Netgate m1n1wall

Author Topic: pfBlocker  (Read 182307 times)

0 Members and 1 Guest are viewing this topic.

Offline RonpfS

  • Full Member
  • ***
  • Posts: 129
    • View Profile
Re: pfBlocker
« Reply #255 on: December 21, 2011, 12:07:42 am »
Increase Firewall Maximum Table Entries under System: Advanced: Firewall and NAT
you may have to increase Firewall Maximum States at some point

Offline RonpfS

  • Full Member
  • ***
  • Posts: 129
    • View Profile
Re: pfBlocker
« Reply #256 on: December 21, 2011, 12:19:10 am »
fixed javascript again, try reinstall in 15 minutes.

Reinstalled and now the Dashboard doesn't scroll anymoire  ;D
Being at it  8) is-it possible to have the option to Enable pfBlocker by default on reinstall?

Offline AhnHEL

  • Sr. Member
  • ****
  • Posts: 572
    • View Profile
Re: pfBlocker
« Reply #257 on: December 21, 2011, 12:27:40 am »
Increase Firewall Maximum Table Entries under System: Advanced: Firewall and NAT
you may have to increase Firewall Maximum States at some point

I'm already up to 2 million entries, even increasing to 200 million doesnt resolve issue.  Been using pfBlocker since it was first introduced and havent had an issue until now.

Edit:

Using the Top Spammers works fine, it has something to do with the iBlocks lists.  Using the same bunch of lists that I PM'd you back during this post.

http://forum.pfsense.org/index.php/topic,42543.msg219723.html#msg219723
« Last Edit: December 21, 2011, 02:27:23 am by onhel »
AhnHEL (Angel)
NYC

3 pfSense sites: 2.1 RELEASE (amd64)
Dell 745 SFF E4400 @ 2.0Ghz, 2GB RAM, 20/5 Mbps
Dell 755 SFF E6550 @ 2.3Ghz, 2GB RAM, 20/5 Mbps
White Box i5 3570k @ 4.4Ghz, 16GB RAM, 114/6 Mbps, SSD
OpenVPN (Site to Site, Road Warrior), IPSec Mobile, UPnP Gaming, Traffic Shaping, Snort, Suricata

Offline RonpfS

  • Full Member
  • ***
  • Posts: 129
    • View Profile
Re: pfBlocker
« Reply #258 on: December 21, 2011, 02:49:34 am »
I ran into that kind of issue when I played with the Level 1 at some point. I was using alias only.
It looked like the table were locked by Firewall Rules, when I disabled pfblocker, the table would still showed up.
I removed pfBlocker and the table were still there under Diagnostics: Tables!!!
I install pfblocker and at some point I recovered. But I am not using Level 1 at this time.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: pfBlocker
« Reply #259 on: December 21, 2011, 03:55:36 am »
Quote
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 10499768 bytes) in /usr/local/pkg/pfblocker.inc on line 281

It looks like very large lists.

Try to remove some lists and enable pfBlocker.

Offline Metu69salemi

  • Hero Member
  • *****
  • Posts: 1564
    • View Profile
Re: pfBlocker
« Reply #260 on: December 21, 2011, 04:46:31 am »
Getting this error now trying to enable pfBlocker, and the widget still looks like the pic i posted above.

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 10499768 bytes) in /usr/local/pkg/pfblocker.inc on line 281

do you have 128GB harddisk? meaning 134217728 bytes divided with 1024 twice is exactly 128GB

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: pfBlocker
« Reply #261 on: December 21, 2011, 04:50:59 am »
No, its 128mb RAM limit for php set on pfsense.

Offline Metu69salemi

  • Hero Member
  • *****
  • Posts: 1564
    • View Profile
Re: pfBlocker
« Reply #262 on: December 21, 2011, 04:56:30 am »
Sorry yes it was MB, not GB's.. assumed still that was kB's.  :-[ :-[

Offline raind0wn388

  • Newbie
  • *
  • Posts: 2
    • View Profile
Re: pfBlocker
« Reply #263 on: December 21, 2011, 11:19:30 am »
I tried getting pfblocker to start, doesn't appear to be running in any of my system logs or processes. Tried reinstalling over and over, and the CIRDs in the dashboard widget still show a red down arrow. Any ideas how I can start the process manually via the shell?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: pfBlocker
« Reply #264 on: December 21, 2011, 11:34:23 am »
What action did you choose for it?

You need at least one rule on interface to get pfBlocker working.

check firewall -> rules
« Last Edit: December 21, 2011, 09:08:22 pm by marcelloc »

Offline raind0wn388

  • Newbie
  • *
  • Posts: 2
    • View Profile
Re: pfBlocker
« Reply #265 on: December 21, 2011, 11:38:07 am »
Ah that was the reason! Didn't know that, thanks!

Offline jroberts31xray

  • Newbie
  • *
  • Posts: 9
    • View Profile
    • Bluegrass.net
Re: pfBlocker
« Reply #266 on: December 26, 2011, 03:48:24 pm »
Good work guys! Nice new tools, usability and not to mention it works perfectly :P.....thanks for bringing two of my fav PF tools together.....Love it!

btw if anyone is using PF 2.0 as a "bridged router" ...set both options to "lan" .... just something i found out the hard way.  ;D

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9930
    • View Profile
Re: pfBlocker
« Reply #267 on: December 26, 2011, 03:55:12 pm »
Quote
Good work guys! Nice new tools, usability and not to mention it works perfectly .....thanks for bringing two of my fav PF tools together.....Love it!

Thanks for your feedback.

Consider donating to these package developers, we will feel fantastic too. ;)
« Last Edit: December 26, 2011, 04:01:24 pm by marcelloc »

Offline sofakng

  • Full Member
  • ***
  • Posts: 109
    • View Profile
Re: pfBlocker
« Reply #268 on: December 28, 2011, 07:32:32 pm »
Does using these large lists slow down the routing at all?  It seems like thousands of IPs in the PF tables would slow it down a bunch... ?

Offline tommyboy180

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 976
    • View Profile
    • TomSchaefer.org
Re: pfBlocker
« Reply #269 on: December 28, 2011, 07:55:36 pm »
Does using these large lists slow down the routing at all?  It seems like thousands of IPs in the PF tables would slow it down a bunch... ?

It depends entirely on your system. Most hardware platforms will not be affected by 100's of thousands of IP's but an embedded system may. It completely depends.

Basically you want to limit your usage to less than 75 to 80 percent of your available RAM. If you're running other addons like squid then you may want to use less than 50 percent of available RAM.

In the cases where the system is slowed down by larger lists or the accumulation of large list the effects will be so small that you will not notice unless you host or depend on real time apps that are time sensitive. Other wise everything should be okay.
« Last Edit: December 28, 2011, 08:02:11 pm by tommyboy180 »
-Tom Schaefer
SuperMicro 1U 2X Intel pro/1000 Dual Core Intel 2.2 Ghz - 2 Gig RAM
TomSchaefer.org/pfsense
Please support Countryblock | IP-Blocklist | File Browser | Strikeback Here