PfBlockerNG

[AndrewZ]

BBcan177, thanks a lot!
Already cleaning up my configs.

[doktornotor]

@BBcan177:

You can add any number of Countries to a single Alias but they all have to be IPv4 or IPv6 depending on which Tab you created them in IPv4 or IPv6 Tabs. Set it to update once per week.

/usr/pbi/pfblockerng-amd64/share/GeoIP/US_v4.txt

Just a note - this apparently fails for IPv6 (Download FAIL/Local File Failure)

[BBcan177]

Yes I have a fix for IPv6 Regex. Should have it posted today or tomorrow…

PM me if you need to get it sooner.

[doktornotor]

@BBcan177:

PM me if you need to get it sooner.

Noooo, definitely not urgent. Was just testing. :)

[BBcan177]

@doktornotor:

@BBcan177:

PM me if you need to get it sooner.

Noooo, definitely not urgent. Was just testing. :)

Was kinda leading you to test it  ;D I did say I really Hate Regex! Right!

You could edit pfblockerng.inc and replace the following (Starting at Line 1166)

        $pattern1 = '([A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}';
        $pattern2 = '[A-Fa-f0-9]{1,4}::([A-Fa-f0-9]{1,4}:){0,5}[A-Fa-f0-9]{1,4}';
        $pattern3 = '([A-Fa-f0-9]{1,4}:){2}:([A-Fa-f0-9]{1,4}:){0,4}[A-Fa-f0-9]{1,4}';
        $pattern4 = '([A-Fa-f0-9]{1,4}:){3}:([A-Fa-f0-9]{1,4}:){0,3}[A-Fa-f0-9]{1,4}';
        $pattern5 = '([A-Fa-f0-9]{1,4}:){4}:([A-Fa-f0-9]{1,4}:){0,2}[A-Fa-f0-9]{1,4}';
        $pattern6 = '([A-Fa-f0-9]{1,4}:){5}:([A-Fa-f0-9]{1,4}:){0,1}[A-Fa-f0-9]{1,4}';
        $pattern7 = '([A-Fa-f0-9]{1,4}:){6}:[A-Fa-f0-9]{1,4}';
        $pattern8 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}::)\/[0-9]{2}';
        $pattern9 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}:[A-Fa-f0-9]{1,4}::)\/[0-9]{2}';
        $pattern10 = '[A-Fa-f0-9]{1,4}::\/[0-9]{2}';
        $pfb['ipv6'] = "/^($pattern1)$|^($pattern2)$|^($pattern3)$|^($pattern4)$|^($pattern5)$|^($pattern6)$|^($pattern7)$|^($pattern8)$|^($pattern9)$|^($pattern10)$/";

[doktornotor]

@BBcan177:

edit pfblockerng.inc and replace the following (Starting at Line 1166)

        $pattern1 = '([A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}';
        $pattern2 = '[A-Fa-f0-9]{1,4}::([A-Fa-f0-9]{1,4}:){0,5}[A-Fa-f0-9]{1,4}';
        $pattern3 = '([A-Fa-f0-9]{1,4}:){2}:([A-Fa-f0-9]{1,4}:){0,4}[A-Fa-f0-9]{1,4}';
        $pattern4 = '([A-Fa-f0-9]{1,4}:){3}:([A-Fa-f0-9]{1,4}:){0,3}[A-Fa-f0-9]{1,4}';
        $pattern5 = '([A-Fa-f0-9]{1,4}:){4}:([A-Fa-f0-9]{1,4}:){0,2}[A-Fa-f0-9]{1,4}';
        $pattern6 = '([A-Fa-f0-9]{1,4}:){5}:([A-Fa-f0-9]{1,4}:){0,1}[A-Fa-f0-9]{1,4}';
        $pattern7 = '([A-Fa-f0-9]{1,4}:){6}:[A-Fa-f0-9]{1,4}';
        $pattern8 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}::)\/[0-9]{2}';
        $pattern9 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}:[A-Fa-f0-9]{1,4}::)\/[0-9]{2}';
        $pattern10 = '[A-Fa-f0-9]{1,4}::\/[0-9]{2}';
        $pfb['ipv6'] = "/^($pattern1)$|^($pattern2)$|^($pattern3)$|^($pattern4)$|^($pattern5)$|^($pattern6)$|^($pattern7)$|^($pattern8)$|^($pattern9)$|^($pattern10)$/";

That works.  8)

[McFuzz]

@BBcan177:

Hi McFuzz,

These are IBlock lists. And they are in a range format. You need to select "gz" format. There is a chart below the URL entry section to indicate what each "Format" is for.

