PfBlockerNG



  • If I understand correctly, they do an in-depth review of the code.  This being a "New" package with a large code base it can take a while. I believe it is in that process now. It is in the pfSense package repository but is waiting for this process to be completed. The "patch", I hate the word "Hack", just allows you to bypass the "compatibility check" to download the package from the pfSense repository before it has gone through this process. It is "Use at your own risk" at the moment. The review process is a good thing. We just have to be patient.

    @reggie14:

    @marcelloc:

    The pull request needs to be merged by pfsense team before you can use it without any hacks.

    Mostly out of curiosity, what does this mean for where this package is in the release process?  That is, does the pfsense team do some testing before they merge it?  Or do they just do some sort of minimal sanity check through the code?


  • Moderator

    @BBcan177:

    I will be submitting a Pull Request for the following :

    1. MaxMind files will be saved to the PBI folder which will make them persist after reboot. (for Nano / Ramdisk installs)

    2. MaxMind archive files in /var/db will be purged after installation to free up some space.

    3. Add MaxMind "Anonymous Proxy and Satellite Providers".

    https://github.com/pfsense/pfsense-packages/pull/801



  • Why do I occasionally see items on the "Permit" part of the Alerts tab when I have 0 permit rules?

    
    Permit   -   Last 5 Alert Entries.							
    Date		IF	Rule			Proto		Source			Destination		CC	List
    Feb 2 14:32:59	WAN	pfB_iBlockHijacked (98)	UDP	  	119.186.197.255: 16001	192.168.YY.X: 64284	CN	No Match
    
    

    When I search my firewall log for the source, nothing pops up. I have logging enabled for all my pass/block/deny rules.



  • When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time. When disabled, the sync happens instantaneous. Using the old pfBlocker package, it works normally as well. I have eight IPv4 lists configured for deny inbound. I have the top 20 configured to be an alias which has a rule to block inbound on port 25. Then I have several countries configured for deny inbound. Inbound is set for my WAN. There is no blocking of outbound.

    Is anyone else experiencing this?


  • Banned

    @fragged:

    When I search my firewall log for the source, nothing pops up.

    This is not logged to general firewall logs unless configured so (Global Enable Logging).

    @swinn:

    When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time.
    Is anyone else experiencing this?

    No. Stop blocking your NTP servers.



  • @doktornotor:

    @fragged:

    When I search my firewall log for the source, nothing pops up.

    This is not logged to general firewall logs unless configured so (Global Enable Logging).

    Is also enabled.


  • Moderator

    @swinn:

    When pfBlockerNG is enabled, any clients trying to sync with ntpd will fail 99% of the time

    MaxMind Country Database is accurate now!  :) The old package had two years old Country Data.
    I assume that the NTP server is in one of those Countries that you selected.

    Look at the "Alerts" Tab, and find the IP that is being blocked. Then create a new "Permit Outbound" alias. You can add the IP to the Custom Text Box at the bottom of this new Alias. This is the recommended method to overcome blocking when "Country Blocking" is occuring.

    For all other False Positives, use the Suppression method instead.


  • Moderator

    @fragged:

    Why do I occasionally see items on the "Permit" part of the Alerts tab when I have 0 permit rules?
    When I search my firewall log for the source, nothing pops up. I have logging enabled for all my pass/block/deny rules.

    I haven't seen this before. But let me know if its repeating…


  • Banned

    @BBcan177:

    Look at the "Alerts" Tab, and find the IP that is being blocked. Then create a new "Permit Outbound" alias. You can add the IP to the Custom Text Box at the bottom of this new Alias. This is the recommended method to overcome blocking when "Country Blocking" is occuring.

    If you are using any of those *.pool.ntp.org things or whatever similar for NTP, you really need some alias with FQDNs for those, otherwise you'll be hunting IPs for quite some time.



  • A couple of notes about my upgrade 1.0 -> 1.01 upgrade. (Xeon amd64 4GB RAM)

    My /var/db/aliastables/ were all wiped out.
    I followed the steps given by BBcan177 to set it right again -> https://forum.pfsense.org/index.php?topic=86212.msg484133#msg484133

    also - A curiosity
    The Maxmind AnonProxy A1 list in pfBlockerNG seems more accurate than the one on Maxmind's website.

