PfBlockerNG v2.0 w/DNSBL

Overloader

It looks like a PHP Opcache issue. Simply reboot pfsense after upgrade. Then it works.

BBcan177

@sashazt said in PfBlockerNG v2.0 w/DNSBL:

Fatal error: Call to undefined function pfb_alerts_default_page() in /usr/local/www/pfblockerng/pfblockerng_general.php on line 96 PHP ERROR: Type: 1, File: /usr/local/www/pfblockerng/pfblockerng_general.php, Line: 96, Message: Call to undefined function pfb_alerts_default_page()

Can you confirm if you are on pfSense 2.4.3? or 2.4.4?

Also did this occur when you upgraded pfBlockerNG-devel? or was this a new installation of pfBlockerNG-devel?

Overloader

@bbcan177 I'm running pfsense 2.4.3-RELEASE-p1 and upgraded from pfBlockerNG 2.1.4_9 to 2.2.5_11 (dev). There are no installation errors but it looks like that the PHP files are cached due opcache.

$ php -v
PHP 5.6.34 (cli) (built: Mar 16 2018 16:55:46) 
Copyright (c) 1997-2016 The PHP Group
Zend Engine v2.6.0, Copyright (c) 1998-2016 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2016, by Zend Technologies
    with Suhosin v0.9.38, Copyright (c) 2007-2015, by SektionEins GmbH

MarcoP

@overloader is your php using opcache.validate_timestamps=0?
If it doesn't opcache should be able to check the modified timestamp and regenerate the cache.

I found out a little issue with a feed blocking it's own IP, funny.

Info regarding the feed
PRI4 - CCT_IP - https[:]//cybercrime-tracker[.]net/fuckerz.php - 213.186.33.3

I'll drop an email and report it directly to the list owner, till here easy.

However the main gateway is still able to connect and download from that IP.

pfSense gateway - pfBlockerNG Reports
Sep 4 10:00:47 WIFI pfB_PRI4_v4 (1770006077) 192.168.20.103:44188 213.186.33.3:443 cluster015.ovh.net TCP:S

pfSense test box on WIFI vlan - 192.168.20.103 - pfBlockerNG error.log
[ pfB_PRI4_v4 - CCT_IP_v4 ] Download FAIL [ 09/04/18 10:00:53 ] Firewall and/or IDS (Legacy mode only) are not blocking download.

Inbound interface is WAN

Advanced inbound on OpenPorts alias
Advanced outbound any any - as default
Floating rules deny both directions

Outbound interfaces, all including WAN

Advance inbound/outbound as default
Floating rules denying both directions

Pinging the IP from WAN correctly fails so pfB rules are working, but why is it still able to download, or is pfBlockerNG able to circumvent it's own block lists.

I was only able to found out the feed blocking it's own IP only because I was synching to the client.

Cheers

gniting

I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.

Thanks.

BBcan177

@ibbetsion said in PfBlockerNG v2.0 w/DNSBL:

I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.

https://forum.netgate.com/topic/135708/is-pfblockerng-devel-stable

gniting

@bbcan177 said in PfBlockerNG v2.0 w/DNSBL:

@ibbetsion said in PfBlockerNG v2.0 w/DNSBL:

I'm looking to get started with PfBlockerNG but am confused as to which version I should get started with, the "dev" version or the stable one? Any pointers on differences between the two will be immensely helpful.

https://forum.netgate.com/topic/135708/is-pfblockerng-devel-stable

Thank you.

anttechs

I love it and it even has the BBC in the list lol
I am I dying to get more Anti corp lists like what you see on filterlist.com because of spying but I get a lot of :

[ pfB_PRI1_v4 - BBC_C2_Agr_v4 ] Download FAIL [ 02/03/19 11:04:34 ]
[ pfB_PRI1_v4 - Talos_BL_v4 ] Download FAIL [ 02/03/19 11:04:19 ]
[ pfB_PRI1_v4 - CINS_army_v4 ] Download FAIL [ 02/03/19 11:04:02 ]
[ pfB_PRI1_v4 - BBC_C2_v4 ] Download FAIL [ 02/03/19 11:03:46 ]
[ DNSBL_NSA - NSAblocklist1 ] Download FAIL [ 02/03/19 11:03:30 ]
[ DNSBL_facebook - FB2 ] Download FAIL [ 02/03/19 11:03:15 ]

and this

[ BBC_C2_Agr_v4 ] Downloading update . cURL Error: 60
SSL certificate problem: self signed certificate Retry in 5 seconds...
. cURL Error: 60
SSL certificate problem: self signed certificate Retry in 5 seconds...
. cURL Error: 60
SSL certificate problem: self signed certificate Retry in 5 seconds...
.. unknown http status code | 0

[ pfB_PRI1_v4 - BBC_C2_Agr_v4 ] Download FAIL [ 02/03/19 11:04:34 ]
[ osint.bambenekconsulting.com ] Domain listed in DNSBL

The Following List has been REMOVED [ BBC_C2_Agr_v4 ]

and I have no idea if I'm doing something wrong or it's just the site?

or its because it's not in the right format?

But its still going great and so much simpler to use.
Great work.

