pfSense Support Subscription

Author Topic: Country Block  (Read 120090 times)

0 Members and 1 Guest are viewing this topic.

Offline louis-m

  • Full Member
  • ***
  • Posts: 263
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #135 on: August 21, 2010, 05:17:46 am »
and what a great peice of code too. that cheeky little bleeder from taiwan is now being blocked good and proper! thank you!

Offline louis-m

  • Full Member
  • ***
  • Posts: 263
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #136 on: August 21, 2010, 09:42:51 am »
um....there's a bit of a difference between the full & embedded versions. running on a full version with the same packages eg snort etc, country block runs. with the embedded. it stops after 5 mins. i'll play a bit more i think.

Offline tommyboy180

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 976
  • Karma: +0/-0
    • View Profile
    • TomSchaefer.org
Re: Country Block
« Reply #137 on: August 21, 2010, 11:54:51 am »
um....there's a bit of a difference between the full & embedded versions. running on a full version with the same packages eg snort etc, country block runs. with the embedded. it stops after 5 mins. i'll play a bit more i think.
I don't have any experience with embedded so any help is appreciated. I wonder what the difference is, hopefully there is a fix that we can implement.
-Tom Schaefer
SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM
TomSchaefer.org/pfsense
Please support Countryblock | IP-Blocklist | File Browser | Strikeback Here

Offline cmb

  • Administrator
  • Hero Member
  • *****
  • Posts: 6333
  • Karma: +0/-0
    • LinkedIn
    • Twitter
    • View Profile
    • Chris Buechler
Re: Country Block
« Reply #138 on: August 22, 2010, 02:45:40 pm »
I don't have any experience with embedded so any help is appreciated. I wonder what the difference is, hopefully there is a fix that we can implement.

The only real difference is if you must write to something other than /var you must conf_mount_rw() first and conf_mount_ro() afterwards.

Offline tommyboy180

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 976
  • Karma: +0/-0
    • View Profile
    • TomSchaefer.org
Re: Country Block
« Reply #139 on: August 22, 2010, 05:52:09 pm »
I don't have any experience with embedded so any help is appreciated. I wonder what the difference is, hopefully there is a fix that we can implement.

The only real difference is if you must write to something other than /var you must conf_mount_rw() first and conf_mount_ro() afterwards.

Thank you very much.
-Tom Schaefer
SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM
TomSchaefer.org/pfsense
Please support Countryblock | IP-Blocklist | File Browser | Strikeback Here

Offline darklogic

  • Full Member
  • ***
  • Posts: 175
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #140 on: August 30, 2010, 07:17:56 am »
I have noticed that some IP's from other Countries have been getting blocked by SNORT even though I have the entire country set to block and country block package was verified to be running. I have never seen this before until now. This could be nothing, but I raise the question that if the country block is basically blocking the IP already, why now is SNORT even getting the opportunity to block the IP? Logic tells me that the country block package would simply overide any other decision the firewall would make on handdle the incoming connection and then simple discard the connection or auto block it from everthing. The only other option or idea I have is that maybe this is a new range of IP's not listed for those countries from the countryipblock.net website??? Maybe something to look into maybe not. Just thought I should say something.

The IP's below belong to Korea the republic and china according to countryipblock.net
121.176.124.65
123.159.194.21

Thanks for any help or ideas.

Offline tommyboy180

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 976
  • Karma: +0/-0
    • View Profile
    • TomSchaefer.org
Re: Country Block
« Reply #141 on: August 30, 2010, 08:28:32 am »
I have noticed that some IP's from other Countries have been getting blocked by SNORT even though I have the entire country set to block and country block package was verified to be running. I have never seen this before until now. This could be nothing, but I raise the question that if the country block is basically blocking the IP already, why now is SNORT even getting the opportunity to block the IP? Logic tells me that the country block package would simply overide any other decision the firewall would make on handdle the incoming connection and then simple discard the connection or auto block it from everthing. The only other option or idea I have is that maybe this is a new range of IP's not listed for those countries from the countryipblock.net website??? Maybe something to look into maybe not. Just thought I should say something.

