Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved
    pfBlockerNG
    210
    1.2k
    1.5m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      chain
      last edited by

      i get this error when saving pfblockerng

      Fatal error: Cannot unset string offsets in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 3921

      I have setup that iblock_level3 url, that block ip address, how do I excluded a set of IP address from being blocked?

      1 Reply Last reply Reply Quote 0
      • H
        heliop100
        last edited by

        @BBcan177:

        @heliop100:

        Are some way to merge both lists? When I try to create one new alias with both alias on, I receive one error that it's not possible because the to aliases are from different types.

        Please see the following links:
        https://forum.pfsense.org/index.php?topic=102071.0
        https://forum.pfsense.org/index.php?topic=86212.msg548324#msg548324
        https://forum.pfsense.org/index.php?topic=86212.msg553921#msg553921

        Hi, Thanks a lot.
        Happy new year!!!

        1 Reply Last reply Reply Quote 0
        • K
          kreindler
          last edited by

          I have a fresh install of a pfsense 2.2.6 on a watchguard.

          Now, I am having some issues with the installation of several packages, one of which is pfBlockerNG.

          The package seems to install properly, no error during the installation, but it doesn't appear anywhere in the console.
          I had it installed before, on the 2.2.2 variant, and it worked as expected.

          I thought it was just an interface glitch, and tried to reinstall the package.

          Still not luck, so I used the "reinstall gui" option.

          Still no luck, so I tried manually addressing>
          https://192.168.1.1/pfblockerng/pfblockerng_alerts.php (which I had cached in my browser).

          This also didn't work.

          PS: between the reinstalls I have also rebooted the appliance.

          1 Reply Last reply Reply Quote 0
          • V
            vwgti
            last edited by

            I'm trying to whitelist access to a website behind my firewall to my own country only.

            When I create a Country list action as an 'alias permit' then use the resulting alias as the Source for the existing website NAT rule, it breaks my internal network access to the site. NAT Refelction is set to Enable (NAT + Proxy), what am i missing here?

            1 Reply Last reply Reply Quote 0
            • T
              trumee
              last edited by

              I am starting to get errors. I guess the lists i am using are old. Where do i get the new list?

              pfblockerng.log

              
[ Abuse_SSLBL ]		 Downloading update [ 01/02/16 6:01:12 ] .. 200 OK. completed ..

[ dShield_Block ]	 Downloading update [ 01/02/16 6:01:13 ] . cURL Error: 51
SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds...
. cURL Error: 51
SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds...
. cURL Error: 51
SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org' Retry in 5 seconds...
.. unknown http status code 

 [ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/02/16 6:01:29 ]
  Firewall and/or IDS are not blocking download.

The Following list has been REMOVED [ dShield_Block ]

[ Snort_BL ]		 Downloading update [ 01/02/16 6:01:30 ] . cURL Error: 60
SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds...
. cURL Error: 60
SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds...
. cURL Error: 60
SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds...
.. unknown http status code 

 [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/02/16 6:01:46 ]
  Firewall and/or IDS are not blocking download.

The Following list has been REMOVED [ Snort_BL ]

[ BBC_Goz ]		 exists. 
[ Alienvault ]		 Downloading update  .. 200 OK.. completed ..

              error.log

              
[ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/03/16 20:11:11 ]
  Firewall and/or IDS are not blocking download.
. unknown http status code 

 [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/03/16 20:11:28 ]
  Firewall and/or IDS are not blocking download.
. unknown http status code 

 [ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:11:47 ]
 [ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ]
. unknown http status code 

 [ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:12:04 ]
 [ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ]
. unknown http status code 

 [ pfB_PRI1 - dShield_Block ] Download FAIL [ 01/03/16 20:13:12 ]
  Firewall and/or IDS are not blocking download.
. unknown http status code 

 [ pfB_PRI1 - Snort_BL ] Download FAIL [ 01/03/16 20:13:29 ]
  Firewall and/or IDS are not blocking download.
. unknown http status code 

 [ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:13:46 ]
 [ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ]
. unknown http status code 

 [ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:14:08 ]
 [ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ]
              1 Reply Last reply Reply Quote 0
              • RonpfSR
                RonpfS
                last edited by

                You can change the Lists state to FLEX for those lists and see if this help.

                2.4.5-RELEASE-p1 (amd64)
                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                1 Reply Last reply Reply Quote 0
                • A
                  Amuzed2pieces
                  last edited by

                  PfBlockeNG sounds really great, but after reading through about 500 posts I found a few people requesting a shorter tutorial, but no one has responded to those request.

                  Is there a concise guide to setting up and configuring PfblockerNG 2.0.4?  I could eliminate a lot of repetitive questions.

                  I'd rather learn from the mistakes of others, than stay up to 2am trying figure out what setting I goofed.

