PfBlockerNG

heliop100

I'm using Alienvault List and blocking outside traffic to Russia, China and North Korea.

Access to www.tcpiputils.com (148.251.153.34 - Germany (DE) - not listed on AlienVault) are blocked, but not on alerts or firewall logs.

If I reset states, it opens for a few seconds and blocks again, disabling pfBlockerNG resolve that issue.

Any idea?

Thanks.

BBcan177

@heliop100:

I'm using Allienvault List and blocking outside traffic to Russia, China and North Korea.

Access to www.tcpiputils.com (148.251.153.34 - Germany (DE) - not listed on AllienVault) are blocked, but not on alerts or firewall logs.

If I reset states, it opens for a few seconds and blocks again, disabling pfBlockerNG resolve that issue.

Any idea?

Thanks.

Alienvault doesn't have that IP listed.. But run this command below to see if any other list has that included…

grep -h "^148.251." /var/db/pfblockerng/deny/ | grep '/'*

Alienvault.txt:148.251.195.0/24
Alienvault.txt:148.251.88.0/24

edit: added the -h flag to skip the filename/path

heliop100

Hi, thanks for your quick answer,

The command gets the same of yours:

grep -h "^148.251." /var/db/pfblockerng/deny/* | grep '/'
148.251.195.0/24
148.251.88.0/24

BBcan177

@heliop100:

Hi, thanks for your quick answer,

The command gets the same of yours:

grep -h "^148.251." /var/db/pfblockerng/deny/* | grep '/'
148.251.195.0/24
148.251.88.0/24

Run the following commands to report all IPs listed in the 148.0.0.0 range…

cd /var/db/pfblockerng/deny
grep "^148\." * | grep '/'

heliop100

Hi

grep "^148." * | grep '/'

Alienvault.txt:148.251.195.0/24
Alienvault.txt:148.251.88.0/24

(But I have disable/enable pfBlockerNG with keep settings cleared, and now are not blocking tcpiputils anymore)

Thanks.

BBcan177

@heliop100:

Hi

grep "^148." * | grep '/'

Alienvault.txt:148.251.195.0/24
Alienvault.txt:148.251.88.0/24

(But I have disable/enable pfBlockerNG with keep settings cleared, and now are not blocking tcpiputils anymore)

Thanks.

pfBNG will only block what you configure it to block…

What does this command report:

host -t A tcpiputils.com

Maybe tcpiputils.com resolves to a different address for you?

All blocked IPs should be reported in the Alerts Tab.

You can also try:
Instead of completely disabling pfBNG, goto the LAN interface and toggle the Icon at the left for each pfBNG Rule one at a time to see which Rule is causing the block for you. Then go from there.

heliop100

Hi,

$ host -t A tcpiputils.com
tcpiputils.com has address 148.251.153.34

Will try your suggestion:

Instead of completely disabling pfBNG, goto the LAN interface and toggle the Icon at the left for each pfBNG Rule one at a time to see which Rule is causing the block for you. Then go from there.

Thanks.

BBcan177

As a note, Germany is listed in the TOP20 List… Did you by any chance select all of the TOP20 to block? If so... This is why its blocked...

You can also create a pfBNG alias "Permit Outbound" and add the IPs that you want to bypass the Blocking rules to the "Custom list" at the bottom... Then set the Rules order to have this permit Rule above the Block/Reject rules...

heliop100

Hi,

No using TOP20.

Don't know what may be happened, now are not blocking.

Thanks.

heliop100

Hi

I'm receiving this error:

[ There were error(s) loading the rules: /tmp/rules.debug:27: cannot define table pfB_IBlock: Cannot allocate memory - The line in question reads [27]: table persist file /var/db/aliastables/pfB_IBlock.txt]

The pfSense box has 4Gb ram and are at 7%.

Thanks.

doktornotor

@heliop100:

[ There were error(s) loading the rules: /tmp/rules.debug:27: cannot define table pfB_IBlock: Cannot allocate memory - The line in question reads [27]: table persist file /var/db/aliastables/pfB_IBlock.txt]

Welcome to the club. This is not a package issue, also nothing to do with lack of physical RAM. It's core OS (probably kernel-level) stuff…

https://redmine.pfsense.org/issues/4876

heliop100

ok, thanks.

@doktornotor:

@heliop100:

[ There were error(s) loading the rules: /tmp/rules.debug:27: cannot define table pfB_IBlock: Cannot allocate memory - The line in question reads [27]: table persist file /var/db/aliastables/pfB_IBlock.txt]

Welcome to the club. This is not a package issue, also nothing to do with lack of physical RAM. It's core OS (probably kernel-level) stuff…

https://redmine.pfsense.org/issues/4876

BBcan177

@heliop100:

Hi

I'm receiving this error:

[ There were error(s) loading the rules: /tmp/rules.debug:27: cannot define table pfB_IBlock: Cannot allocate memory - The line in question reads [27]: table persist file /var/db/aliastables/pfB_IBlock.txt]

The pfSense box has 4Gb ram and are at 7%.

