Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved
    pfSense Packages
    143
    896
    1.1m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Mr. Jingles
      last edited by

      I am running into a problem, BB  :-\

      1. Remove "#" from line 471 ( countrycode ) , and save/exit the script.
      2. From the "Shell" run  [  [b]./pfiprep killdb  ]
      3. This should download the Maxmind Country Code .zip file and automatically extract the .csv country Code Database.
      4. It will create a file called "countrycode" which is a list of all the countries.
      5. On First Install, the script will exit and ask you to edit the "countrycode" file.
      6. Put a "#" infront of the countries to whitelist.

      The file is created, but nothing is in it (zero bytes). The script issued this:

      
  [2.1.4-RELEASE][root@112]/home/badips(9): ./pfiprep killdb

**** UPDATE PROCESS START -  Sat Jul 26 17:13:39 CEST 2014  ****

 Deleting pfIP Rep Databases.

Databases have been Deleted!

find: /home/badips/countrycodes: No such file or directory
rm: /home/badips/cc_csv.lock: No such file or directory
find: /home/badips/GeoIPCountryWhois.csv: No such file or directory
rm: /home/badips/cc_csv.lock: No such file or directory
looking up geolite.maxmind.com
connecting to geolite.maxmind.com:443
SSL connection established using RC4-SHA
Certificate subject: /serialNumber=dfgdighiofgiodfiogdiofgdjkfq4Js/C=US/O=*.maxmind.com/OU=GT53364002/OU=See www.rap112sl.com/resources/cps (c)11/OU=Domain Control Validated - Rap112SL(R)/CN=*.maxmind.com
Certificate issuer: /C=US/O=GeoTrust, Inc./CN=Rap112SL CA
requesting https://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip
remote size / mtime: 1444832 / 1404267648

/home/badips/GeoIPCountryCSV.zip              100% of 1410 kB  164 kBps

unzip:  cannot find or open /home/badipsGeoIPCountryCSV.zip, /home/badipsGeoIPCountryCSV.zip.zip or /home/badipsGeoIPCountryCSV.zip.ZIP. 

cut: /home/badips/GeoIPCountryWhois.csv: No such file or directory

Please edit [ /home/badips/countrycodes ] and comment # the countries to  SAFELIST  before proceeding with CC Blocking

[2.1.4-RELEASE][root@112]/home/badips(10):

      (I scrambled that serial number there since I don't know if it should be pasted here).

      What should I do?

      Thank you  ;D

      6 and a half billion people know that they are stupid, agressive, lower life forms.

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        Hi Hollander, Looks like I missed a "/",

        In pfiprepman, Line 416

        **    $pathunzip -o $userfolder$infile**

        change it to:

        $pathunzip -o $userfolder/$infile

        Sorry about that.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • K
          kenshirothefist
          last edited by

          @kenshirothefist:

          First of all, pfBlocker is a great package, cheers to the authors! However, it would be very useful (some users already highlighted this) to have more options for "Update frequency". Specifically I would like to see one very short and one longer frequency, like "Every 10 Minutes" and "Once a week". Could you add this?

          And just out of curiosity, how is this updating handled, I don't see any crontab entry for pfBlocker?

          Any comments on this?

          Also, I would like to ask you if there is any way to manually update the list? Thanks!

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @kenshirothefist:

            @kenshirothefist:

            First of all, pfBlocker is a great package, cheers to the authors! However, it would be very useful (some users already highlighted this) to have more options for "Update frequency". Specifically I would like to see one very short and one longer frequency, like "Every 10 Minutes" and "Once a week". Could you add this?

            And just out of curiosity, how is this updating handled, I don't see any crontab entry for pfBlocker?

            Any comments on this?

            Also, I would like to ask you if there is any way to manually update the list? Thanks!

            When you enable pfBlocker, it creates a cron entry

            0 * * * * root /usr/local/bin/php /usr/local/www/pfblocker.php cron

            The way pfBlocker works is it looks to see if there is an existing file in the:

            /usr/local/pkg/pfblocker (folder) for the Blocklist. If its there, it will reload the existing file. If its not there, it will download the file from the URL you entered for the Blocklist. When the CRON job runs, if the list is scheduled to be updated, that file is deleted so that it will download a new file.

            So the only way to do that is to manually delete the Blocklist file in that folder. Unfortunately, the file is named after the MD5 hash of the URL making it a little difficult to see which file belongs to which Blocklist.

            You could try running this command from the shell to determine what the md5 Hash is and than seeing if a file exists with that hash.txt and delete it. Than you can click "Save" in pfBlocker which should re-download the new file.

            md5 -s 'http://www.spamhaus.org/drop/drop.txt'

            MD5 ("http://www.spamhaus.org/drop/drop.txt") = d2278c81b67d798693429e4feb04a83a

            http://www.freebsd.org/cgi/man.cgi?query=md5&sektion=1

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • L
              LinuxTracker
              last edited by

              @BBcan177:

              The Country Database in pfBlocker hasn't been updated for over 2 years now. The data is obsolete.

