PfBlockerNG
-
I've upgraded to 2.2
I see pfblocker in the menu', but if I try to access it I see ERROR: No valid package defined.!
I've installed pfblockerng but it cannot start it cause it says:
The Package 'pfBlocker' is currently Enabled. Either Disable pfBlocker, or 'Disable Validation Check' in pfBlockerNG
(checkin the Disable Validation Check remove the error but pfblockerng doesn't insert rules in PF)
How can I disable the old pfblocker ?thanks
Giacomo
-
How can I disable the old pfblocker ?
HI capitangiaco,
You can manually edit the config file /conf/config.xml
<config><enable_cb>on</enable_cb>
<enable_log><inbound_interface>wan</inbound_interface>
<inbound_deny_action>block</inbound_deny_action>
<outbound_interface>lan</outbound_interface>
<outbound_deny_action>reject</outbound_deny_action>
<credits><donation></donation></credits></enable_log></config>and change the <enable_cb>on</enable_cb> to
<enable_cb></enable_cb>
I will be adding a conversion and a proper uninstall to correct this issue going forward. The previous pfBlocker version is not maintained by me.
Please make a backup before manually editing that file!
-
can you please offer an estimation for the release of the final version?
Hi fakemoth,
I am the Developer of pfBlockerNG.
wbennett77 just posted the first post in this Thread which I Hijacked (with his permission of course :) )
The package is released. I set it as "Beta" until I was sure that it was stable. I hope to change that to "Stable" in the upcoming weeks. But there is no reason why you cannot install it in production. I have not seen any serious bugs so far and any bugs that are reported, have been promptly fixed.
-
Thank you for the thorough answer, so my guess is that if an IP exists in two lists - one configured with "Deny Inbound" and one with "Deny Both", the "Deny Both" is the one that remains after deduplication?
Hi st4t1c,
De-duplication has nothing to do with the Firewall Rule processing order.
Basically, pfSense Floating Rules are processed first (top to bottom), then the Interfaces are processed (top to bottom)… So on a first match of the Firewall Rule criteria, the firewall will act on the settings in that particular rule.
If you want to have certain Rules to use a specific set of Alias/Lists, then you need to make "Alias Native" Rules to be able to fine-tune that functionality.
-
Review it, test it, and feel free to include it yourself in the next bugfix version.
Thanks Phil for spotting that… I ran it thru some testing and it looks correct now. Will get that into a commit.
Here is a table to show the various Base Hour/Frequency Settings.
Base Hour [ 0 ] 2hr [0,2,4,6,8,10,12,14,16,18,20,22] 3hr [0,3,6,9,12,15,18,21] 4hr [0,4,8,12,16,20] 6hr [0,6,12,18] 8hr [0,8,16] 12hr [0,12] Base Hour [ 1 ] 2hr [1,3,5,7,9,11,13,15,17,19,21,23] 3hr [1,4,7,10,13,16,19,22] 4hr [1,5,9,13,17,21] 6hr [1,7,13,19] 8hr [1,9,17] 12hr [1,13] Base Hour [ 2 ] 2hr [2,4,6,8,10,12,14,16,18,20,22,0] 3hr [2,5,8,11,14,17,20,23] 4hr [2,6,10,14,18,22] 6hr [2,8,14,20] 8hr [2,10,18] 12hr [2,14] Base Hour [ 3 ] 2hr [3,5,7,9,11,13,15,17,19,21,23,1] 3hr [3,6,9,12,15,18,21,0] 4hr [3,7,11,15,19,23] 6hr [3,9,15,21] 8hr [3,11,19] 12hr [3,15] Base Hour [ 4 ] 2hr [4,6,8,10,12,14,16,18,20,22,0,2] 3hr [4,7,10,13,16,19,22,1] 4hr [4,8,12,16,20,0] 6hr [4,10,16,22] 8hr [4,12,20] 12hr [4,16] Base