PfBlockerNG

I have a couple questions:

Can PFBlockerNG work with lists in p2p.gz format? I didn't see it listed in the IPv4/IPv6 tabs.

Also can PFBlockerNG use snort lists for IP blocking?

Thanks.

cyberbot

Thank you for the package much appreciate it .
after applying the settings on the pfBlockerNG my internet stops working,
i've followed this video for the setup but after i enable pfBlockerNG the internet stops working

https://www.youtube.com/watch?v=vgM5JRo575U

Mr. Jingles

@cyberbot:

Thank you for the package much appreciate it .
after applying the settings on the pfBlockerNG my internet stops working,
i've followed this video for the setup but after i enable pfBlockerNG the internet stops working
https://www.youtube.com/watch?v=vgM5JRo575U

I scrolled through that vid but, and sorry to sound like I do ( ;D ) but that is the usual useless non-tuto, of which you can find a zillion; they never even show it works. They'd better of going out walking the dog than wasting their - and all the other populants of this earth - time.

That aside: do you have any floating rules generated in the firewall? What do your firewall logs show you?

Your much better of reading this (yes, long, I know :-[ ) thread, where BB has added tons of information.

If you don't want to waste so much time reading this thread, remember this: BB wasted his time answering in this thread ;D

Mr. Jingles

**To all, just a kind informational note:

rumor has it BB is currently quite busy with extremely important stuff, so expect some delays in him answering here.**

Jamerson

i am having the same issue can't get the internet working after the pfblockerNG is enabled.
Firewall rules from the LAN are allowed to everything,
from the WAN is as usually allowing the OPENVPN.

cyberbot

@Mr.:

@cyberbot:
Thank you for the package much appreciate it .
after applying the settings on the pfBlockerNG my internet stops working,
i've followed this video for the setup but after i enable pfBlockerNG the internet stops working
https://www.youtube.com/watch?v=vgM5JRo575U
I scrolled through that vid but, and sorry to sound like I do ( ;D ) but that is the usual useless non-tuto, of which you can find a zillion; they never even show it works. They'd better of going out walking the dog than wasting their - and all the other populants of this earth - time.

That aside: do you have any floating rules generated in the firewall? What do your firewall logs show you?

Your much better of reading this (yes, long, I know :-[ ) thread, where BB has added tons of information.

If you don't want to waste so much time reading this thread, remember this: BB wasted his time answering in this thread ;D
[/quote]

thank you for your answer.
there is no particular firewall rules to block the internet. everything works fine untill the pfblocker is activated and stops things working.

f34rinc

@shadowset:

I have a couple questions:

Can PFBlockerNG work with lists in p2p.gz format? I didn't see it listed in the IPv4/IPv6 tabs.

Also can PFBlockerNG use snort lists for IP blocking?

Thanks.

Can you link me to the .gz list in question?

Yes pfBlockerNG can use snort's IP lists

@Jamerson:

i am having the same issue can't get the internet working after the pfblockerNG is enabled.
Firewall rules from the LAN are allowed to everything,
from the WAN is as usually allowing the OPENVPN.

Do you have OpenVPN Interface selected from the General tab in pfBlockerNG ?

Jamerson

@f34rinc:

@shadowset:

I have a couple questions:

Can PFBlockerNG work with lists in p2p.gz format? I didn't see it listed in the IPv4/IPv6 tabs.

Also can PFBlockerNG use snort lists for IP blocking?

Thanks.

Can you link me to the .gz list in question?

Yes pfBlockerNG can use snort's IP lists

@Jamerson:

i am having the same issue can't get the internet working after the pfblockerNG is enabled.
Firewall rules from the LAN are allowed to everything,
from the WAN is as usually allowing the OPENVPN.

Do you have OpenVPN Interface selected from the General tab in pfBlockerNG ?

no i don't have openvpn interface selected
on the Interface/Rules Configuration
i have inbound firewall rules and outbound firewall rules.
inbound = WAN Action Block
outbound = LAN Action Reject

Thank you

f34rinc

Did that fix your problem Jamerson?

thehasty

pfBlockerNG Firewall 1.09
2.2.3-RELEASE (amd64)
FreeBSD 10.1-RELEASE-p13

Hello,

I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

My alias smtp_ports has the value "25, 465, 587" and I see Alerts like this:
Jul 12 05:27:36 WAN pfB_DShield
(96) TCP-S Icon Reverse Resolve with DNS 94.102.52.27:49717 my_server_ip_here:902 NL dshield

Obviously port 902 is not within my alias parameters, so I am thinking something is wrong here. Either it is truly blocking all ports from the IPs on the lists and ignoring my specified ports, or it is just showing false alerts.

