PfBlocker
-
Oh i c. That makes sense. Right now seems to be ok but if I see performance issues, I will take that in mind and change it up.
-
Firstly, thank you for the excellent package. I greatly enjoy using 3rd party lists to do IP blocking and have pfblocker configured and running the way I like it. That said, I do have a couple questions.
-
I prefer to block inbound and outbound connections on all interfaces and use pfblocker aliases with 2 floating rules to do this. Is this the preferred method or is there another way I am missing?
-
Not directly a pfblocker question, but in what order are floating rules applied? Do they come before or after the individual interface rules?
Thank you very much for all your hard work!
-
-
- I prefer to block inbound and outbound connections on all interfaces and use pfblocker aliases with 2 floating rules to do this. Is this the preferred method or is there another way I am missing?
Define action as alias only and create your rules. That's the best way.
-
This seems like a very good package. However I'm having trouble getting lists to work properly.
I can make a list with this url in gz format and it works fine and creates an alias:
http://list.iblocklist.com/?list=bt_spyware&fileformat=p2p&archiveformat=gzFor some reason no matter what I try I can't get this list to load in either txt or gz format. No alias is created and nothing is blocked.
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklistAny ideas? Thanks
-
For some reason no matter what I try I can't get this list to load in either txt or gz format. No alias is created and nothing is blocked.
https://zeustracker.abuse.ch/blocklist.php?download=ipblocklistThis list is in txt format and returns only ips, not CIDR or ip ranges.
so,
:)
version 1.0.1 is out with:
-
fixed pfBlocker to check lists with single ips
-
updated country ip files
-
Return of Deny Both action(Inbound and Outbound)
-
Improved some GUI info
-
-
Wow.. thanks marcello! New version seems to work great.
Nice work, thanks again
-
Thank you for a great package! I just have one minor request for this package. Can you add more granular options for the list update frequency? Something like the attached image?
Thanks,
-Brian
-
Thanx for a great package - I like how it integrates and uses pfSense 2.0 firewall aliases and WAN/LAN rules :-)
A small observation and fix request (latest pfSense 2.0 release + latest pfBlocker):
After placing the pfBlocker widget on the bottom part of my long pfSense 2.0 dashboard page with vertical scrollbar, I observed that the dashboard page/scrollbar automatically reverted back to the top of the page at a fixed interval (every 5-10 secs).
This is a bit annoying if I am looking at data from a widget in the bottom part of the dashboard page - and every 5-10 seconds the page jumps to the top (internal pfBlocker refresh?) and I have to manually use the scrollbar/mouse/arrow-keys to navigate back down to the bottom of the page.
If I temp. removed the pfBlocker widget from dashboard the mis-behaviour went away also.
Hope you can reproduce this scenario and look forward to next release :-)
-
I observed that the dashboard page/scrollbar automatically
Thanks for the feedback.
I`ve removed scroll call in widget.
reinstall package in about 15 minutes.
If you have many widgets, consider testing widescreen package. It may help you.
-
Reinstalled and now I'm not getting any CIDRs or Packets in the widget.
![Screen Shot 2011-12-20 at 1.47.33 PM.png](/public/imported_attachments/1/Screen Shot 2011-12-20 at 1.47.33 PM.png)
![Screen Shot 2011-12-20 at 1.47.33 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2011-12-20 at 1.47.33 PM.png_thumb) -
fixed javascript again, try reinstall in 15 minutes.
-
pf 2.0 i386 + squid+squidguard+pfblocker 1.0 and 1.0.1 works very well (deny inbound)
pfblocker 1.0.1+ deny both, crash pfsense!!
reboot and crash,crash…
changing to deny inbound,works well again -
Can you be more specific on what kind of crash you have?
I'm using deny both with no issues or crashes.
Boot process is fine too. -
I`ve removed scroll call in widget.
reinstall package in about 15 minutes.Seems to work fine now… no forced scrolling to the top when refreshing numbers.
Thanx !!
-
Getting this error now trying to enable pfBlocker, and the widget still looks like the pic i posted above.
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 10499768 bytes) in /usr/local/pkg/pfblocker.inc on line 281
-
Increase Firewall Maximum Table Entries under System: Advanced: Firewall and NAT
you may have to increase Firewall Maximum States at some point -
fixed javascript again, try reinstall in 15 minutes.
Reinstalled and now the Dashboard doesn't scroll anymoire ;D
Being at it 8) is-it possible to have the option to Enable pfBlocker by default on reinstall? -
Increase Firewall Maximum Table Entries under System: Advanced: Firewall and NAT
you may have to increase Firewall Maximum States at some pointI'm already up to 2 million entries, even increasing to 200 million doesnt resolve issue. Been using pfBlocker since it was first introduced and havent had an issue until now.
Edit:
Using the Top Spammers works fine, it has something to do with the iBlocks lists. Using the same bunch of lists that I PM'd you back during this post.
http://forum.pfsense.org/index.php/topic,42543.msg219723.html#msg219723
-
I ran into that kind of issue when I played with the Level 1 at some point. I was using alias only.
It looked like the table were locked by Firewall Rules, when I disabled pfblocker, the table would still showed up.