                  Thanks

                  1 Reply Last reply Reply Quote 0
                  • J
                    jawz101
                    last edited by

                    Converting MaxMind Country databases for pfBlockerNG.
                    This may take a few minutes…

                    I just did fresh a install of pfSense after using the box for other stuff for a while and the converting the database process just hangs.  It didn't a few months ago.  I was running 2.2.5 the last time I had installed pfB so that and whatever has changed with the addon since a few months is really the only things that have changed in the process.

                    This is a fast 50+MB connection and an Intel c2758 board so I can't think it's the equipment.  Logs aren't showing anything funky.  I've removed and reinstalled pfB a few times to see if something would change but the CPU is idle at this point and logs aren't indicating anything's going on at this point of the install.  I let it go about 20+ minutes on one attempt and just now let it sit there while I slept 7+ hours.

                    I can clearly see the lists have downloaded to the box via ssh and I even looked at the github source and downloaded the country lists from the url's via my browser.

                    edit- just redownloaded the pfSense iso, verified hash, reinstalled pfSense and still get the same hang

                    1 Reply Last reply Reply Quote 0
                    • J
                      jawz101
                      last edited by

                      @BBCan17
                      I've since reinstalled Firefox and started walking through all of my addons setting them back up how I had them.  So far I haven't seen it not install now.  Maybe either successfully installing it once from another browser is what fixed it or I haven't checked a setting in my add-ons that was causing the error or maybe something in my browser cache… no idea.  Kinda frustrating I haven't pinned it down but at least it wasn't a big deal I guess.  If something comes up I'll let you know because that's really odd.

                      Thanks for the help!

                      Also, I'm thinking of writing a tut at some point but I doubt it'll be concise as some would wish.  It's one of those apps I want to gush on about.  Besides, after using blockers for 10+ years they're handy but using >10 blocklists seems excessive prefer being conservative.

                      1 Reply Last reply Reply Quote 0
                      • D
                        DLFerguRD
                        last edited by

                        @BBcan177

                        Hi I have just upgrqaded to pfsense 2.3B and am having a problem with the pfBlockerNG webserver service.
                        The service will not start for some reason.  I do get a crash report from pfsense.

                        					Crash report begins.  Anonymous machine information:

amd64
10.2-STABLE
FreeBSD 10.2-STABLE #296 d8ff348(devel): Wed Jan  6 08:09:19 CST 2016     root@pfs23-amd64-builder:/usr/home/pfsense/pfsense/tmp/obj/usr/home/pfsense/pfsense/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors:
[06-Jan-2016 10:10:32 America/Edmonton] PHP Stack trace:
[06-Jan-2016 10:10:32 America/Edmonton] PHP   1\. {main}() /usr/local/www/pfblockerng/pfblockerng.php:0
[06-Jan-2016 10:10:32 America/Edmonton] PHP   2\. sync_package_pfblockerng() /usr/local/www/pfblockerng/pfblockerng.php:101
[06-Jan-2016 10:10:32 America/Edmonton] PHP   3\. pfb_create_dnsbl() /usr/local/pkg/pfblockerng/pfblockerng.inc:3031
[06-Jan-2016 10:10:32 America/Edmonton] PHP   4\. link() /usr/local/pkg/pfblockerng/pfblockerng.inc:693
[06-Jan-2016 10:15:00 America/Edmonton] PHP Stack trace:
[06-Jan-2016 10:15:00 America/Edmonton] PHP   1\. {main}() /usr/local/www/pfblockerng/pfblockerng.php:0
[06-Jan-2016 10:15:00 America/Edmonton] PHP   2\. pfblockerng_sync_cron() /usr/local/www/pfblockerng/pfblockerng.php:94
[06-Jan-2016 10:15:00 America/Edmonton] PHP   3\. sync_package_pfblockerng() /usr/local/www/pfblockerng/pfblockerng.php:387
[06-Jan-2016 10:15:00 America/Edmonton] PHP   4\. pfb_create_dnsbl() /usr/local/pkg/pfblockerng/pfblockerng.inc:3031
[06-Jan-2016 10:15:00 America/Edmonton] PHP   5\. link() /usr/local/pkg/pfblockerng/pfblockerng.inc:693

                        I have tried reinstalling, removing the package completely and then installing.

                        It would be great if you could have a look at this.
                        BTW Thanks for a great package.

                        Dan

                        1 Reply Last reply Reply Quote 0
                        • D
                          ddimick
                          last edited by

                          pfSense moved from lighttpd to nginx in the beta which broke pfBNG (along with all other packages relying on lighttpd). I believe the author is working on an update.

                          https://forum.pfsense.org/index.php?topic=104854.0

                          1 Reply Last reply Reply Quote 0
                          • D
                            DLFerguRD
                            last edited by

                            Ok Thank you.
                            Since the package was available for 2.3 I thought it was already done.

                            1 Reply Last reply Reply Quote 0
                            • V
                              varazir
                              last edited by

                              I'm getting this error in the update log

                              ===[  DNSBL Process  ]================================================
Missing DNSBL stats and/or Unbound DNSBL conf file - Rebuilding
                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                Hi trumee,

                                Some of those download fails are due to cURL errors. See the messages below. Set those to "Flex".