Please advise.

Thank you!

BBcan177

@thehasty:

I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.

thehasty

@BBcan177:

When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.

Thank you, I've set custom protocol to tcp/ip for all of my ipv6 lists and top25. Seems odd to me that is a requirement.

Thanks again! I will report back if I encounter any other issues.

cyberbot

@f34rinc:

Did that fix your problem Jamerson?

no still waiting for some answers,
whenever i activate the pfBlockerNG the internet stops working.

fragged

@cyberbot:

@f34rinc:

Did that fix your problem Jamerson?

no still waiting for some answers,
whenever i activate the pfBlockerNG the internet stops working.

We need to see rules.debug or a screenshot of the rules created to give you any information.

taryezveb

Just wanted to add, also having issues with pfBlockerNG, but only after a reboot. Which just noticed, because the UPS needs new batteries. Power here is terrible and has gone out several times. Each time after pfSense reboots can not connect to the internet and sometimes even to pfSense.

Guessing this a new issue, since did not notice this before. Either with the recent change to pfSense made with the 2.2.3 update or with the pfBlockerNG 1.09 update. Both happened about the same time. Before those updates everything worked fine, but had not rebooted since the 2.2.2 update. So it is possible that is not the cause.

After connecting to pfSense and unchecking the Enable/Disable checkbox[to disable] and then saving; internet comes back up. After that checking the Enable/Disbable checkbox[to enable] and then saving. And forcing an update, cron and reload; pfBlockerNG works fine after that.

Note, if it matters: the few times I remembered to ping a site[7) Ping host], did not get any packet loss. Before doing the above. Also the Floating Rules are present before doing the above.

Using the defaults for many of the options and just have a few IPV4 lists. Nothing shows in the logs that would be helpful.

Thanks

BBcan177

Hi cyberbot/taryezveb,

Are you running a Nano version/Ramdisk or a full installation of pfSense?

On reboot is there a delay in the Reboot process? ie - Stuck on "Loading Firewall … " in the pfSense boot console screen?

After pfSense Boots, does the widget show entries in the packet column? or is it all blank?

When you hover-over the Firewall Rules for pfBNG, does each Firewall rule popup a table showing the IP addresses?

Run the following commands when there are issues, and report back with the output.

/sbin/pfctl -vvsTables | grep -A4 'pfB_'
ls -lah /var/db/aliastables/*

dzeanah

Is it appropriate to offer a bounty here?

I'd like to pledge $100 to add the following feature: block TOR exit nodes. I personally like TOR, but my forum is getting attacks from the TOR network that average more than one every eight seconds. Right now I'm going to the following URL and manually updating the list of nodes that can access my site as a custom list:

https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=[my server's IP address]&port=

I'd love to be able to simply check TOR the way I can flag a country within pfBlockerNG to deal with the problem instead.

Mr. Jingles

@Derek:

Is it appropriate to offer a bounty here?

I'd like to pledge $100 to add the following feature: block TOR exit nodes. I personally like TOR, but my forum is getting attacks from the TOR network that average more than one every eight seconds. Right now I'm going to the following URL and manually updating the list of nodes that can access my site as a custom list:

https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=[my server's IP address]&port=

I'd love to be able to simply check TOR the way I can flag a country within pfBlockerNG to deal with the problem instead.

It's always appropriate to throw beer or coffee to BB ;D

If you are in a hurry, I noticed, for me Snort/Suricata are also blocking TOR nodes. So you could perhaps use that until (and if) BB finds time to fulfill your request.

BBcan177

There are three IP lists that contain 'Tor Exit Nodes' that can be used in pfBNG without any code changes :

(gz) http://list.iblocklist.com/?list=togdoptykrlolpddwbvz&fileformat=p2p&archiveformat=gz
(txt) https://torstatus.blutmagie.de/ip_list_exit.php/Tor_ip_list_EXIT.csv
(html) https://rules.emergingthreats.net/open/suricata/rules/tor.rules

dzeanah

Thanks for that BB. I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages. I'll tinker a bit more.