Asia any more. If I change it manually. This works fine for a couple of hours
until a filer or rule gets reloaded.

What can I do, so I don't have to change the order of the list everyday?
Hope the problem is clear. Thanks!

![LAN Rules.PNG](/public/imported_attachments/1/LAN Rules.PNG)
![LAN Rules.PNG_thumb](/public/imported_attachments/1/LAN Rules.PNG_thumb)

ttblum

I configured gateway monitoring, but it didn't seem to help.

When the internet connection came back up, the filter reloaded, but pfblocker still would not let traffic through:

Jul 1 07:39:53	syslogd: kernel boot file is /boot/kernel/kernel
...
Jul 1 07:39:58	php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerAfrica.txt.tmp' 'https://127.0.0.1:8443/pfblocker.php?pfb=pfBlockerAfrica'' returned exit code '1', the output was 'fetch: transfer timed out'
...
Jul 1 07:40:09	check_reload_status: Starting packages
Jul 1 07:40:09	php: : pfSense package system has detected an ip change -> ... Restarting packages.
Jul 1 07:40:14	php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' > '/var/db/aliastables/pfBlockerSouthAmerica.txt'' returned exit code '2', the output was ''
Jul 1 07:40:14	php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' 'https://127.0.0.1:8443/pfblocker.php?pfb=pfBlockerSouthAmerica'' returned exit code '1', the output was 'fetch: transfer timed out'
Jul 1 07:40:14	php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' > '/var/db/aliastables/pfBlockerSouthAmerica.txt'' returned exit code '2', the output was ''
Jul 1 07:40:14	php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' 'https://127.0.0.1:8443/pfblocker.php?pfb=pfBlockerSouthAmerica'' returned exit code '1', the output was 'fetch: transfer timed out'
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : Restarting/Starting all packages.
...
Jul 1 07:42:16	php: : OpenNTPD is starting up.
Jul 1 07:42:16	php: : The command '/usr/bin/killall 'ntpd'' returned exit code '1', the output was 'killall: warning: kill -TERM 26134: No such process'
Jul 1 07:42:16	php: : There were error(s) loading the rules: no IP address found for grep: /tmp/rules.debug:18: file "/var/db/aliastables/pfBlockerAfrica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:20: file "/var/db/aliastables/pfBlockerAsia.txt" contains bad data no IP address found for grep: /tmp/rules.debug:22: file "/var/db/aliastables/pfBlockerEurope.txt" contains bad data no IP address found for grep: /tmp/rules.debug:24: file "/var/db/aliastables/pfBlockerSouthAmerica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:26: file "/var/db/aliastables/pfBlockerTopSpammers.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [ /tmp/rules.debug]:
Jul 1 07:42:17	check_reload_status: Restarting ipsec tunnels
Jul 1 07:42:27	php: : Creating rrd update script
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : Restarting/Starting all packages.
Jul 1 07:42:33	php: : IPSEC: One or more IPsec tunnel endpoints has changed its IP. Refreshing.
Jul 1 07:42:33	check_reload_status: Reloading filter
Jul 1 07:42:34	login: login on console as root
Jul 1 07:42:41	php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was 'no IP address found for grep: /tmp/rules.debug:18: file "/var/db/aliastables/pfBlockerAfrica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:20: file "/var/db/aliastables/pfBlockerAsia.txt" contains bad data no IP address found for grep: /tmp/rules.debug:22: file "/var/db/aliastables/pfBlockerEurope.txt" contains bad data no IP address found for grep: /tmp/rules.debug:24: file "/var/db/aliastables/pfBlockerSouthAmerica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:26: file "/var/db/aliastables/pfBlockerTopSpammers.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded'
...

Hi, I meant to add that this only happens when pfBlocker is installed and active.

I have had two routers running pfBlocker that, when booted after a power outage, all inside hosts have lost internet access
after the router came back up.

iamzam

After posting a message about pfblocker not reinstalling in the 2.1 snapshot area I found this thread so I guess I'll just post a link to it here

http://forum.pfsense.org/index.php/topic,64312.0.html

Mr. Jingles

@SkyNET:

Hi Guys,

Quick question about pfBlocker regarding rules.
Under "Rules" there are all the pfblocker auto rules.

Its about when I change the order of blocking.
Lets say Subnet A is allowed to connect to asia and Subnet B is not. (See picture)

Every day, the rules are checked and reloaded, and Subnet A is set to the bottom of the list again.
So It does not have access to Asia any more. If I change it manually. This works fine for a couple of hours
until a filer or rule gets reloaded.

What can I do, so I don't have to change the order of the list everyday?
Hope the problem is clear. Thanks!

Change the Pfblocker auto generated lists to 'alias only', and then manually create a firewall rule for each alias. Thanks to dokternoter for pointing this out before to me ;D