                                @trumee:

                                SSL: no alternative certificate subject name matches target host name 'feeds.dshield.org'
                                SSL certificate problem: unable to get local issuer certificate Retry in 5 seconds…

                                Also Dangerulez and VMX are being blocked by other Firewall Lists.

                                [ pfB_PRI3 - DangerRulez ] Download FAIL [ 01/03/16 20:11:47 ]
                                [ 188.40.39.38 ] Firewall IP block found in: [ pfB_Top_v4 | 188.40.0.0/16 ]

                                [ pfB_PRI3 - VMX ] Download FAIL [ 01/03/16 20:12:04 ]
                                [ 195.209.40.11 ] Firewall IP block found in: [ pfB_Top_v4 | 195.208.0.0/15 ]

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @DLFerguRD:

                                  Hi I have just upgrqaded to pfsense 2.3B and am having a problem with the pfBlockerNG webserver service. The service will not start for some reason.  I do get a crash report from pfsense.

                                  @DougD:

                                  pfSense moved from lighttpd to nginx in the beta which broke pfBNG (along with all other packages relying on lighttpd). I believe the author is working on an update.

                                  https://forum.pfsense.org/index.php?topic=104854.0

                                  Yes the recent changes in pfense 2.3 from Lighttpd to NGINX broke the DNSBL feature… I will be submitting a PR to fix this up soon....

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    @varazir:

                                    I'm getting this error in the update log

                                    ===[  DNSBL Process  ]================================================
Missing DNSBL stats and/or Unbound DNSBL conf file - Rebuilding

                                    Its not an error… Its just a notice to say that its rebuilding the database. Possibly due to a "Force Reload" or re-enabling pfBlockerNG... or adding/removing a DNSBL Alias/Feeds...

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • A
                                      abujammy
                                      last edited by

                                      @BBcan177, this is going to take some explaining. :)  This feature affects other services, but let's just use AWS as an example.

                                      AWS controls (among many, many others) the entire 54.240.128.0/18 range, which means that all /24 ranges from 54.240.128.0/24-54.240.191.0/24 are included.  Since AWS allows others to use their servers, it's highly likely that many of those /24 ranges are going to be flagged.

                                      Let's say that 128, 129, 140, 141, 142, 143, 144 get flagged in a particular /24.  As far as AWS is concerned, there's no correlation which implies that 130, 139 or 145 are the same individual or group.  This is especially true for CloudFront where the IP assignments mean nothing.

                                      So the entire /24 net gets blacklisted when, in actuality, for these particular subnets, the relationships between IPs on the same /24 subnet is almost zero.

                                      What I'd like would be for a way to say: "Hey, go ahead and parse out something like this: https://ip-ranges.amazonaws.com/ip-ranges.json and, if the IPs are within those ranges, still blacklist them, but don't add them to the list for reputation processing."

                                      Thoughts?

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        @abujammy:

                                        What I'd like would be for a way to say: "Hey, go ahead and parse out something like this: https://ip-ranges.amazonaws.com/ip-ranges.json and, if the IPs are within those ranges, still blacklist them, but don't add them to the list for reputation processing."

                                        Hi abujammy, Its best to use the Country code exclusion for Reputation and add "USA" to the list of exclusions.

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          tommyboy180
                                          last edited by

                                          Wow! BBcan177. Wow.

                                          I've been gone for such a long time, I come back and pfBlockerNG is a hit! This is so cool. I'm so glad that you stepped up and helped move this idea. Thanks to Marcello Coutinho for helping me get pfBlocker (back when it was IP blocklist and country Block) off the ground from it's first inception back when it was release 0.1.

                                          This is absolutely awesome. And you gave throwback credit to me and Marcello Coutinho.

                                          Well done! This is why I love the pfsense community. We all work together to make our worlds better.

                                          -Tom Schaefer
                                          SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM

                                          Please support pfBlocker | File Browser | Strikeback

                                          1 Reply Last reply Reply Quote 0
                                          • BBcan177B
                                            BBcan177 Moderator
                                            last edited by

                                            @tommyboy180:

                                            Wow! BBcan177. Wow.

                                            I've been gone for such a long time, I come back and pfBlockerNG is a hit! This is so cool. I'm so glad that you stepped up and helped move this idea. Thanks to Marcello Coutinho for helping me get pfBlocker (back when it was IP blocklist and country Block) off the ground from it's first inception back when it was release 0.1.

                                            This is absolutely awesome. And you gave throwback credit to me and Marcello Coutinho.

                                            Well done! This is why I love the pfsense community. We all work together to make our worlds better.

                                            Thanks… Most don't realize all the effort that goes into developing and maintaining a package with an ever changing landscape...  ;)  welcome back...

                                            "Experience is something you don't get until just after you need it."

                                            Website: http://pfBlockerNG.com
                                            Twitter: @BBcan177  #pfBlockerNG
                                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post