Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved
    pfBlockerNG
    210
    1.2k
    1.5m
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      @firewalluser:

      So I've downloaded pfblockerNG but cant find a tab to block the United States or North America

      Eeeeh?!

      1 Reply Last reply Reply Quote 0
      • S
        SkyNET
        last edited by

        As a side note.., and a question..

        Upgrading from version 1.01 to version 1.02 removed all my newly added pfBlockerNG rules from version 1.01.
        Had to create them all again after the package update. Seeing that update 1.03 is available.. Will this also remove all my current pfBlockerNG rules?
        Lots of manual labor..

        Anyway the new package is great!

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by

          @SkyNET:

          Upgrading from version 1.01 to version 1.02 removed all my newly added pfBlockerNG rules from version 1.01.
          Had to create them all again after the package update. Seeing that update 1.03 is available.. Will this also remove all my current pfBlockerNG rules?
          Lots of manual labor..

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User
            last edited by

            Just to be clear: This post is not a personal attack at anybody.

            Most of the problems as far as I can see where with user configuration errors. This isn't a fruity company's product. You DO actually need to configure it in order to run.

            Choosing every single list on the planet without first understanding the basics is wrong.
            Blocking by countries is wrong. Most web hosting "companies" (trust me, I know my competition better than they know themselves) are renting space in a "cheap-from-a-provider's POV" country (eg. US). Yes I do agree that the NSA is being run by criminals, and yes I do agree that most (all?) of them should be locked in cells with the door welded shut. Weigh in what you lose with what you get. Not arguing the "if you have nothing to hide, you have nothing to be afraid of" meme. I'm saying that by cutting off entire countries, you risk cutting off significant portion of the "good" part of the Internet as well. For a single user, who cares. For a provider, you will, trust me.
            Spend 5 minutes (time it) going through the package's options before complaining that something doesn't work. There are cases where it is a genuine bug (eg PS tab not getting synced) and other times it's a specific issue to you (eg sync not working because of special characters in the password).

            Take care, and wait for the configuration guides before letting the beast out of the cage  ;)

            1 Reply Last reply Reply Quote 0
            • F
              firewalluser
              last edited by

              @doktornotor:

              @firewalluser:

              So I've downloaded pfblockerNG but cant find a tab to block the United States or North America

              Eeeeh?!

              @firewalluser:

              So I've downloaded pfblockerNG but cant find a tab to block the United States or North America which is only in response to the US announcing yesterday they will keep all non-US traffic for 5 years. I value my privacy so I'd rather not have anything to do with US sites after this announcement which will probably make surfing interesting to say the least.

              So considering the number of CIDR's for the the US, would it be best to add them to Aliases and block via a firewall rule or use pfblockerng.

              Do have to say it looks comprehensive which is good and certainly an improvement over earlier attempts to block IP's en mass.

              Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

              Asch Conformity, mainly the blind leading the blind.

              1 Reply Last reply Reply Quote 0
              • A
                asterix
                last edited by

                @Asterix:

                NA country list is blocking my HE ipv6 tunnel. Tried suppression and changing order. Also tried de-selecting North America from the NA list. I have kept all countries to deny inbound.

                Only way it works is by disabling NA country list entirely. Suggestions??

                Anyone?

                1 Reply Last reply Reply Quote 0
                • C
                  Cino
                  last edited by

                  @firewalluser:

                  So I've downloaded pfblockerNG but cant find a tab to block the United States or North America which is only in response to the US announcing yesterday they will keep all non-US traffic for 5 years. I value my privacy so I'd rather not have anything to do with US sites after this announcement which will probably make surfing interesting to say the least.

                  So considering the number of CIDR's for the the US, would it be best to add them to Aliases and block via a firewall rule or use pfblockerng.

                  Do have to say it looks comprehensive which is good and certainly an improvement over earlier attempts to block IP's en mass.

                  hmmm, so does this mean you wont be accessing the forum anymore?

                  1 Reply Last reply Reply Quote 0
                  • F
                    firewalluser
                    last edited by

                    If its hosted in the US, then yes that will be the case, is it as I've not looked yet, I thought this was Canadian a business?

                    Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

                    Asch Conformity, mainly the blind leading the blind.

                    1 Reply Last reply Reply Quote 0
                    • SoloamS
                      Soloam
                      last edited by

                      This is a great package, congrats. Any tutorial available or planed to explain the multiple options?

                      Thank You
                      Best Regards

                      1 Reply Last reply Reply Quote 0
                      • C
                        Cino
                        last edited by

                        @firewalluser:

                        If its hosted in the US, then yes that will be the case, is it as I've not looked yet, I thought this was Canadian a business?

                        Its based out of the US, Austin TX I believe. But with team members thru the world.

                        1 Reply Last reply Reply Quote 0
                        • ?
                          A Former User
                          last edited by

                          @Asterix:

                          @Asterix:

                          NA country list is blocking my HE ipv6 tunnel. Tried suppression and changing order. Also tried de-selecting North America from the NA list. I have kept all countries to deny inbound.