Hour [ 5 ] 2hr [5,7,9,11,13,15,17,19,21,23,1,3] 3hr [5,8,11,14,17,20,23,2] 4hr [5,9,13,17,21,1] 6hr [5,11,17,23] 8hr [5,13,21] 12hr [5,17] Base Hour [ 6 ] 2hr [6,8,10,12,14,16,18,20,22,0,2,4] 3hr [6,9,12,15,18,21,0,3] 4hr [6,10,14,18,22,2] 6hr [6,12,18,0] 8hr [6,14,22] 12hr [6,18] Base Hour [ 7 ] 2hr [7,9,11,13,15,17,19,21,23,1,3,5] 3hr [7,10,13,16,19,22,1,4] 4hr [7,11,15,19,23,3] 6hr [7,13,19,1] 8hr [7,15,23] 12hr [7,19] Base Hour [ 8 ] 2hr [8,10,12,14,16,18,20,22,0,2,4,6] 3hr [8,11,14,17,20,23,2,5] 4hr [8,12,16,20,0,4] 6hr [8,14,20,2] 8hr [8,16,0] 12hr [8,20] Base Hour [ 9 ] 2hr [9,11,13,15,17,19,21,23,1,3,5,7] 3hr [9,12,15,18,21,0,3,6] 4hr [9,13,17,21,1,5] 6hr [9,15,21,3] 8hr [9,17,1] 12hr [9,21] Base Hour [ 10 ] 2hr [10,12,14,16,18,20,22,0,2,4,6,8] 3hr [10,13,16,19,22,1,4,7] 4hr [10,14,18,22,2,6] 6hr [10,16,22,4] 8hr [10,18,2] 12hr [10,22] Base Hour [ 11 ] 2hr [11,13,15,17,19,21,23,1,3,5,7,9] 3hr [11,14,17,20,23,2,5,8] 4hr [11,15,19,23,3,7] 6hr [11,17,23,5] 8hr [11,19,3] 12hr [11,23] Base Hour [ 12 ] 2hr [12,14,16,18,20,22,0,2,4,6,8,10] 3hr [12,15,18,21,0,3,6,9] 4hr [12,16,20,0,4,8] 6hr [12,18,0,6] 8hr [12,20,4] 12hr [12,0] Base Hour [ 13 ] 2hr [13,15,17,19,21,23,1,3,5,7,9,11] 3hr [13,16,19,22,1,4,7,10] 4hr [13,17,21,1,5,9] 6hr [13,19,1,7] 8hr [13,21,5] 12hr [13,1] Base Hour [ 14 ] 2hr [14,16,18,20,22,0,2,4,6,8,10,12] 3hr [14,17,20,23,2,5,8,11] 4hr [14,18,22,2,6,10] 6hr [14,20,2,8] 8hr [14,22,6] 12hr [14,2] Base Hour [ 15 ] 2hr [15,17,19,21,23,1,3,5,7,9,11,13] 3hr [15,18,21,0,3,6,9,12] 4hr [15,19,23,3,7,11] 6hr [15,21,3,9] 8hr [15,23,7] 12hr [15,3] Base Hour [ 16 ] 2hr [16,18,20,22,0,2,4,6,8,10,12,14] 3hr [16,19,22,1,4,7,10,13] 4hr [16,20,0,4,8,12] 6hr [16,22,4,10] 8hr [16,0,8] 12hr [16,4] Base Hour [ 17 ] 2hr [17,19,21,23,1,3,5,7,9,11,13,15] 3hr [17,20,23,2,5,8,11,14] 4hr [17,21,1,5,9,13] 6hr [17,23,5,11] 8hr [17,1,9] 12hr [17,5] Base Hour [ 18 ] 2hr [18,20,22,0,2,4,6,8,10,12,14,16] 3hr [18,21,0,3,6,9,12,15] 4hr [18,22,2,6,10,14] 6hr [18,0,6,12] 8hr [18,2,10] 12hr [18,6] Base Hour [ 19 ] 2hr [19,21,23,1,3,5,7,9,11,13,15,17] 3hr [19,22,1,4,7,10,13,16] 4hr [19,23,3,7,11,15] 6hr [19,1,7,13] 8hr [19,3,11] 12hr [19,7] Base Hour [ 20 ] 2hr [20,22,0,2,4,6,8,10,12,14,16,18] 3hr [20,23,2,5,8,11,14,17] 4hr [20,0,4,8,12,16] 6hr [20,2,8,14] 8hr [20,4,12] 12hr [20,8] Base Hour [ 21 ] 2hr [21,23,1,3,5,7,9,11,13,15,17,19] 3hr [21,0,3,6,9,12,15,18] 4hr [21,1,5,9,13,17] 6hr [21,3,9,15] 8hr [21,5,13] 12hr [21,9] Base Hour [ 22 ] 2hr [22,0,2,4,6,8,10,12,14,16,18,20] 3hr [22,1,4,7,10,13,16,19] 4hr [22,2,6,10,14,18] 6hr [22,4,10,16] 8hr [22,6,14] 12hr [22,10] Base Hour [ 23 ] 2hr [23,1,3,5,7,9,11,13,15,17,19,21] 3hr [23,2,5,8,11,14,17,20] 4hr [23,3,7,11,15,19] 6hr [23,5,11,17] 8hr [23,7,15] 12hr [23,11] -
Hello
I use multiple subnet for interface, use deny inbound and Enable Suppression
For example ,LAN have 192.168.1/24 and 163.22.51.126/25 (use Virtual IPs for multiple subnet)
IN alerts tabs, i found most suppress button is not in source but in destination
Any idea?
Thanks~
-
I use multiple subnet for interface, use deny inbound and Enable Suppression
IN alerts tabs, i found most suppress button is not in source but in destinationHi ntct,
I have a fix, if you are able to test it, send me a PM and I will give some instructions. -
I load new pfblockerng_alerts.php
It's corrected
Thank BBcan177!!
