PfBlockerNG
-
@Mr.:
Given the increase in traffic in this thread I thought it was released, but according to the package manager in the GUI it is not there yet; lots of hackers here then ;D
It is released and available on pfSense 2.2 only.
WUT??
Not on 2.1.5?(??)
-
No, really, it's for 2.2 only?
I'm on 2.1.5, and plan to stay there for quite some time. I was looking forward to this package tremendelously, even back last year when BB tried to help me become a beta tester for it.
I'm a little bit like the attached pic now :'(
-
Good Evening,
I am attempting to use the IP Lists from https://blocklist.sigmaprojects.org/, but each time it goes to update, I am receiving an error:
[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=anti-infringement ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=webexploit ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=dshield ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=drop ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=zeus ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=china ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=forumspam ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=pedophiles ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=northkorea ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=russia ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=atma ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spammers ]
** TERMINATED - Header contains Blank/International/Special or SpacesAny thoughts or guidance that might have to help resolve this issue would be greatly appreciated.
Best-
-
** TERMINATED - Header contains Blank/International/Special or Spaces
In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.
-
** TERMINATED - Header contains Blank/International/Special or Spaces
In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.
Thank you for the help. I have updated the Alias with these instructions but still receive the same error. The Header field is blank for each of the lists. Does something needed to be added to the Header field to make it work?
Best-
-
** TERMINATED - Header contains Blank/International/Special or Spaces
In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.
Thank you for the help. I have updated the Alias with these instructions but still receive the same error. The Header field is blank for each of the lists. Does something needed to be added to the Header field to make it work?
Best-
** TERMINATED - Header contains Blank/International/Special or Spaces
Enter a name for the header like: sigma-anti-infringement, sigma-webexploit, sigma-dshield
'Header' : The 'Header' Field must be Unique, it will name the List File and it will be referenced in the pfBlockerNG Widget. Use a Unique Prefix per 'Alias Category' followed by a unique descriptor for each List.
-
Ok just to let everyone know that I tried his lists and found that same error. There is something wrong with fetching of list. I can download gz lists if I use browser to get it. It looks legit inside
Example from file
1.0.128.0/17
1.0.192.0/18
1.1.128.0/17
1.2.128.0/17
1.9.0.0/16
1.20.128.0/17
1.27.1.231/32
1.27.100.88/32
1.34.0.0/16
1.36.71.108/32
1.36.79.146/32
1.48.0.0/16
1.50.0.0/16
1.54.224.0/20
1.56.44.42/32
1.56.122.145/32
1.56.145.114/32I do not get his Header problem he sees but I get
[ Sigantiinfringement ] Downloading New File
[ pfB_sigmaprojects Sigantiinfringement ] Download FAIL [ 02/06/15 22:00:47 ]
[ Sigwebexploit ] Downloading New File
[ pfB_sigmaprojects Sigwebexploit ] Download FAIL [ 02/06/15 22:00:48 ]
[ Sigdshield ] Downloading New File
[ pfB_sigmaprojects Sigdshield ] Download FAIL [ 02/06/15 22:00:49 ]
I took the link and had Free Download manager try to get it and that worked. FDM got the file no problem.
![screencapture-192-168-1-1-pkg_edit-php (1).png](/public/imported_attachments/1/screencapture-192-168-1-1-pkg_edit-php (1).png)
![sigma list.png](/public/imported_attachments/1/sigma list.png)
![screencapture-192-168-1-1-pkg_edit-php (1).png_thumb](/public/imported_attachments/1/screencapture-192-168-1-1-pkg_edit-php (1).png_thumb)
![sigma list.png_thumb](/public/imported_attachments/1/sigma list.png_thumb) -
If the lists are gz format and in CIDR format, you need to select "gz_2".
However, these are not the best lists to use. It's best to use lists from the original provider.
-
BBcan you the man. That fixes them thanks. GZ_2 format. Maybe next update it can be smarter and know what to choose :p
-
Hi all,
So I got around to mimicking the setup i had in pfBlocker; I added all the lists and configured everything based on the way things used to be. However, my status widget just looks like this after a few hours:
With the old setup, I'd be able to see all the blocked packets. In pfBlocker, I had it set as deny inbound and WAN as both inbound/outbound interface…
Obviously the lists have loaded fine and firewall rules have been made as well but... what am I missing here?
Thanks!
-
go to the update tab and view log .. send it here
Oh and send your list links here also please so I can try and see if that is problem too
-
My lists actually require a subscription… but nevertheless, here they are; username and password redacted:
http://list.iblocklist.com/?list=rynxmrknfjysesjtjlxy&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=fruzekpkpzlmzozmuuhx&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=ydxerpxkpcfqjaybcssw&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=usrcshglbiilevmyfhse&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=lujdnbasfaaixitgmxpp&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=cwworuawihqvocglcoss&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=mcvxsnihddgutbjfbghy&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxx
http://list.iblocklist.com/?list=czvaehmjpsnwwttrdoyl&fileformat=p2p&archiveformat=gz&username=yyyyyy&pin=xxxxxxxFull log can be found here:
http://pastebin.com/raw.php?i=xR3DD8Br
I just noticed this interesting tidbit in the log:
===[ Aliastables / Rules ]================================ No Changes to Firewall Rules, Skipping Filter Reload Updating: pfB_TopSpammers 1 table created.312 addresses added. Updating: pfB_Ads no IP address found for /32pfctl: cannot load /var/db/aliastables/pfB_Ads.txt: No error: 0 Updating: pfB_Hijacked 1 table created.536 addresses added. Updating: pfB_DROP 1 table created.651 addresses added. Updating: pfB_BOGON no IP address found for /8pfctl: cannot load /var/db/aliastables/pfB_BOGON.txt: No error: 0 Updating: pfB_BadPeers 1 table created.48783 addresses added. Updating: pfB_Spider 1 table created.859 addresses added. Updating: pfB_CruzitWebAttacks 1 table created.4251 addresses added. ===[ FINAL Processing ]=============================================
Is the above an issue at all?
Thanks!
-
I seen failed download in the beginning of your log. You can fix that by putting type of url in list to gz_2
and I had similar issue that was fixed by reinstalling the package
force a reload before doing that though
-
I changed them to gz_2 and forced an update; I'll give it some time and see what happens. Thanks!
-
Hit the thanks button for me please. Hope that works for you
-
Just out of curiosity - there shouldn't be anything related to configuration other than the lists that could affect the behavior, could there?
For what its worth - this is how mine is configured:
-
For what its worth - this is how mine is configured:
On an unrelated note: WAN is not an outbound interface.
-
Just out of curiosity - there shouldn't be anything related to configuration other than the lists that could affect the behavior, could there?
For what its worth - this is how mine is configured:
Except the LAN should be the outbound normally
Looks ok to me, maybe tomorrow about 11pm EST I can help with teamviewer if you don't have right by then
-
Whoops - I must have accidentally toggled it. Fixed right now; will monitor.
-
Hi McFuzz,
These are IBlock lists. And they are in a range format. You need to select "gz" format. There is a chart below the URL entry section to indicate what each "Format" is for.
I think the issue is with the "Ads" list. I will be doing some debugging today but try to toggle that list "off" and change all IBlock to "gz" then run a "Force Reload".
If you see a "-" in the widget there are issues with pfctl and it's not going to block anything.