PfBlockerNG
-
It seems to be fixed now. Post back if you continue to have any issues.
-
If your interested to read up on Bambenek Consultings work:
"The New Scourge of Ransomware: A Study of CryptoLocker and Its Friends"
Published on Mar 19, 2015
By Lance James and John Bambenek
https://www.youtube.com/watch?v=X994Rdt-36oMeat of the video starts at around the 9-10min mark.
-
Here is another Threat Source for pfBlockerNG :
This feed is provided by : bambenekconsulting.com
These lists cover the following type of Threats:
-
Banjori
-
Bebloh/URLZone
-
Cryptolocker
-
Cryptowall
-
Dyre
-
Geodo
-
Hesperbot
-
Matsnu
-
Necurs
-
P2P GOZ
-
PT GOZ / New GOZ
-
Pushdo
-
Qakbot
-
Ramnit
-
Symmi
-
Tinba / TinyBanker
Here is a list of all the Feeds available: All Feeds
I would recommend using the two main IP lists which encompass all of the individual Lists:
c2 IP Feed Master Feed of known, active and non-sinkholed C&Cs IP addresses.
c2 All Indicator Feed Master Feed of known, active and non-sinkholed C&Cs indicators
Use the "html" Format to download these Lists. Download frequency of atleast once per day.
** Please read their License and please donate to the charity they run called the "Tumaini Foundation".
If you see Alerts to any of these Lists, please take additional measures to clean up any infections as these IPs are very malicious. So please put these lists into its own Alias.
Thanks for this and your work on pfBlockerNG; a welcomed upgrade to
pfBlocker.Just started using pflockerNG and have a suggestion. When clicking on
the 'Cancel' button instead of reloading the page, it should take you
back to the previous page. For example, when editing/adding an
alias/list would take you back to the main alias/list page.Maybe others like the current function. Just seems that when canceling
should go to the previous page, a reload does not convey that whatever
was done was canceled.Thank You
-
-
Hi All,
The filter function for the alerts doesn't seem to be working properly (pfSense 2.2.1, pfBlockerNG 1.06).
For example right now when I have a look at my alerts only within the last 2 hours I have 5 entries with destination port 25.
In the total list (500 entries, around 2 days) there are around 100 entries with destination port 25.When I set a filter for destination port = 25 it displays only three items (out of the approximate 100) and when I change the filter to ^25$ then only one entry (the most recent one) is displayed.
Any idea what I can try to be able to correctly filter by destination port? -
When clicking on the 'Cancel' button instead of reloading the page, it should take you
back to the previous page.In my setup, this is what it does, so not sure why it doesn't do that for you? The code for this is in pfSense base code, (pkg_edit.php). What theme are you using?
-
When I set a filter for destination port = 25 it displays only three items (out of the approximate 100) and when I change the filter to ^25$ then only one entry (the most recent one) is displayed.
Any idea what I can try to be able to correctly filter by destination port?Hi ConfuesedUser, what did you input in the "Deny Entries" in the Alert Settings at the top of the Alerts Page? It will only report this number of Alerts (With/without Filtering). My tests show everything to be ok with all of the Filtering options?
-
In my setup, this is what it does, so not sure why it doesn't do that
for you? The code for this is in pfSense base code, (pkg_edit.php). What
theme are you using?Using the pfsense_ng theme, reverted to the pfsense theme. Still get the
same in chromium and firefox; after logging out closing the window and
opening a new window and logging back in. In case that would make a
difference.Thank You
-
When I set a filter for destination port = 25 it displays only three items (out of the approximate 100) and when I change the filter to ^25$ then only one entry (the most recent one) is displayed.
Any idea what I can try to be able to correctly filter by destination port?Hi ConfuesedUser, what did you input in the "Deny Entries" in the Alert Settings at the top of the Alerts Page? It will only report this number of Alerts (With/without Filtering). My tests show everything to be ok with all of the Filtering options?