    Example: This IP  63.141.198.54 is A1 (and is in pfBlockerNG).
    re: http://www.ip-tracker.org/locator/ip-lookup.php?ip=63.141.198.54
    re: https://www.iptomaps.com/country_block/12245

    but it isn't on Maxmind's web-list of A1 IPs
    https://www.maxmind.com/en/anonymous_proxies

    Just an oddity and a welcome one at that.



  • The pull request is merged. Package is available on list.


  • Banned

    @marcelloc:

    The pull request is merged. Package is available on list.


  • Moderator

    @LinuxTracker:

    A curiosity
    The Maxmind AnonProxy A1 list in pfBlockerNG seems more accurate than the one on Maxmind's website.

    Example: This IP  63.141.198.54 is A1 (and is in pfBlockerNG)
    but it isn't on Maxmind's web-list of A1 IPs
    https://www.maxmind.com/en/anonymous_proxies

    I think as this is a "Free" service, that they don't update the Web Site so frequently. The Database is updated the First Tuesday of each month, but I have noticed that it can change before that time.

    I checked the Maxmind Database file and it is listed there.

    GeoIPCountryWhois.csv:"63.141.198.0","63.141.199.255","1066255872","1066256383","A1","Anonymous Proxy"


  • Moderator

    @doktornotor:

    @marcelloc:

    The pull request is merged. Package is available on list.

    Yes this pic is worth repeating as I am buying the next Round! Just don't expect me to be in any position to fix any bugs tomorrow!  ;D

    I have hammered at this package with my troop of loyal Beta Testers (just over 25 of them)… A really big Thanks to those Guys for really helping put the package thru real world testing. Any bugs you guys do find, let me know and I"m sure we can get them resolved. You Beta Testers are the Salt of the Earth kinda guys... Just what Open Source is all about. Hope you guys like the package. Its been fun!



  • great news!!! thank you BBcan177 and everyone else who worked on this great package.


  • Moderator

    @wbennett77:

    pfBlockerNG v1.0 – Official Release

    Thanks to wbennett77 for allowing me to commandeer his First post in this thread …
    https://forum.pfsense.org/index.php?topic=86212.msg472670#msg472670



  • Noticed pfBlockerng is not showing up in the Dashboard services status Widgets. Not sure how to reload it after modification.

    Thanks


  • Banned

    It's not a running service, no business in there.


  • Moderator

    @Firemedic46:

    Noticed pfBlockerng is not showing up in the Dashboard services status Widget.

    pfBlockerNG does not have a service as doktornotor indicated. So it will not show in the services menu. But when pfBlockerNG is enabled, you will see at the top left corner of the pfBNG widget, a similar Service Status Icon showing that pfBNG is "Enabled"



  • It seems I can't avoid blocks from showing up in system logs->firewall, even with "Global Enable Logging" unchecked. Is it just me?


  • Banned

    You have individual settings per each block list.



  • ;) you're the man…. thank you.



  • Just did a very smooth reinstall/upgrade to 1.01. Thanks BBcan177 for an amazing package and thanks for all the support.

    Cheers!



  • Not seeing any aliases being created after selecting various country blocks. Nor do I see them on the dashboard widget. Its empty.



  • Did you enable pfBlockerNG in the General tab? Did you force an update?

    @Asterix:

    Not seeing any aliases being created after selecting various country blocks. Nor do I see them on the dashboard widget. Its empty.



  • Yup..

    EDIT: A reboot fixed it.

    Quick question…..

    Do u enable the floating rules options on the general tab?


  • Moderator

    After seeing some users installation of pfBNG, I would like to suggest the following:

    1. Enable "Keep Settings" in the General Tab. On any re-install you will lose all settings without it.

    2. With the new "Alerts" Tab, you don't need to break-out each List into a single Alias. You can create an "Alias" Category, say IBlock and put most of the IBlock lists into one Alias. You can create another Alias for "Mail Servers" etc.. The Alerts tab will tell you which list was responsible for the Blocked event.

    3. If you create an "Alias Permit/Deny/Match/Native", name the Alias  pfb_   All lowercase. The widget is designed to pick this Prefix in the Rules so that it can be displayed with the other Auto rules that are prefixed  pfB_. For any Alias only type list, never use  pfB_ as a prefix. The package will remove it at each Cron event.

