PfBlockerNG

pfcode

Hi,

iptodomain.com (198.50.147.11) was blocked by the pfBlockerNG (ToastedSpam 198.50.128.0/17), so I clicked the Suppression Icon (+) from the Alerts tab, to add the IP to the pfBlockerNGSuppress Alias automatically(198.50.147.11/32, not manually), the 'Enable Suppression' in the General tab is ticked, the rule order is 'pfSense Pass|pfB_Pass|pfB_Block', I did a force update, but pfBlockerNG still block it (the reason was the same: ToastedSpam 198.50.128.0/17), I checked all the setting, and found that nowhere in the pfBlobckerNG settings is using this Alias, other than the 'Enable Suppression' is ticked. What am I missing? Why I can't access the URL where its ip is in the pfBlockerNGSuppress alias?

BTW, when doing an force update/force cron, I didn't see the pgBlockerNGSuppress shown in the Log View screen, also I made the change posted by cauthier on Page 47

BBcan177

Hi pfcode,

You cannot suppress an IP that is in a /17 CIDR… Suppression is only for IPs that are either /32 or /24... Hover-over the Suppression (+) icon, or the List column, and it will give you further instructions...

Basically, you will need to create a new alias ie : "Whitelist" and set the list to "Permit Outbound", then add any IPs that you want to allow outbound in the Custom Box at the bottom of the Alias.

power_matz

Hi,

after reading this thread I installed the current version yetserday on my 2.2 system.
After doing some config everything was doing fine.

I just was wondering that the CPU is all the time at 50% or above. Reduction of the frequency is not happening like before.
On the machine SNORT is / was running and the CPU was at 300 MHz most of the time, now the CPU ist at least at 1000MHz.
Any idea what is so consuming?

After running over night this morning the pfsense box wasn't reachable any more. Wether via GUI nor via ssh terminal.
I had to reboot / switch off and on again.

The box was running very stable since months.

Any idea? Are there some known issues? Are any logs required? I don't know if there were written.

Matthias

doktornotor

Certainly not pfBlockerNG. Beyond the cron jobs running every X hours, this only creates aliases and firewall rules.

Check the CPU usage with something like top and start your own thread in proper forum section.

tim.mcmanus

I'm too lazy to look through 48 pages of discussion to find the link where I can donate to the developer's beer fund for this project?

I want to give back to the coders in the form of foamy suds where I can.

rodymcamp

I had this Happen when i first started adding block lists, I have just upgraded my pfsense over time from way back and there was some temp memory issue that was filling up and causing a crash, I did a clean install and now Everything works great. I really did not get to much into it, I had been wanting to do a clean install for a while and this was just a good excuse.

@power_matz:

Hi,

after reading this thread I installed the current version yetserday on my 2.2 system.
After doing some config everything was doing fine.

I just was wondering that the CPU is all the time at 50% or above. Reduction of the frequency is not happening like before.
On the machine SNORT is / was running and the CPU was at 300 MHz most of the time, now the CPU ist at least at 1000MHz.
Any idea what is so consuming?

After running over night this morning the pfsense box wasn't reachable any more. Wether via GUI nor via ssh terminal.
I had to reboot / switch off and on again.

The box was running very stable since months.

Any idea? Are there some known issues? Are any logs required? I don't know if there were written.

Matthias

power_matz

Thanks for the information. After a restart the system now runs like before.
Maybe its a good thing to restart after adding all the rules.

Matthias

LinuxTracker

@tim.mcmanus:

I'm too lazy to look through 48 pages of discussion to find the link where I can donate to the developer's beer fund for this project?

I want to give back to the coders in the form of foamy suds where I can.

I just went though the same thing.
I have a 2nd issue that I waned to donate w/o logging into Paypal.

Short answer is I put this url in my browser and successfully donated my pittance.

https://paypal.com/xclick/business=BBCan177@gmail.com

(email addres is one from the pfBlockerNG->General tab)

Mr. Jingles

Hi BB :-*

1. The errors we were emailing about appear gone now (?). I had two lists disabled for a week, enabled them yesterday and I think I don't see any errors anymore ( ??? ).
2. I have this weird thing with the dashboard widget: if I add it, it shows up twice. If I remove one of them (the x in the right corner) both are gone. I've attached a screenshot. Latest pfBlockerNG 1.0.9, pfSense 2.2.1.

Would you have any idea?

