PfBlocker

ttblum

I configured gateway monitoring, but it didn't seem to help.

When the internet connection came back up, the filter reloaded, but pfblocker still would not let traffic through:

Jul 1 07:39:53	syslogd: kernel boot file is /boot/kernel/kernel
...
Jul 1 07:39:58	php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerAfrica.txt.tmp' 'https://127.0.0.1:8443/pfblocker.php?pfb=pfBlockerAfrica'' returned exit code '1', the output was 'fetch: transfer timed out'
...
Jul 1 07:40:09	check_reload_status: Starting packages
Jul 1 07:40:09	php: : pfSense package system has detected an ip change -> ... Restarting packages.
Jul 1 07:40:14	php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' > '/var/db/aliastables/pfBlockerSouthAmerica.txt'' returned exit code '2', the output was ''
Jul 1 07:40:14	php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' 'https://127.0.0.1:8443/pfblocker.php?pfb=pfBlockerSouthAmerica'' returned exit code '1', the output was 'fetch: transfer timed out'
Jul 1 07:40:14	php: : The command '/usr/bin/grep -v '^#' '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' > '/var/db/aliastables/pfBlockerSouthAmerica.txt'' returned exit code '2', the output was ''
Jul 1 07:40:14	php: : The command '/usr/bin/fetch -T 5 -q -o '/var/db/aliastables/pfBlockerSouthAmerica.txt.tmp' 'https://127.0.0.1:8443/pfblocker.php?pfb=pfBlockerSouthAmerica'' returned exit code '1', the output was 'fetch: transfer timed out'
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : No pfBlocker action during boot process.
Jul 1 07:40:16	php: : Restarting/Starting all packages.
...
Jul 1 07:42:16	php: : OpenNTPD is starting up.
Jul 1 07:42:16	php: : The command '/usr/bin/killall 'ntpd'' returned exit code '1', the output was 'killall: warning: kill -TERM 26134: No such process'
Jul 1 07:42:16	php: : There were error(s) loading the rules: no IP address found for grep: /tmp/rules.debug:18: file "/var/db/aliastables/pfBlockerAfrica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:20: file "/var/db/aliastables/pfBlockerAsia.txt" contains bad data no IP address found for grep: /tmp/rules.debug:22: file "/var/db/aliastables/pfBlockerEurope.txt" contains bad data no IP address found for grep: /tmp/rules.debug:24: file "/var/db/aliastables/pfBlockerSouthAmerica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:26: file "/var/db/aliastables/pfBlockerTopSpammers.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [ /tmp/rules.debug]:
Jul 1 07:42:17	check_reload_status: Restarting ipsec tunnels
Jul 1 07:42:27	php: : Creating rrd update script
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : No pfBlocker action during boot process.
Jul 1 07:42:30	php: : Restarting/Starting all packages.
Jul 1 07:42:33	php: : IPSEC: One or more IPsec tunnel endpoints has changed its IP. Refreshing.
Jul 1 07:42:33	check_reload_status: Reloading filter
Jul 1 07:42:34	login: login on console as root
Jul 1 07:42:41	php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was 'no IP address found for grep: /tmp/rules.debug:18: file "/var/db/aliastables/pfBlockerAfrica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:20: file "/var/db/aliastables/pfBlockerAsia.txt" contains bad data no IP address found for grep: /tmp/rules.debug:22: file "/var/db/aliastables/pfBlockerEurope.txt" contains bad data no IP address found for grep: /tmp/rules.debug:24: file "/var/db/aliastables/pfBlockerSouthAmerica.txt" contains bad data no IP address found for grep: /tmp/rules.debug:26: file "/var/db/aliastables/pfBlockerTopSpammers.txt" contains bad data pfctl: Syntax error in config file: pf rules not loaded'
...

Hi, I meant to add that this only happens when pfBlocker is installed and active.

I have had two routers running pfBlocker that, when booted after a power outage, all inside hosts have lost internet access
after the router came back up.

iamzam

After posting a message about pfblocker not reinstalling in the 2.1 snapshot area I found this thread so I guess I'll just post a link to it here

http://forum.pfsense.org/index.php/topic,64312.0.html

Mr. Jingles

@SkyNET:

Hi Guys,

Quick question about pfBlocker regarding rules.
Under "Rules" there are all the pfblocker auto rules.

Its about when I change the order of blocking.
Lets say Subnet A is allowed to connect to asia and Subnet B is not. (See picture)

Every day, the rules are checked and reloaded, and Subnet A is set to the bottom of the list again.
So It does not have access to Asia any more. If I change it manually. This works fine for a couple of hours
until a filer or rule gets reloaded.

What can I do, so I don't have to change the order of the list everyday?
Hope the problem is clear. Thanks!

Change the Pfblocker auto generated lists to 'alias only', and then manually create a firewall rule for each alias. Thanks to dokternoter for pointing this out before to me ;D

SkyNET

@Hollander:

@SkyNET:

Hi Guys,

Quick question about pfBlocker regarding rules.
Under "Rules" there are all the pfblocker auto rules.