I removed pfBlocker and the table were still there under Diagnostics: Tables!!!
I install pfblocker and at some point I recovered. But I am not using Level 1 at this time. -
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 10499768 bytes) in /usr/local/pkg/pfblocker.inc on line 281
It looks like very large lists.
Try to remove some lists and enable pfBlocker.
-
@onhel:
Getting this error now trying to enable pfBlocker, and the widget still looks like the pic i posted above.
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 10499768 bytes) in /usr/local/pkg/pfblocker.inc on line 281
do you have 128GB harddisk? meaning 134217728 bytes divided with 1024 twice is exactly 128GB
-
No, its 128mb RAM limit for php set on pfsense.
-
Sorry yes it was MB, not GB's.. assumed still that was kB's. :-[ :-[
-
I tried getting pfblocker to start, doesn't appear to be running in any of my system logs or processes. Tried reinstalling over and over, and the CIRDs in the dashboard widget still show a red down arrow. Any ideas how I can start the process manually via the shell?
-
What action did you choose for it?
You need at least one rule on interface to get pfBlocker working.
check firewall -> rules
-
Ah that was the reason! Didn't know that, thanks!
-
Good work guys! Nice new tools, usability and not to mention it works perfectly :P…..thanks for bringing two of my fav PF tools together.....Love it!
btw if anyone is using PF 2.0 as a "bridged router" ...set both options to "lan" .... just something i found out the hard way. ;D
-
Good work guys! Nice new tools, usability and not to mention it works perfectly …..thanks for bringing two of my fav PF tools together.....Love it!
Thanks for your feedback.
Consider donating to these package developers, we will feel fantastic too. ;)
-
Does using these large lists slow down the routing at all? It seems like thousands of IPs in the PF tables would slow it down a bunch… ?
-
Does using these large lists slow down the routing at all? It seems like thousands of IPs in the PF tables would slow it down a bunch… ?
It depends entirely on your system. Most hardware platforms will not be affected by 100's of thousands of IP's but an embedded system may. It completely depends.
Basically you want to limit your usage to less than 75 to 80 percent of your available RAM. If you're running other addons like squid then you may want to use less than 50 percent of available RAM.
In the cases where the system is slowed down by larger lists or the accumulation of large list the effects will be so small that you will not notice unless you host or depend on real time apps that are time sensitive. Other wise everything should be okay.
-
updated to pfsense 2.01. Removed country block and ipblock. Installed pfblocker
pfblock appears to work fine.
I am seeing a frequent messages in system log:
Dec 29 12:13:35 <user.notice>fw root: IP-Blocklist was found not running
Dec 29 12:16:26 <user.err>fw apinger: ALARM: WANGW(192.168.75.1) *** delay ***
Dec 29 12:16:36 <user.notice>fw check_reload_status: Reloading filter
Dec 29 12:16:42 <user.notice>fw root: IP-Blocklist was found not running
I do not see IP-Blocklist in the installed packages.
I see a reference in the config.xml :
–-------<ipblocklist_settings><config><enable>0</enable></config></ipblocklist_settings>
why is IP-Blocklist trying to get restarted ?
Is there another file that still thinks IP-Blocklist is installed ?</user.notice></user.notice></user.err></user.notice> -
maybe you need to delete its remaining script.
'/usr/local/pkg/pf/IP-Blocklist.sh'
Also look for ipblocklist scripts in /usr/local/etc/rc.d
I see a reference in the config.xml
follow these steps:
-
backup configuration
-
open /conf/config.xml
-
remove these entries
-
save file
-
reboot pfsense
-
-
I keep getting these messages in the system log:
Dec 29 17:01:02 php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 17:01:02 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 17:00:53 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'
Dec 29 17:00:23 php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 17:00:23 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 17:00:15 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'
Dec 29 16:59:45 php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 16:59:45 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 16:59:36 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'
Dec 29 16:59:06 php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 16:59:06 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 29 16:58:58 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'
But in the Dashboard everything looks good.
</pfblockertbg></pfblockertbg></pfblockertbg></pfblockertbg></pfblockertbg></pfblockertbg></pfblockertbg></pfblockertbg> -
Increase even more Firewall Maximum Table Entries in system->advanced -> firewall/NAT
-
Ok, will try that. Now is at 3000000, will try with 4000000.
Edit: with 4000000 still getting those messages. Will keep trying until I find a number that works and report back.
-
Don't forget to see memory use in dashboard. If you are getting more then 80% may be time for an upgrade or smaller lists.
-
Memory is at 44% at the moment, I should have plenty of headroom.
-
Personally I took mine up to a high value that would never be reached (something like 9999999999999999 or similar). I did this for several reasons.
No memory is allocated based on this number and it makes it easy to increase my table usage without trying to find a limit that will work. So it doesn't cost you anything and this ensures that no matter how many lists I use I won't run into any issue. Just in case someone is wondering my system only has 2GB of mem which is more than enough. -
I was trying to do it incrementally, but that is not working. Got up to 15000000, but then saw your post. So I'm going to try that large number[9999999999999999].
-
Are you sure you are not reading an old alert?
BTW, if a really large value does not exaust memory, It's an excelent option to prevent errors.