Hi BBcan177,
I attached three screenshots that probably are more helpful than me writing a lot stuff.
not_filtered.jpg: As the name says. I was limiting to 50 deny and using Firefox search it found 12 matches (see at the bottom). 7 entries with destination port 50 are visible without scrolling down. Since it is an internal mail server (port forward) it is showing a private IP as destination.
filtered_1.jpg: Adding a destination port filter of '25' already reduced the amount of entries to 3.
filtered_2.jpg: Adding a destination port filter of '^25$' (like suggested on the page) reduced the amount of entries to 1 (so basically 11 are missing).
Not part of those screenshots:
When I change the number of deny entries to 500 there are in total 102 entries with 192.168.50.10:25. Applying the '^25$' filter as described above still shows only one entry.
-
Until this bug is fixed, debugging similar issues is a pure waste of time.
-
Hi ConfuesedUser,
If you look at your pfSense Firewall log do you have IGMP alerts (If so, create a Firewall rule to drop those packets until the Devs fix that issue)? If you filter port 25 in the Firewall log do they show ok?
I can't reproduce this error on my boxes. Maybe try to clear the Firewall log and start with a Fresh Log and see if that fixes it? Report back how it goes. Can you filter other Settings in the Alerts Page? or is this issue limited to the "Dest Port" Filter field?
-
If you look at your pfSense Firewall log do you have IGMP alerts (If so, create a Firewall rule to drop those packets until the Devs fix that issue)?
This sadly seems impossible. Best you can do is hiding them from the GUI by reverting the patch that made them show. But they will still get logged and screw things like this.
-
Hello all,
i sorted all to work fine except pflocker. Can someone please see this printscreens and tell me what caused this? Seems theres no alerts for me at all. Nothing.
Many thnx.
-
Hi ConfuesedUser,
If you look at your pfSense Firewall log do you have IGMP alerts (If so, create a Firewall rule to drop those packets until the Devs fix that issue)? If you filter port 25 in the Firewall log do they show ok?
I can't reproduce this error on my boxes. Maybe try to clear the Firewall log and start with a Fresh Log and see if that fixes it? Report back how it goes. Can you filter other Settings in the Alerts Page? or is this issue limited to the "Dest Port" Filter field?
Hi BBCan177,
To answer your questions:
-
There are no IGMP alerts in the logs
-
In the firewall logs all shows up correctly / as expected when filtering for dest. port 25
-
oh dear, I was reading end executing your questions in order, so I cleared the firewall logs now which makes it pointless to filter for other settings now in the alerts
I will let the logs fill a bit and I will test the filters again tomorrow.
Btw, my log file size limit is at 20MB. Could the big size be causing issues?Many thanks for your help!
One more question:
To be able to see the country for firewall logs is a great feature. Would it be possible to add a check box to allow querying all rules in the alerts tab? Currently it is hard-coded to filter for "pfB_".
I think it would be pretty cool to be able to see all logs listed with the country. -
-
I have a couple questions regarding my setup of pfBlockerNG
I setup pfBlockerNG to block inbound connections from nearly all countries and then set up some IPv4 lists (Emerging Threats, iBlocklist, etc.) in match inbound mode to monitor. I have the same/similar IPv4 lists setup to match and log outbound connections (preceded with OB in the name)
I checked after 24 hours and had approximately 100 matches on the IPv4 lists. I then switched them to Deny inbound. After another 24 hours I checked and I have very few blocks on the IPv4 lists. I do have a lot of blocks on the country lists. Is it possible that there is overlap between the country blocks and IPv4 list blocks and so the block statistics are only counting a block per the country blocking and not the list?
Also, the number of blocked connections I'm seeing on the pfBlockerNG widget don't match what is showing up in the alerts. I have the country blocking set to not log, but all others are set to log. Here is what I am seeing on the widget, and below that is what I am seeing on the pfBlockerNG alerts.
Shouldn't I be seeing 8 blocked connections in the alert and 15 matched connections?
-
Hello ha11oga11o,
There is an issue as you have all "-" in the Widget Packet Counts.