Thanks.

Damn IBlock again :)

Create a second IBlock Alias for this large IBlock list.

There seems to be an issue with having that many IPs in one Alias table.

doktornotor

Well, some of these lists would need splitting feature until the damned bug is found.

interos

Having issues setting up pfBlockerNG on pfSense.
Seems like an easy to fix problem if I want to write code; so my assumption is that it is also an easy settings fix that I missed.

The problem is that when pfBlockerNG ingests a list, it finds spaces in the header and promptly aborts.
I've been testing several lists from iBlockList via both paid and public lists that demonstrate the same problem.

The first list I tried was the Pedophile list. Here is the excerpt from the txt file which is downloaded via a gz file.

List distributed by iblocklist.com

Sharing R@ygold Porn:1.9.98.0-1.9.99.255
Shares Various Illegal Porn:1.9.101.0-1.9.103.255

In pfBlockerNG, I have the following settings:

Alias Name: Pedophiles
List Description: i-BlockList Pedophiles
Format: gz
State: On
URL: http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz&username=MyUserName&pin=MyPIN
Header: iBlock-Pedo
List Action: Deny Both
Update Frequency: Every 4 Hours
Weekly: Monday
Enable Logging: Enable
Enable Custom Port: Blank
Enable Custom Destination: Blank
Custom Protocol: any
IPv4 Custom Addresses: Blank
Update Custom List: Default

Running pfSense 2.2.4
pfBlockerNG 1.10

Here is the Log File from the UI

UPDATE PROCESS START [ 10/11/15 17:27:44 ]

[ http://list.iblocklist.com/?list=dufcxgnbjsdwmwctgfuj&fileformat=p2p&archiveformat=gz&username=MyUserName&pin=MyPinCode ]
** TERMINATED - Header contains Blank/International/Special or Spaces

===[ Aliastables / Rules ]================================

No Changes to Firewall Rules, Skipping Filter Reload
No Changes to Aliases, Skipping pfctl Update

UPDATE PROCESS ENDED

So my first thought is to do pre-processing on these and rehost them. That seems like a poor choice to just configuring the plugin correctly. Any thoughts on how to fix this? Thanks in advance.

BBcan177

@interos:

** TERMINATED - Header contains Blank/International/Special or Spaces

This error means that you entered invalid characters in the Header field. This is the field beside the URL in the IPv4 tab. Do not include spaces, or other special characters when naming the Header…

So remove the "-" in your Header: iBlock**-**Pedo
You can use "_" if you wish instead…

hmh

How-to block social networks with pfBlockerNG

Install package Cron
Install FreeBSD package manager https://doc.pfsense.org/index.php/Installing_FreeBSD_Packages


pkg install whois

Add Cron task


/usr/local/bin/mwhois -h whois.radb.net -i origin as32934 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/facebook_cidr.raw
/usr/local/bin/mwhois -h whois.radb.net -i origin as49988 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/odnoklassniki_cidr.raw
/usr/local/bin/mwhois -h whois.radb.net -i origin as47541 | grep -Eo "([0-9.]+){4}/[0-9]+" | sort -n > /var/db/pfblockerng/vk_com_cidr.raw

My config
update lists once a week on friday

In pfBlockerNG add IPv4 List

With
List Action: Alias Match
And
Update Frequency: Weekly

Add firewall rule:

Thats it!

P.S.
If you already have list (for example) Top20 with List Action: Alias Match, processing of files will be skipped
Because nets from facebook_cidr.raw already in list Top20

Will be cool if developers add option to block networks by AS number
It is very useful

BBcan177

Yes v2.0 has whois support built-in… :)

Soloam

BBcan177, first of all great work on this package, it's a must have to all pfsense boxes.

I found a bug! If we can call it a bug, it can be only miss configuration.

Lets assume this scenario. 2 Lists, 2 Interfaces.

I have list 1 (IP's)
1.2.3.4
5.6.7.8

I have list 2(IP's)
1.2.3.4
9.10.11.12

Both have IP 1.2.3.4

I make use of De-Duplication.

I set list 1 as Deny on Interface LAN1
I set list 2 as Deny on Interface LAN2

The logs are all messed up, because He can't find out that from what interface the block 1.2.3.4 is.

Best Regards

BBcan177

@soloam:

I found a bug! If we can call it a bug, it can be only miss configuration.

Hi soloam,

Its not a bug. When you use de-duplication, only one of the Lists will have IP 1.2.3.4
If you want a second list to skip de-duplication, you will need to use "Alias Native" and manually create the firewall rule…