Bye ;D

pfblockerNG_double_widget.jpg_thumb

cyberbot

after reading this thread . i've installed the latest version on 2.2.2 pfsense 64 bit
after i enable the the pfblockerng the internet stops working.
i am in europe and deny both inbound and outbond of other countries. but somehow after i enable the package my internet stops working. but i can vpn to the box.
any suggestions what i am doing wrong ?

LinuxTracker

@cyberbot:

after i enable the the pfblockerng the internet stops working.
i am in europe and deny both inbound and outbond of other countries. but somehow after i enable the package my internet stops working. but i can vpn to the box.
any suggestions what i am doing wrong ?

When the Internet stops working, can you ping domains? Can you ping external IPs?

Can you give a screenshot of your LAN rules?

Also make sure your country isn't one in the Top 20 countries tab.

tim.mcmanus

Is this package 2.2.3-friendly? I upgrade to 2.2.3 and assume I need to reinstall the package because the widget puked code all over the Dashboard.

![Screen Shot 2015-06-25 at 8.48.24 PM.png](/public/imported_attachments/1/Screen Shot 2015-06-25 at 8.48.24 PM.png)
![Screen Shot 2015-06-25 at 8.48.24 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2015-06-25 at 8.48.24 PM.png_thumb)

phil.davis

That should only happen if you login to the dashboard while packages are reinstalling in the (minutes…) after the upgrade reboot.
Once all packages have installed themselves then those files will exist. A refresh of the dashboard should clear it.

tim.mcmanus

@phil.davis:

That should only happen if you login to the dashboard while packages are reinstalling in the (minutes…) after the upgrade reboot.
Once all packages have installed themselves then those files will exist. A refresh of the dashboard should clear it.

It's still angry. Rebooted the firewall too because of another unrelated upgrade issue. I'll reinstall and that more than likely should fix it.

LinuxTracker

@tim.mcmanus:

Is this package 2.2.3-friendly? I upgrade to 2.2.3 and assume I need to reinstall the package because the widget puked code all over the Dashboard.

I did one so far and pfBNG widget is intact. You aren't working with BBCan177's pfBNG beta, are you?

tim.mcmanus

@LinuxTracker:

@tim.mcmanus:

Is this package 2.2.3-friendly? I upgrade to 2.2.3 and assume I need to reinstall the package because the widget puked code all over the Dashboard.

I did one so far and pfBNG widget is intact. You aren't working with BBCan177's pfBNG beta, are you?

Yes, I am working with the beta. My upgrade had one unrelated issue, so this could possibly be an artifact of a less-than-perfect upgrade on my end.

meruem

when using "Alias Deny", the "Alerts" tab doesn't show any block logs like I think it would.

The log seems weird.. it grows and shrinks with each update… shouldnt it just be one long list with the max rows setting? It also says this at the bottom "Found 11 Alert Entries - Insufficient Firewall Alerts found."

The firewall log seems like it's working against the block list correctly using the alias I set up, but it is not as good because it doesnt give me any indication of in the firewall log that the block was because of the alias

LinuxTracker

@tim.mcmanus:

Yes, I am working with the beta. My upgrade had one unrelated issue, so this could possibly be an artifact of a less-than-perfect upgrade on my end.

Last night, I ran into the same problem with the beta of pfBNG.
As pfSense went through it's post-upgrade package re-installations, it uninstalled pfBNG-beta but couldn't reinstall it with the package settings set to default.

In this case I put the regular pfBNG package back in for now and my widget is behaving.

LinuxTracker

@meruem:

The log seems weird.. it grows and shrinks with each update… shouldnt it just be one long list with the max rows setting?

I'm not clear what you mean.
I think, the Alerts tab pulls it's data from Status: System logs: Firewall, because clearing the Firewall Log clears the Alerts tab.
Do you see any correlation between the weirdness in the Alerts tab and data displayed in Status: System logs: Firewall?

@meruem:

It also says this at the bottom "Found 11 Alert Entries - Insufficient Firewall Alerts found."

You'll get that if the number of displayed entries is less than the value in the Alert Settings

@meruem:

The firewall log seems like it's working against the block list correctly using the alias I set up, but it is not as good because it doesnt give me any indication of in the firewall log that the block was because of the alias

I often have discrepancies in the Alerts tab where I have an incorrect value in the List column - that is - the displayed list isn't in the IPv4 Alias that's noted in the Rule column (it's in a different IPv4 Alias).

Sometimes setting/unsetting deduplication->cron update sets that right.
Other time deleting the associated Firewall Rule and recreating fixes it for a while.

BBcan177

@meruem,

Did you click the checkbox in the firewall rule to enable "logging"?