Please reset all files with the following steps from the General Tab:
- Uncheck "Keep Settings"
- Disable "pfBlockerNG"
- Click "Save"
After it completes, reverse the steps above. Then run a "Force Update" The widget Packet Counts should start with "0's".
NOTE - Please don't select Countries in the 'TOP' alias, and then select the same Countries in the other Continent Tabs.
-
I will let the logs fill a bit and I will test the filters again tomorrow.
Btw, my log file size limit is at 20MB. Could the big size be causing issues?I don't think so, but please let me know how it went after Resetting the Logs?
To be able to see the country for firewall logs is a great feature.
I could look at that. It will add some overhead but I could make it into an 'option'.
-
I don't think so, but please let me know how it went after Resetting the Logs?
Thanks, will do so tomorrow.
To be able to see the country for firewall logs is a great feature.
I could look at that. It will add some overhead but I could make it into an 'option'.
I just gave it a quick try (without the check boxes, simply hard coded since my php knowledge is pretty much non-existent) and changed the following:
Old:
$data = exec ("/sbin/pfctl -vv -sr | grep 'pfB_'", $results);New:
$data = exec ("/sbin/pfctl -vv -sr", $results);Old:
if (preg_match("/USER_RULE: (\w+)/",$result,$desc))New:
if (preg_match("/USER_RULE: (.*)\"/",$result,$desc))It would be very nice to be able to flip them both by toggling one check box.
Also it would be good if this one could be toggled as well:
//Remove any Duplicate IPs $pfb_local = array_unique($pfb_local);Simple reason: This allows me to see for incoming mails if the same address tried multiple times and has been blocked by the spam filter on the mail server. If that happens (and it does) for some countries again and again which I don't do business with anyway I'd add them to the country block list.
Anyway, one more thing I completely forgot: pfBlockerNG is absolutely great!!!
-
Hi jeffh,
I would read this thread for my comments on 'Blocking the world, and allow a few Countries" and reverse that approach to Permit a select few Countries instead. pfSense is a stateful Firewall by design and is already Implicitly blocking on the Inbound.
If you want to protect some open ports, you should look at creating an Alias rule to protect the individual Inbound Port(s). Otherwise, Blocking on the Inbound with no open ports is inspecting packets that are already going to be dropped by the Implicit Deny Rule.
The Alerts Tab reads the Firewall Log to get its data. The Firewall logs only hold a certain amount of data (Can be configured in the Firewall Settings). The Firewall log is also cleared on a regular basis and thus older alerts will disappear.
The Widget Packet Counts are read from pfSense 'pfctl'. Those stats are cleared if you edit/save and Rules/Nat etc and a 'Filter_reload' occurs. So the counts will increase forever if you do not make any config changes. But as per above, the Firewall log is cleared and this is why these alerts are not being displayed in the Alerts Tab.
-
I just gave it a quick try (without the check boxes, simply hard coded since my php knowledge is pretty much non-existent) and changed the following
Thanks. I will take a look and see if I can incorporate that.
Also it would be good if this one could be toggled as well:
This is the code that skips 'Repeated Alerts' You can comment out the "continue" line to skip that process.
409 // Skip Repeated Alerts 410 if (($pfbalert[3] . $pfbalert[8] . $pfbalert[10]) == $previous_dstip || ($pfbalert[3] . $pfbalert[7] . $pfbalert[9]) == $previous_srcip) 411 continue;Anyway, one more thing I completely forgot: pfBlockerNG is absolutely great!!!
Thanks! :)
-
Hi jeffh,
I would read this thread for my comments on 'Blocking the world, and allow a few Countries" and reverse that approach to Permit a select few Countries instead. pfSense is a stateful Firewall by design and is already Implicitly blocking on the Inbound.
If you want to protect some open ports, you should look at creating an Alias rule to protect the individual Inbound Port(s). Otherwise, Blocking on the Inbound with no open ports is inspecting packets that are already going to be dropped by the Implicit Deny Rule.
Thanks BBcan177, I'll read through this thread, but that definitely makes sense. Not sure why I didn't think of that approach from the get go.