I think the issue is with the "Ads" list. I will be doing some debugging today but try to toggle that list "off" and change all IBlock to "gz" then run a "Force Reload".

If you see a "-" in the widget there are issues with pfctl and it's not going to block anything.

Howdy,

I actually changed it to gz_2 and it apparently works fine now; gz caused me to have the dashes (-). I'll disable ads and see if all others work with gz. I'll check out the BOGON settings :)

[Topper727]

Wonder if there is a problem with the lists.. I had that happen and I disabled with help from BBcan the bad apples.. Found out there is a 0.0.0.0 address in bad ones and that was a bug that he is fixing now.

[SixXxShooTeR]

deviantart is working now. Malwarebytes still saying unable to access server when updating. Only packets being blocked are from level1 and ads and tracker list.

[Topper727]

try

https://www.iblocklist.com/lists.php

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=anti-infringement ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=webexploit ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=dshield ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=drop ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=zeus ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=china ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=forumspam ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=pedophiles ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=northkorea ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=russia ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=atma ]
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spammers ]
.

[doktornotor]

@Topper727:

Found out there is a 0.0.0.0 address in bad ones

Whoever puts 0.0.0.0 in a blocklist should not maintain one in the first place… WTF!  :o >:(

[Topper727]

Agree.. but BBcan had code to remove it but now he has a file that I gave him from a list that he can test and debug that part of the code.  So in future if more of those 0.0.0.0 show up they will be ignored. Hence the list should work

[McFuzz]

By the way - another interesting thing I've noticed between pfBlocker and pfBlockerNG is that with pfBlocker, it'd block A LOT of packets, but with pfBlockerNG - barely so:

What gives..?

[Topper727]

Suggestion if not already done.  Put the block to block both for each list.

And I get a lot of blocks from it. Go surf around some bad sites and watch the numbers grow.


[Topper727]

Also a suggestion from BBcan I was told about this.  Setup this page like I did and then force reload to get rid of bad nets not just 1 ip from it.

.png)
.png_thumb)

[SixXxShooTeR]

@Topper727:

try
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware ]
.

Just added this list, it's only showing a Count of 1 tho.

[Topper727]

add them all in a group is what I did so I not see how many each have.  But I have them all and I get pretty good amount of blocks from those lists.. I also have deduplication on so all my lists are stripped of duplicates making them smaller too

[SixXxShooTeR]

Okay, ill give it a try. Tho I have been able to find out what lists are blocking what, like malwarebytes or deviantart.com, by having them displayed individually and not in groups. Once you visit a site you can see which lists are denying or blocking packets.

I also have de-duplication enabled.

Question, I see that you've selected "Unknown" in the ET IQRISK BLOCK LISTS and ET IQRISK Match LISTS. What does that do?

[Topper727]

I made mistake when first setting that up. That is a paid subscription so it does nothing for me.  I do not pay for it.

Click the thanks at top right of my message if I helped you

[ch1ll1man]

We've started using PFBlockerNG on a couple of our firewalls and are using the country block to keep some countries out.    However there are a few IP ranges we would like to let through within those blocked countries and these IP ranges change weekly so we're pulling a txt file into an IPV4 alias via PFBlocker daily updates.

Everything so far is working great but the permit rule created by PFBlockerNG is

IPv4 * pfB_Cloudflare * * * * none pfB_Cloudflare auto rule

What we'd like that rule to say is

IPv4 * pfB_Cloudflare * AN_IP 80 * none pfB_Cloudflare auto rule
IPv4 * pfB_Cloudflare * AN_IP 443 * none pfB_Cloudflare auto rule

AN_IP = an internal IP of a server we have

What's the best advice on this for achieving that?  If I edit the rule PFBlockerNG just destroys it on the Update.