-
Thanks Phil for spotting that… I ran it thru some testing and it looks correct now. Will get that into a commit.
Here is a table to show the various Base Hour/Frequency Settings.
Base Hour [ 0 ] 2hr [0,2,4,6,8,10,12,14,16,18,20,22] 3hr [0,3,6,9,12,15,18,21] 4hr [0,4,8,12,16,20] 6hr [0,6,12,18] 8hr [0,8,16] 12hr [0,12]How can I change Frequency? I can't find it anywhere.
-
When you add an Alias with a bunch of lists, you get to choose the Update Frequency. So for each Alias you can decide how often to check for updates.
-
I mean the frequency of the CRON Event found in the Alerts tab. It seems to run every 60 minutes. Should I be bothered about that?
-
I mean the frequency of the CRON Event found in the Alerts tab. It seems to run every 60 minutes. Should I be bothered about that?
The Alerts Tab is "hard-coded" to refresh every "60 seconds" if you click the "Auto-Refresh" checkbox. You shouldn't need to refresh more often. After a refresh, you should probably be analyzing the alerts :)
-
All my lists are set to update weekly.
The "NEXT Scheduled CRON Event will run at"…. it runs every 60 minutes. Is that normal?
Eg: Now it shows
NEXT Scheduled CRON Event will run at 17:00 in 1 Minutes
After few minutes it shows
NEXT Scheduled CRON Event will run at 18:00 in 59 Minutes -
All my lists are set to update weekly.
I would expect most lists to change daily and any good blacklists to be updated on an hourly basis. I can however add an option in the future to edit the cron settings (min/hour/day etc)
-
I'd be concerned if the hourly cron is actually pinging/contacting the block list servers every hour.
iBlocklist for example changed their free download policy to weekly. "…10 TERAbytes of data for us each month......free users will only be able to download updated lists once per week." At that time I was using old pfblocker and it had only a maximum of 24 hrs update interval for lists. Then I disabled the update option and created a custom weekly cron job.
-
All my lists are set to update weekly.
The "NEXT Scheduled CRON Event will run at"…. it runs every 60 minutes. Is that normal?
Eg: Now it shows
NEXT Scheduled CRON Event will run at 17:00 in 1 Minutes
After few minutes it shows
NEXT Scheduled CRON Event will run at 18:00 in 59 MinutesYes, it is normal. The cron job is set to run every hour. It checks what aliases have what frequency of update and runs updates for the ones that are due.
In our case, if you only have Aliases that are set to update weekly, then the cron job will wake up 24*7=168 times a week, but 167 times it will quickly find it has nothing to do and exit. -
Yes, it is normal. The cron job is set to run every hour. It checks what aliases have what frequency of update and runs updates for the ones that are due.
In our case, if you only have Aliases that are set to update weekly, then the cron job will wake up 24*7=168 times a week, but 167 times it will quickly find it has nothing to do and exit.Okay great; thanks for the clarification : )
-
I'd be concerned if the hourly cron is actually pinging/contacting the block list servers every hour.
To add onto what Phil posted above, the first step is to compare the Alias Frequency setting to the current hour and if they are a match (ie needs to be updated) then the second step is to compare the previously downloaded files timestamp to the List providers URL. If the file remains unchanged, then the update for that list is skipped.
iBlocklist for example changed their free download policy to weekly.
Just so you know that the post you linked is from 2013. I have not seen any issues with IBlock restricting Downloads for the free service.
I would also recommend that there are several other alternative lists available. If you are updating once per week, you are missing a lot of current threat analysis that these Threat Source providers have. I did post a few other Sources in this thread. There are lots of others. Just need to do your homework. :) But if you are just using pfBlockerNG for IBlock lists, then you are doing yourself a big injustice in my opinion.
-
Is anyone familiar with Block List at https://www.blocklist.de/en/index.html ? They look very interesting.
I run Fail2Ban on my servers. It's set with a hair trigger that after 2 failed login attempts via SSH, FTP, etc the IP is blocked for 2 hours. It then sends out an email for the IP and ownership to me. Block List gets their IPs from servers running Fail2Ban. Their lists are updated every 30 minutes and it's free. So if I get a hack attempt and I have Fail2Ban notifiy Block List, they will then update their lists in 30 minutes. Tf I have pfBlockerNG checking every hour, that IP is automatically blocked from my entire network.
At least the above sounds it could be too good to be true. So has anyone had any experience with them? Are there any holes in my theory?
-
Yes I use that list also but I do not participate in the IP sharing part.
I use Ossec (part of my Security Onion deployment) on my servers which is similar to what fail2ban is doing. If you can get fail2ban to output the IP to a local logfile, You can have pfBlockerNG pull that file on an hourly basis to block that IP for your whole network. I actually block the whole /24. My mail server can get a spam email or a brute force attack from several different IPs in the same /24 over a short period of time. I really hate spammers and pfBNG really has cut down on my Inbound Spam traffic. (like over 95% reduction)… ;D