              I've been recently looking at this and found we have 2 issues.
              One is the out of date IP ranges, which you know about.
              The other is a few ISO country codes probably need to be updated.

              @BBcan177:

              I know they are working on a new service (most likely for paid members) that will provide updates for the Country Lists.

              I guess it's been a couple of years since CountryIPBlocks went to pay-for-play.

              Back then, marcelloc and I both reached out to the CIPB guy and tried to work out a compromise that would allow pfBlocker to keep updating from CIPB.

              CIPB's compromise was that each pfBlocker user would pay CIPB for it's repackaged public data.
              That didn't seem like much of a compromise so here we are.

              Anyhoo:
              I've  found a source of current country IP data yesterday and wrote a short Bash script to push it into pfBlocker.
              It looks good but while cross-checking the data I found pfBlocker has a couple of outdated country (ISO 3166-1 alpha-2) codes.

              Also - I still want to find+vet a couple more data sources.
              I'll post what I come up with and we'll see what everyone thinks.

              Thanks

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                @LinuxTracker:

                I've  found a source of current country IP data yesterday and wrote a short Bash script to push it into pfBlocker.
                It looks good but while cross-checking the data I found pfBlocker has a couple of outdated country (ISO 3166-1 alpha-2) codes.

                Also - I still want to find+vet a couple more data sources.
                I'll post what I come up with and we'll see what everyone thinks.

                Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.

                I have also release a script to utilize country Blocking:
                https://forum.pfsense.org/index.php?topic=78062.15

                Would be interested to see what you have come up with.

                Maybe you can PM me a copy? Would also be interested in helping getting it off the ground.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • L
                  LinuxTracker
                  last edited by

                  @BBcan177:

                  Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.

                  That was the site that had a .CSV file of IPs in ranges, right?
                  I think I saw somewhere in the thread that pfBlocker will work with ranges - something I didn't know.

                  However, I prefer working w/ CIDR (I'd explain why if anyone cares) and am looking at CIDR sources right now.

                  I'll give another look at Maxmind GeoIP if my 'Plan A' doesn't work out.

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @LinuxTracker:

                    @BBcan177:

                    Did you take a look at the Maxmind GeoIP Country List. ~98% accurate.

                    That was the site that had a .CSV file of IPs in ranges, right?
                    I think I saw somewhere in the thread that pfBlocker will work with ranges - something I didn't know.

                    However, I prefer working w/ CIDR (I'd explain why if anyone cares) and am looking at CIDR sources right now.

                    I'll give another look at Maxmind GeoIP if my 'Plan A' doesn't work out.

                    Here is a sample.

                    Its all in one file, and its not too hard to convert to CIDR and break it down in the XX Country Codes with some grep and awk commands.

                    "223.255.128.0","223.255.191.255","3758063616","3758079999","HK","Hong Kong"
                    "223.255.192.0","223.255.223.255","3758080000","3758088191","KR","Korea, Republic of"
                    "223.255.224.0","223.255.231.255","3758088192","3758090239","ID","Indonesia"
                    "223.255.232.0","223.255.235.255","3758090240","3758091263","AU","Australia"
                    "223.255.236.0","223.255.239.255","3758091264","3758092287","CN","China"
                    "223.255.240.0","223.255.243.255","3758092288","3758093311","HK","Hong Kong"
                    "223.255.244.0","223.255.247.255","3758093312","3758094335","IN","India"
                    "223.255.252.0","223.255.253.255","3758095360","3758095871","CN","China"
                    "223.255.254.0","223.255.254.255","3758095872","3758096127","SG","Singapore"
                    "223.255.255.0","223.255.255.255","3758096128","3758096383","AU","Australia"

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • L
                      LinuxTracker
                      last edited by

                      @BBcan177:

                      @LinuxTracker:

                      That was the site that had a .CSV file of IPs in ranges, right?

                      Here is a sample.
                      Its all in one file, and its not too hard to convert to CIDR and break it down in the XX Country Codes with some grep and awk commands.
                      "223.255.128.0","223.255.191.255","3758063616","3758079999","HK","Hong Kong"
                      "223.255.192.0","223.255.223.255","3758080000","3758088191","KR","Korea, Republic of"
                      "223.255.224.0","223.255.231.255","3758088192","3758090239","ID","Indonesia"
                      "223.255.232.0","223.255.235.255","3758090240","3758091263","AU","Australia"
                      "223.255.236.0","223.255.239.255","3758091264","3758092287","CN","China"

                      Your data source seems more trustworthy than what I've found.

                      I'll PM you the script to d/l+extract the country IPs into .txt files as soon as I puzzle it out.

                      1 Reply Last reply Reply Quote 0
                      • K
                        kevin067
                        last edited by

                        Hi, does anybody know what triggers the reset of the pfBlocker's dashboard packet count? It would be much more useful if it only cleared when I clear the counter. Right now it just seems to clear the packet count randomly.