I do wonder if this is 0.0.0.0 example.com is ok to put as a list?
I could just ake my own list but then they would not get updated.

I want to block all companies like google, apple, Microsoft, NSA Government, and so on.
I just use a paiid vpn to reach the outside world.

MarcoP

@anttechs edit filerlist to filterlists ;)

About the failed downloads, if i remember right some list does include other list' IP, so if you have WAN as Outbound interface in pfBlockerNG these IPs are going to be blocked. The same should apply for the SSL error.

anttechs

Many thanks ;)
I'm still learning everyday lol
mines on LAN Outbound Firewall Rules reject.
but Wan is set to default

I think I get it

I disabled TLD because I had .com and most of the others in there, I may be going over the top lol

MarcoP

@anttechs said in PfBlockerNG v2.0 w/DNSBL:

Many thanks ;)

You're welcome

I disabled TLD because I had .com and most of the others in there

Yeap, that would be it!

Cheers

beachbum2021

can a dev confirm whether or not snort/suricata are available in the 2.5 dev? they are installable but not listed in services or showing in top

ck42

Was using the non-devel package and began seeing the crashes.

Uninstalled and installed the Devel package (2.2.5_37). Still seeing this. (2.4.5-p1)

Crash report details:

PHP Errors:
[13-Nov-2020 12:33:48 America/New_York] PHP Fatal error:  Uncaught Error: Cannot create references to/from string offsets in /usr/local/pkg/pfblockerng/pfblockerng_install.inc:113
Stack trace:
#0 /etc/inc/pkg-utils.inc(770) : eval()'d code(1): include_once()
#1 /etc/inc/pkg-utils.inc(770): eval()
#2 /etc/inc/pkg-utils.inc(858): eval_once('include_once('/...')
#3 /etc/rc.packages(74): install_package_xml('pfBlockerNG-dev...')
#4 {main}
  thrown in /usr/local/pkg/pfblockerng/pfblockerng_install.inc on line 113

/etc/rc.packages: New alert found: PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng_install.inc, Line: 113, Message: Uncaught Error: Cannot create references to/from string offsets in /usr/local/pkg/pfblockerng/pfblockerng_install.inc:113 Stack trace: #0 /etc/inc/pkg-utils.inc(770) : eval()'d code(1): include_once() #1 /etc/inc/pkg-utils.inc(770): eval() #2 /etc/inc/pkg-utils.inc(858): eval_once('include_once('/...') #3 /etc/rc.packages(74): install_package_xml('pfBlockerNG-dev...') #4 {main} thrown

Anything I need to worry about?

RonpfS

if you look at /usr/local/pkg/pfblockerng/pfblockerng_install.inc

it's about the cron jobs removal.

// Remove discontinued pfBlockerNG CRON job
$pfb_cron = &$config['cron']['item'];
if (isset($pfb_cron)) {
	foreach ($pfb_cron as $key => $item) {
		if (strpos($item['command'], 'pfblockerng.php dc >>') !== FALSE) {
			unset($pfb_cron[$key]);
		}
	}
}

Have a look at /etc/crontab, you can also install the Cron package.

ck42

@RonpfS
These are the current pfBlockerNG cron entries

# pfSense specific crontab entries
# Created: November 13, 2020, 2:10 pm
#

0       0       4-10    *       *       root    /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dcc >> /var/log/pfblockerng/extras.log 2>&1
0       *       *       *       *       root    /usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php cron >> /var/log/pfblockerng/pfblockerng.log 2>&1

What I don't know though is...are these two entries part of the new -Devel installation or are these the old discontinued ones - that it's supposed to remove?
Based on the comment line, you can see that the comments were added today, but can't say for certain if the cron entries are pre-existing or not.

Based on you having the -Devel version also installed and guessing that you are not seeing this error, what does your pfBlocker crontab entry look like? Match mine?

I don't speak PHP, so not quite sure how to evaluate that 'if' statement.

RonpfS

@ck42
I have one more

0	11	4-10	*	*	root	/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php dcc >> /var/log/pfblockerng/extras.log 2>&1
0	22	*	*	*	root	/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php bl shallalist,ut1 >> /var/log/pfblockerng/extras.log 2>&1
15	2,5,8,11,14,17,20,23	*	*	*	root	/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php cron >> /var/log/pfblockerng/pfblockerng.log 2>&1

Maybe disabling pfblockerNG will delete the pfb entries. When you install, was pfblockerNG disabled ?
Maybe try to install the package with pfblockerNG disabled again.

ck42

@RonpfS
Disabling pfBlocker did remove the cron entries. Re-enabling did not create that third one that you have though.
Next, I disabled it and then re-installed it (did not uninstall and then install again manually, just used the re-install option in the package manager). Then enabled it. Still only have the two cron entries. But.....I don't seem to be seeing the crash message any longer. Interesting.
I'll keep an eye on it and see if this is permanent.
Still curious though about your third cron entry. Wondering if this is maybe due to an additional configuration somewhere in your pfBlocker configuration that you enabled that I don't have. If so, then it's not a concern.

RonpfS

@ck42 The entry is related to Firewall / pfBlockerNG/ DNSBL / DNSBL Category Blacklist.