Its about when I change the order of blocking.
Lets say Subnet A is allowed to connect to asia and Subnet B is not. (See picture)

Every day, the rules are checked and reloaded, and Subnet A is set to the bottom of the list again.
So It does not have access to Asia any more. If I change it manually. This works fine for a couple of hours
until a filer or rule gets reloaded.

What can I do, so I don't have to change the order of the list everyday?
Hope the problem is clear. Thanks!

Change the Pfblocker auto generated lists to 'alias only', and then manually create a firewall rule for each alias. Thanks to dokternoter for pointing this out before to me ;D

Thanks for your help! It works like a charm now!! Description name is important to get it working.

doktornotor

While at it, it'd be awesome if the custom set up lists did update on reinstall after snapshot upgrade.

Hello,
Running pfblocker 1.0.2 on a CARP cluster. The sync tab appears to be broken. Changes in configuration are not carried over to the backup system. Neither are new lists added, old lists modified. Used both sync interface ip and admin interface ip. Logs show this:
Master:
php: : Filter sync successfully completed with https://192.168.xxx.xxx:x.
Slave:
nothing, just a bunch of dhcp and dnsmasq entries.

The sync tab on the master has the sync ticked, contains the ip of the backup system, and the password is correct.
The sync tab on the backup has the sync NOT ticked, and IP is blank.

Thanks

davidfine

It seems to think that 66.154.123.x is outside the USA, but it is with a hosting company in Los Angeles. Is this the right place to report this error?

Supermule

I think you need to find Marcello in here. I think he was one of the people behind PFblocker.

marcelloc

@davidfine:

It seems to think that 66.154.123.x is outside the USA, but it is with a hosting company in Los Angeles. Is this the right place to report this error?

The contry ip blocklist was updated until the list got paid. There are other free good country lists but I'm still having no time to change pfblocker code to use a new list.

I've asked for donations to speed up update process but had no luck with it.

You can also workaround it by creating a new list with this ip/range and allow ir on pfblocker. This will be applied before pfblocker deny rules.

kejianshi

Maybe a dumb question… Does pfblocker block everything from a country you designate or does it only block unsolicited traffic?

Supermule

Everything…

Supermule

Can we somehow track a specific IP and see what country CIDR it is attached to? I have a client that got blocked yesterday and I havent got a clue what country the IP is attached to?

kilthro

I dont know of an easy way of doing that besides searching the tables. However what I have done is identified the mistakenly blocked ip and added it to my allow list and all is good. Not the best solution but a work around so that they are not blocked.

doktornotor

@Supermule:

Can we somehow track a specific IP and see what country CIDR it is attached to? I have a client that got blocked yesterday and I havent got a clue what country the IP is attached to?

http://www.geoiptool.com/

zardoz

Hello, I've recently installed pfblocker and been trying it out. Unfortunately I'm getting this error.
This is just an FYI.

There were error(s) loading the rules: /tmp/rules.debug:25: cannot define table pfBlockerTopSpammers: Cannot allocate memory - The line in question reads [25]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

some details;
pfsense version: 2.1-RC0 (i386) built on Fri Jun 14 16:39:04 EDT 2013

machine has 4gb of ram, swap space is 2gb, roughly 2gb free.
Memory useage displays as 7% on dashboard.

pfBlocker was configured to deny in/out on wan/lan, all countries selected in topSpammers list.</pfblockertopspammers>

doktornotor

@zardoz:

pfBlocker was configured to deny in/out on wan/lan, all countries selected in topSpammers list.

You realize the blocklist is not even being updated any more? (Neither are the continent/country blocklists, AFAICT. No longer free.) All this cruft should be purged from pfBlocker.

zardoz

Does this mean that pfBlocker is not supported?

doktornotor

@zardoz:

Would it make sense to only have current supported packages available in pfSense?

The package itself is still perfectly fine for custom blocklists. Just in need of a diet to lose the predefined blocklists functionality that's not really useful any more. pfBlocker Light, anyone? :D

Head over to http://www.iblocklist.com/lists.php and pick your poison (P2P/GZ format is just fine for pfblocker.)

Important note: For the not really that much sane blocklists, you'll need to go to System - Advanced - Firewall/NAT and bump the "Firewall Maximum Table Entries" way up.

zardoz

thanks! I'll try out a list or two.

kilthro

@zardoz:

Hello, I've recently installed pfblocker and been trying it out. Unfortunately I'm getting this error.
This is just an FYI.

There were error(s) loading the rules: /tmp/rules.debug:25: cannot define table pfBlockerTopSpammers: Cannot allocate memory - The line in question reads [25]: table <pfblockertopspammers>persist file "/var/db/aliastables/pfBlockerTopSpammers.txt"

some details;
pfsense version: 2.1-RC0 (i386) built on Fri Jun 14 16:39:04 EDT 2013

machine has 4gb of ram, swap space is 2gb, roughly 2gb free.
Memory useage displays as 7% on dashboard.

pfBlocker was configured to deny in/out on wan/lan, all countries selected in topSpammers list.</pfblockertopspammers>

Did you go to system > advanced > firewall tab and increase Firewall Maximum Table Entries? if not increase that. Generally have to increase it quite a bit depending on all the lists you load. Mine is set to 999999999