Project

General

Profile

Actions

Bug #6246

closed

pfBlockerNG - filter rule error if all entries in a block list de-dupe out

Added by Andrew - almost 8 years ago. Updated almost 8 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
pfBlockerNG
Target version:
-
Start date:
04/24/2016
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
Affected Plus Version:
Affected Architecture:

Description

I have a number of IPv4 block lists active in pfBlockerNG. Occasionally, the content of the various lists means that one of the lists completely de-dupes out. When that happens, the following error appears in the main system log.

There were error(s) loading the rules: /tmp/rules.debug:288: macro 'pfB_Spyware_Ib' not defined - The line in question reads [288]: block in log quick on $LAN inet from $pfB_Spyware_Ib to any tracker 1770009210 label "USER_RULE: pfB_Spyware_Ib auto rule" @ 2016-04-19 00:11:34

It looks like when the list is empty the filter rule fails, rather than working but blocking no additional IPs.

Actions #1

Updated by BBcan177 . almost 8 years ago

Thanks for the report, please add the following line to /usr/local/pkg/pfblockerng/pfblockerng.sh

Add this line, before the existing Line # 346

emptyfiles # Call emptyfiles function

For a reference to that file:
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/pkg/pfblockerng/pfblockerng.sh#L346

On another note, Its best to get the BlockLists from the orginal Source of the files...

See the following thread:
https://forum.pfsense.org/index.php?topic=86212.msg488934#msg488934

I will add this the the next release...

Actions #2

Updated by Andrew - almost 8 years ago

Thanks. I'll try that edit.

I'm probably being slow, but I didn't follow your comment in relation to the original source of the blocklists. I thought I was getting them from the original sources. Have you seen something to suggest I'm not?

Actions #3

Updated by BBcan177 . almost 8 years ago

Hi Andrew,

"Occasionally, the content of the various lists means that one of the lists completely de-dupes out"
"pfB_Spyware_Ib"

From those two statements, it led me to believe that your using an IBlock Spyware list, and its getting dedup'd to the point where the file is empty. Just keep in mind, that quite a few IBlock lists are a "copy" of other lists. If you want to review your list, you could post in the forum, if you want some help with that.

Actions #4

Updated by Andrew - almost 8 years ago

Thanks. The edit to the pfblockerng.sh file seems to have worked - will report back if I have any issues.

Thanks for clarifying the point around the source of the lists. I'll amend the source of the lists.

Actions #5

Updated by BBcan177 . almost 8 years ago

Actions #6

Updated by Chris Buechler almost 8 years ago

  • Status changed from New to Feedback

PR merged.

Actions #7

Updated by BBcan177 . almost 8 years ago

Can be closed

Actions #8

Updated by Chris Buechler almost 8 years ago

  • Status changed from Feedback to Resolved

thanks BBcan

Actions

Also available in: Atom PDF