PfBlockerNG
-
Hi pfcode,
Its best to make a new pfBlockerNG alias called "Whitelist". Add any IPs that you want to access (these are the destination IPs, not the local LAN IP) in the custom entry box at the bottom of the Whitelist Alias. Set the "List Action" to "Permit Outbound".
The rule order setting should ensure the this "Permit" rule is above the "Block" rules.
-
Hi pfcode,
Its best to make a new pfBlockerNG alias called "Whitelist". Add any IPs that you want to access (these are the destination IPs, not the local LAN IP) in the custom entry box at the bottom of the Whitelist Alias. Set the "List Action" to "Permit Outbound".
The rule order setting should ensure the this "Permit" rule is above the "Block" rules.
Hi, BB
Thanks for the answer and suggestion, Yes, I was using pfBlockerNG Whitelist alias but gave up later, because there were so many Apps installed on that Android Media Box, P2P TV, IPTV app, …, so adding destination IPs in the custom entry box is PITA, tons of different IPs.
My concern is why the rule I put on the top of the floating rule doesn't work properly.
-
Hello all, long time lurker, first time poster
Got a few noob questions in regards to pfblockerNG. Only other packages i've installed are snort and ntopng. Everything is working well with pfblockerNG except suppression and allowing traffic to pass. For example, a list that I'm currently using (http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz) is blocking Facebook. I see entries in the Alerts that relate to Facebook, so i clicked on the + to add it to the suppression list.
Here's a screentshot of the specific IP address:
The Ip address shows up in the suppression list that pfblocker creates:
Without the list enabled, I am able to access Facebook no problem (with snort running on WAN with plenty of ET rules). However, with this list enabled, i find that suppression is not working. Am i doing something wrong?
Also, on a related note, i'm trying to allow "akamaitechnologies" (most likely, content hoster for Facebook) pass through my lists; suppression is not working as there's many servers/hostnames that i cannot keep adding as they constantly change, including the port numbers. How can i allow all this type of traffic to pass? see screenshot below:
thanks for any help!
-
My concern is why the rule I put on the top of the floating rule doesn't work properly.
Rule looks ok. Try to clear the firewall logs and clear the Firewall State table.
-
Hello all, long time lurker, first time poster
Hi cassius, I would not recommend those two IBlock lists. They have too many false positives. I wrote a script which was posted in the thread by doktornotor a few posts back which has better Blocklists than these from IBlock.
Also you can only use "Suppression" for a /24 or /32 Block… Take a look at the Alerts Tab and underneath the List column, will show the IP and CIDR of the Block. Hover over the list column, and you will get a "Popup" Description on how to Whitelist IPs.
-
I use a custom ipv4 list ( /var/db/pfblockerng/spammers.txt ) with 1200+ address listed like such: 212.71.238.0/24 and it appears that sometimes pfblockerng misses blocking some of the address in the list. It seems it doesn't block any /16 ranges either. Every morning I discover some duplicate spam addresses and find that I already entered them in the custom list. When this happens I also enter the address into the IPv4 Custom Address(es) section at the bottom, hit save, then update > full reload. I'm concerned that the size of the custom list might cause problems because it is stored as 'Base64' format. I think the old version worked with the /16 /20 /24, etc. ranges and they were blocked. Is there anywhere I might look at to ensure that the spammers.txt file is consumed and acted upon correctly? Thank you.
-
I may start my own thread, but I'll give my experience.
I'm newer to pfsense.
I had pfBlockerNG setup and working great. Site had a power outage and after pfsense came back online, nothing would route / talk to the outside world. Firewall Logs showed no blocking. If I disabled pfBlocker (tick box), everything started working perfectly.
Not sure what to think.
Any advice on approaching this to diagnose it? -
Site had a power outage and after pfsense came back online, nothing would route / talk to the outside world. Firewall Logs showed no blocking.
- Reinstall
- Restore configuration backup
- Get UPS
-
Try a "Force Reload". If that has issues, then uncheck "keep settings" in the general tab, then disable pfBlockerNG. This should clear all of the downloaded files. Then re-check "keep", re-enable pfBlockerNG and run a "Force Update".
-
Hello!
Trying to (re)install pfBlockerNG from scratch - but the package does not appear in the package manager…? Any ideas?
Thanks!
-
If you have it installed it won't appear in the "Available" tab as its already installed… You can goto "Installed Packages" Tab and click the "Pkg" Icon for pfBNG...
-
If you have it installed it won't appear in the "Available" tab as its already installed… You can goto "Installed Packages" Tab and click the "Pkg" Icon for pfBNG...
Very odd - I uninstalled it and it confirmed uninstallation, removed it from the installed package view but then I did not think to refresh the page… I just so happened to click on the installed package list and lo-and-behold, it was still there!
Uninstalled it again... Reinstalled - now all appears to be well!
-
My Alerts -> Auto-Resolve quit auto-resolving a bit back.
It's a small thing among pfBlockerNG greatness, yet I miss it.IPs are still resolving in the Firewall logs when I click !. That seems a good sign.
What I tried:
I've reviewed pfBlockerNG settings and don't see anything amiss.
I've tried adjusting interfaces and other options in the DNS resolver
I've tried telling pfSense to only use the DNS servers listed in General
I've reinstalled pfBlocker package.What I have:
pfSense 2.2.2 x64 running on a Dell quad core Xeon w/ 4GB RAM
Lots of lists in pfBlockerNG, some really large.