                        Thanks,
                        Kevin

                        1 Reply Last reply Reply Quote 0
                        • C
                          Cino
                          last edited by

                          anything that reloads your rules/filter will do it.  look for check_reload_status: Syncing firewall in your system log

                          1 Reply Last reply Reply Quote 0
                          • marcellocM
                            marcelloc
                            last edited by

                            HI, for those who want to test an updated country list from a new source before I try to update it on package install, follow these steps on console

                            
cd /usr/local/pkg
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Africa_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Asia_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Europe_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/North_America_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/Oceania_cidr.txt
/usr/bin/fetch http://e-sac.siteseguro.ws/pfsense/pfblocker/South_America_cidr.txt
php /usr/local/www/pfblocker.php uc

                            After this, access pfblocker gui and save config again.

                            You can check applied networks/cidrs on diagnostics -> tables

                            Treinamentos de Elite: http://sys-squad.com

                            Help a community developer! ;D

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              @marcelloc:

                              HI, for those who want to test an updated country list from a new source before I try to update it on package install, follow these steps on console

                              Hi Marcello,

                              This updates correctly. What is the source of the Country code files if you don't mind sharing?

                              Thanks.

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • T
                                tommyboy180
                                last edited by

                                I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

                                ipblocklist
                                HOLD - cidr
                                dashboard HUD
                                Remove IPFW Flush
                                Complete - ensure /usr/local/pkg/pf/ .sh is removed
                                Complete - whitelists on reboot
                                Complete - logging doesn't stay enabled when you click save/update
                                Complete - remove unique -u to just unique
                                Complete - remove warning from GUI
                                Complete - add lvl1 by default
                                Complete - change description to use the phrase peerblock
                                Complete - remove "ipfw -f flush" commands from php and uninstall process.
                                Complete - setenv PACKAGESITE "ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-8-stable/Latest/" before pkg_add -r "package"
                                Complete - pkg_add -r p5-NET-CIDR p5-Net-CIDR-0.14 CURRENT
                                Complete - pkg_add -r perl    perl-5.10.1_1    TO  perl-5.12.4_2
                                Complete - don't uninstall perl and p5-cidr-net at uninstall

                                countryblock
                                Complete - ensure /usr/local/pkg/pf/ .sh is removed
                                Complete - update CIDR.php file
                                Complete - Remove Email
                                Remove IPFW Flush

                                strikeback
                                auto start
                                auto settings (root user)

                                ideas:
                                hybrid ipblockist and countryblock. Tab seperate the roles.  one package - one stop shop. Name: Layer3 Shield or Layer3 Filter or Security
                                iplocklist and countryblock redirection on outbound if going to blocked ip's!!!

                                This note is dated 2010!

                                -Tom Schaefer
                                SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                Please support pfBlocker | File Browser | Strikeback

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @tommyboy180:

                                  I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

                                  This note is dated 2010!

                                  If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker.  :)

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Can't imagine anyone would be intested in that.  ;)
                                    Oh wait….

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kilthro
                                      last edited by

                                      @stephenw10:

                                      Can't imagine anyone would be intested in that.  ;)
                                      Oh wait….

                                      rofl

                                      @BBcan177:

                                      @tommyboy180:

                                      I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

                                      This note is dated 2010!

                                      If you guys are interested I have a working BETA for pfBlocker that incorporates features that lots of us would like to see in a new release of pfBlocker.  :)

                                      Please share. :-D  I would love to see this package get a facelift and some TLC. Besides Snort this is one of the must have packages imo.

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kilthro
                                        last edited by

                                        @tommyboy180:

                                        I was just going through some notes on pfblocker. This brought back some memories. I thought I would share with you guys since it's apart of the pfblocker past.

                                        This note is dated 2010!

                                        /gasp!

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          They say a Picture is worth a 1000 words, so I will post 4 pics.

                                          I have a few fellow members currently helping to Beta test the code. So far so good. I would like to change the behavior of the Rules Creation and the Loading of the Tables in my next round of changes to the pfBlocker Code.

                                          Any programming help would also be appreciated to help expedite the process….  ;)

                                          Link to the pfBlocker (General Tab)
                                                http://imgur.com/h0708WP

                                          Link to the pfBlocker (Reputation Tab)
                                                http://imgur.com/9AGK95V

                                          Link to the pfBlocker (LISTS Tab)
                                                http://imgur.com/4Wgq4sk

                                          Link to the pfBlokcer (LOG Tab)
                                                http://imgur.com/SNQ85RT

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • panzP
                                            panz
                                            last edited by

                                            I can't load any list into pfBlocker that is bigger than 10 MB: it crashes with an out if memory error, even if I choose the Alias creation.

                                            pfSense 2.3.2-RELEASE-p1 (amd64)
                                            motherboard: MSI C847MS-E33 Micro ATX (with Intel Celeron CPU 847 @ 1.10 GHz) ~ PSU: Corsair VS350 ~ RAM: Kingston KVR1333D3E9S 4096 MB 240-pin DIMM DDR3 SDRAM 1.5 volt ~ NIC: Intel EXPI9301CTBLK (LAN) ~ NIC: D-Link DFE-528TX (CAM) ~ Hard Disk: Western Digital WD10JFCX Red ~ Case: Cooler Master HAF XB ~ power consumption: 21 Watts.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post