                          Only way it works is by disabling NA country list entirely. Suggestions??

                          Anyone?

                          Whitelist the tunnel's IP with a rule above the pfBlockerNG's rule maybe? (pfsense interface config, or tunnelbroker should show it)

                          1 Reply Last reply Reply Quote 0
                          • C
                            Cino
                            last edited by

                            @jflsakfja:

                            @Asterix:

                            @Asterix:

                            NA country list is blocking my HE ipv6 tunnel. Tried suppression and changing order. Also tried de-selecting North America from the NA list. I have kept all countries to deny inbound.

                            Only way it works is by disabling NA country list entirely. Suggestions??

                            Anyone?

                            Whitelist the tunnel's IP with a rule above the pfBlockerNG's rule maybe? (pfsense interface config, or tunnelbroker should show it)

                            This is what I do and it works prefect. I use floating rules, so its one of my first floater before the pfBlockerNG rules.. And I have Quick checked

                            P.S This is why there is an option (Rule Order) to change the way pfBlockerNG places the rules. To give you the flexible that is needed based on your setup. Since I have pfBlockerNG create floating rules, I needed to use the second Rule Order. If I wasn't using floating rules. The first option would work but I would still place my whitlisted IPs as a floating rule.

                            1 Reply Last reply Reply Quote 0
                            • A
                              asterix
                              last edited by

                              OK a bit confused. Could you please provide some quick screen shots. Last time I added a rule it was pushed all the way down on the floating rules. Also the suppression list alias is not being loaded in the rules as well.

                              1 Reply Last reply Reply Quote 0
                              • ?
                                A Former User
                                last edited by

                                Not in front of a pfsense box now, but you can find various options on where to put the automatically created rules in the pfblockerng package. One of them should allow you to have your defined rules first, and the automatically created ones (pfblockerng's) last. If you chose that option, and the rule is still created in the end, tick the rule and move it to the top manually.

                                1 Reply Last reply Reply Quote 0
                                • C
                                  cjbujold
                                  last edited by

                                  Great program works well for us.  However would like to suggest 2 items:

                                  1. in the alert tab add a filter so we can easily find an offending rule affecting an IP (something like the filter in Snort).

                                  2. If somebody could provide the suggested block list to use.  We have added several from IblockList but I presume there are some that are better than others.  Some direction and expertise on which to use would be very helpful

                                  Again a great program and congratulation to the team that put it together.

                                  cjb

                                  1 Reply Last reply Reply Quote 0
                                  • A
                                    asterix
                                    last edited by

                                    I have set it to the second option as well..

                                    pfSense Pass | PfB Pass | PfB Block/Reject

                                    Now exactly which IP do I need to add to the top of the floating rules for HE Tunnel to work. I have tried the typical 66.220.2.74 and the gif remote address as well. Also where is the whitelist option?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Supermule Banned
                                      last edited by

                                      What would be the point of that?

                                      Everything is passed through to the servers no matter what country it origins from.

                                      :D

                                      pfB pass/reject -> all others comes second.

                                      1 Reply Last reply Reply Quote 0
                                      • ?
                                        A Former User
                                        last edited by

                                        @Asterix:

                                        I have set it to the second option as well..

                                        pfSense Pass | PfB Pass | PfB Block/Reject

                                        Now exactly which IP do I need to add to the top of the floating rules for HE Tunnel to work. I have tried the typical 66.220.2.74 and the gif remote address as well. Also where is the whitelist option?

                                        The gif address (remote) should make it work. Are you sure the floating rule you created is a quick pass rule?

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          asterix
                                          last edited by

                                          This is exactly what I have done… let me know what I may have missed..

                                          PfBlocker enabled
                                          All countries - Deny Inbound

                                          IPv4 tab - Alias named Whitelist. Added IPv4 Custom Address - 66.220.2.74 and the gif remote address - List action is set to Permit both (open communications between pfSense and the 2 HE IP addresses)

                                          Checked the Rules and its on the top by default through PfBlocker configuration.

                                          Reloaded and even rebooted pfSense. Yet the tunnel is blocked. The moment I deselect the entire NA country list the tunnel is back on.

                                          1 Reply Last reply Reply Quote 0
                                          • ?
                                            A Former User
                                            last edited by

                                            @Asterix:

                                            This is exactly what I have done… let me know what I may have missed..

                                            PfBlocker enabled
                                            All countries - Deny Inbound

                                            IPv4 tab - Alias named Whitelist. Added IPv4 Custom Address - 66.220.2.74 and the gif remote address - List action is set to Permit both (open communications between pfSense and the 2 HE IP addresses)

                                            Checked the Rules and its on the top by default through PfBlocker configuration.

                                            Reloaded and even rebooted pfSense. Yet the tunnel is blocked. The moment I deselect the entire NA country list the tunnel is back on.

                                            Looks like its configured ok. Dunno why it's not working. I'll let someone else with access to a pf box to help along.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post