    4. Match can be used if you want to Monitor a group of IPs, this will just log the activity without Blocking. These Match rules will populate in the Floating Tab. You can use a URL or post IPs in the "Custom Box" provided in each Alias.

    5. "Alias Native" are lists that do not undergo any De-Duplication/Reputation, this can be used for Lists like the IBlock Anti-Infringement or when you want to Block Facebook for example.

    6. With the new "html" format, you can Deny, Permit or Match sites like Twitter, Facebook for example. You can use Hurricane Electric to pull the IPs that are part of these networks. You would also need to create a list for IPv6 if you use that in your network. Again use the "Alias Native" for these types of lists if you want to Block them. For Permit or Match, you can use the Auto-Type Rule Settings.

    http://bgp.he.net/search?search[search]=twitter&commit=Search
        http://bgp.he.net/search?search[search]=facebook&commit=Search
        http://bgp.he.net/search?search[search]=spotify&commit=Search
        http://bgp.he.net/search?search[search]=dropbox&commit=Search

    1. And as always no one reads the tech notes on each setting. So I advise you to read each one to familiarize yourself with each function.


  • And what List Action did you select?


  • Moderator

    @dennypage:

    Did you enable pfBlockerNG in the General tab? Did you force an update
    @Asterix:

    Not seeing any aliases being created after selecting various country blocks. Nor do I see them on the dashboard widget. Its empty.

    Follow the pfblockerng.log. It will tell you error events that can help diagnose…

    Two points to check

    1. Each alias needs to have a defined : List Action
    2. Ensure that you have a "header name" for each List/URL


  • I edited my previous post as a reboot fixed it.

    Wanted to check if u enable the floating rules options on the general tab?


  • Moderator

    @Asterix:

    I edited my previous post as a reboot fixed it.

    Wanted to check if u enable the floating rules options on the general tab?

    The choice is there to run Rules on each interface or to set them in the "Floating Tab"… The Choice is yours to make... There are threads that give some more advice on that...

    So yes, if you want to enable "Floating Rules" select the option in the General Tab.

    https://forum.pfsense.org/index.php?topic=78062.0



  • woot, it's official!



  • @BBcan177:

    After seeing some users installation of pfBNG, I would like to suggest the following:

    1. Enable "Keep Settings" in the General Tab. On any re-install you will lose all settings without it.

    2. With the new "Alerts" Tab, you don't need to break-out each List into a single Alias. You can create an "Alias" Category, say IBlock and put most of the IBlock lists into one Alias. You can create another Alias for "Mail Servers" etc.. The Alerts tab will tell you which list was responsible for the Blocked event.

    3. And as always no one reads the tech notes on each setting. So I advise you to read each one to familiarize yourself with each function.

    Like This:








  • @Asterix:

    Wanted to check if u enable the floating rules options on the general tab?

    Depends on how you want your system setup. I have it enabled using rule order pfSense Pass/Match | pgB_Pass/Match | pfB_Block/Reject..



  • My lists were all showing 0 entries after update… But after the last CRON they are all showing again. Weird as I force updated many times and it didn't populate. Not sure what happened, but ignore this post. :)


  • Moderator

    Can you run the following command followed by a "Force Update"

    /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dc



  • I ran that and force updated. After last update have 70K+ entries, same as right before I did it.

    I also tried adding/removing a few countries and the count changes. So seems like everything is working great. Not sure what happened right after upgrade, but it is behaving now. AWESOME addition to pfSense.



  • I hate to ask stupid questions on here, but i'm going to anyway. Feel free to point out my inadequacies, as I'm sure the answer is obvious and I'm just being obtuse…

    If I need to unblock/pass a specific IP address that is currently being blocked in a country block list - is that possible?

    For instance, I had Poland blocked in the Top 20 list. However, GOG.COM's game down loader is via Poland so I need to let it through.

    Obviously I can unblock Poland, but would rather just let the GOG IP address through.


  • Moderator

    @JasonJoel:

    If I need to unblock/pass a specific IP address that is currently being blocked in a country block list - is that possible?

    Follow the instructions in this link to create a "Permit outbound" alias.

    https://forum.pfsense.org/index.php?topic=86212.msg484689#msg484689



  • Very nice job on the package but…in the alert tab we need small country flags for the CC colum. Its not a real NG package w/o little flags :)

    Cheers.

    F.


Log in to reply