Also running Snort, Squid3+SquidguardAny thoughts anyone?
Appreciated. -
How long is your alert list?
-
How long is your alert list?
Dang. You've hit on it.
I had tried with different deny sizes - between 30 and 100 but I always left the Match at 30.
After your reply I set match to 0 and deny to 30 and it works again.Thanks dude!
-
pfBlockerNG v1.09 Release Notes:
-
Several under-the-hood code changes.
-
Added a 'Cron Interval' setting in the 'General' Tab. Previously Cron would run each hour.
-
Added function to check if the Cron task has changed, and only update if required (reduce config backups)
-
The 'Update Tab' uses the new Cron Interval setting to show the Next Cron task and Time remaining.
-
Improved the logging to the pfblockerng.log (Reduce empty lines and some other tweaks)
-
The parsing of IPs on downloads has been adjusted to remove the '/32' CIDRs (and leave just the IP address). Also parse for Ranges before parsing for CIDR or Single IP addresses.
Next release will move away from a Regex Style function to a faster, more efficient string functions. -
Input Validation has been added to the IPv4/6 Tabs. Unfortunately, if there is an error, it doesn't save the last inputted settings, and you will need to re-enter all of the input data.
-
GUI changes to combine like-fields together. ie - 'General' Tab, Inbound Ports options, and the Continent pages now have the IPv4/6 Tables side-by-side.
-
Added ability to move Aliases in the IPv4/6 Tabs. 'Click+hold' and move the Alias to any line position required.
-
Widget has been overhauled to make it more efficient. Added 'Wrench Icon' which will allow for some customization's.
-
Widget now allows pivoting from the Packet Count column to the Alerts Tab, and it will load the approproate filters to show the associated Alerts. Please note that if the the pfSense Firewall Log has been cleared, old Alerts will not show in the 'Alerts Tab'.
Also added an 'Advanced' Inbound Firewall Rules Settings':
This will allow you to create pfSense 'Port' and 'Destination' Aliases which can be used with the Auto-Rules created by pfBlockerNG.
Since pfSense is a stateful firewall by design, a 'Deny Inbound' or 'Deny Both' will create an Inbound rule in the WAN Firewall Rules tab. Previously it will log Alerts for Packets that are already being blocked by the pfSense Default implicit Deny rule.
This new feature will allow fine-tuning of the Inbound Rules to Alert only on the Open Ports that you have configured in these new settings. If you require a more complicated rule, please continue to use the 'Alias Type' Rules instead.
Here is a screenshot, showing some Port and Destination Aliases.
NOTE: Please DO NOT use "pfB_" or 'pfb_' in the start of the Alias name!!For the IP aliases, please use the "IP Network Type" alias.
Screenshot showing the Adv. Inbound Settings using the pfSense Aliases created above:
Screenshot showing the Auto-Created Firewall rules using the pfSense Aliases:
-
-
I have a local blocklist that I add to several times a day. It is stored in /var/db/pfblockerng/MyBlocklist.txt
I have set it to update every hour, however, the cron job fails to update:**Remote timestamp: Mon, 01 Jun 2015 19:03:19 GMT
Local timestamp: Mon, 01 Jun 2015 19:03:19 GMT
Remote file unchanged. Download TerminatedNo Updates required.
CRON PROCESS ENDED
UPDATE PROCESS ENDED**What am I missing? It is obviously comparing timestamps… I edited the original file this morning.
Is it looking at a different file?Any help is appreciated
Chris
-
Problem solved by BBcan177 with a minor edit to the following file:
/usr/local/www/pfblockerng/pfblockerng.php
Line 192
if (file_exists($local_file)) {
// Determine if URL is Remote or Local
if ($host['host'] == "127.0.0.1" || $host['host'] == $pfb['iplocal'] || empty($host['host'])) {
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));
} else {Original:
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));NEW:
$remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($list_url));Thanks!
To be very clear, change the variable $local_file to $list_url
-
Hi,
iptodomain.com (198.50.147.11) was blocked by the pfBlockerNG (ToastedSpam 198.50.128.0/17), so I clicked the Suppression Icon (+) from the Alerts tab, to add the IP to the pfBlockerNGSuppress Alias automatically(198.50.147.11/32, not manually), the 'Enable Suppression' in the General tab is ticked, the rule order is 'pfSense Pass|pfB_Pass|pfB_Block', I did a force update, but pfBlockerNG still block it (the reason was the same: ToastedSpam 198.50.128.0/17), I checked all the setting, and found that nowhere in the pfBlobckerNG settings is using this Alias, other than the 'Enable Suppression' is ticked. What am I missing? Why I can't access the URL where its ip is in the pfBlockerNGSuppress alias?
BTW, when doing an force update/force cron, I didn't see the pgBlockerNGSuppress shown in the Log View screen, also I made the change posted by cauthier on Page 47
-
Hi pfcode,
You cannot suppress an IP that is in a /17 CIDR… Suppression is only for IPs that are either /32 or /24... Hover-over the Suppression (+) icon, or the List column, and it will give you further instructions...
Basically, you will need to create a new alias ie : "Whitelist" and set the list to "Permit Outbound", then add any IPs that you want to allow outbound in the Custom Box at the bottom of the Alias.