The IP's below belong to Korea the republic and china according to countryipblock.net
121.176.124.65
123.159.194.21

Thanks for any help or ideas.
The pf Firewall follows rules in the order they are written to the config. SNORT rules must come before the countryblock rules. You can verify this by looking at /tmp/rules.debug.
What I think you are seeing the the same IP. Both packages block the IP but SNORT is the first to encounter based on your rule set.
-Tom Schaefer
SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM
TomSchaefer.org/pfsense
Please support Countryblock | IP-Blocklist | File Browser | Strikeback Here

Offline darklogic

  • Full Member
  • ***
  • Posts: 175
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #142 on: August 30, 2010, 10:59:29 am »
ok, so basically one way or another they will get blocked even though SNORT seen the incoming connection first. I just never noticed this before. Is it because the CountryBlock is sending information to the logs now?

Thanks,

Offline tommyboy180

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 976
  • Karma: +0/-0
    • View Profile
    • TomSchaefer.org
Re: Country Block
« Reply #143 on: August 31, 2010, 02:13:02 am »
ok, so basically one way or another they will get blocked even though SNORT seen the incoming connection first. I just never noticed this before. Is it because the CountryBlock is sending information to the logs now?

Thanks,
No the logs are separate. It's just the order that the rules are handled.
-Tom Schaefer
SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM
TomSchaefer.org/pfsense
Please support Countryblock | IP-Blocklist | File Browser | Strikeback Here

Offline darklogic

  • Full Member
  • ***
  • Posts: 175
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #144 on: August 31, 2010, 07:35:52 am »
Ok, well thanks for explanning to me on what was happening.

Take Care,

Matt

Offline tommyboy180

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 976
  • Karma: +0/-0
    • View Profile
    • TomSchaefer.org
Re: Country Block
« Reply #145 on: August 31, 2010, 08:02:33 am »
Ok, well thanks for explanning to me on what was happening.

Take Care,

Matt
np
-Tom Schaefer
SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM
TomSchaefer.org/pfsense
Please support Countryblock | IP-Blocklist | File Browser | Strikeback Here

Offline jerrygoldsmith

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #146 on: September 05, 2010, 10:35:27 am »
First off, this is an AWESOME package, thank you for putting in the time and effort to make it what it is!


Question - mine will randomly report 'not running'.  My DSL provider is AT&T and they change my IP randomly - sometimes twice a day (not the modem, its a result of something else they are experimenting with here in town).   I think this is the cause, but I'm not sure.  Logs don't report anything of interest, but that seems to be the correlation.

Is there a way to auto-start it, or to keep it from needing to be restarted every time this happens?

Offline tommyboy180

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 976
  • Karma: +0/-0
    • View Profile
    • TomSchaefer.org
Re: Country Block
« Reply #147 on: September 05, 2010, 11:15:11 am »
First off, this is an AWESOME package, thank you for putting in the time and effort to make it what it is!


Question - mine will randomly report 'not running'.  My DSL provider is AT&T and they change my IP randomly - sometimes twice a day (not the modem, its a result of something else they are experimenting with here in town).   I think this is the cause, but I'm not sure.  Logs don't report anything of interest, but that seems to be the correlation.

Is there a way to auto-start it, or to keep it from needing to be restarted every time this happens?

You can have it start via a cron job. I'm not sure why it stops even if your IP changes, the only thing that causes the package to stop is a change in the firewall configuration. What you can do have a cron job run every minute or 5 minutes to run the package. That would keep it running all the time .
-Tom Schaefer
SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM
TomSchaefer.org/pfsense
Please support Countryblock | IP-Blocklist | File Browser | Strikeback Here

Offline mgc6288

  • Jr. Member
  • **
  • Posts: 65
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #148 on: September 05, 2010, 05:55:29 pm »
Is there a way to auto-start it, or to keep it from needing to be restarted every time this happens?

What I did is after I installed the Cron package, I created an auto start like this:

minute: 0
hour: *
mday: *
month: *
wday: *
who: root
command: /usr/local/etc/rc.d/countryblock.sh

Offline jerrygoldsmith

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: Country Block
« Reply #149 on: September 05, 2010, 09:04:38 pm »
Thanks guys, I appreciate it.

Like I said, I don't know if it's the IP change but it seems to happen about that time.  I put in the cron job, thanks a bunch!

And thanks again for the wonderful package and all the hard work you put into it!