Adding IP-Blocklist package: This package uses the pf (pfctl) to block IP addresses. For each IP range or list added a pf table is made and applied to the firewall to prevent traffic from being sent to and traffic from being received from the target. You can either enter an IP range manually (experimental) or add a list from sites like iblocklist.com. Tested on 1.2.2 and 1.2.3 with FF and IE.

11 files changed, 823 insertions, 0 deletions

diff --git a/config/ipblocklist/IP-Blocklist.sh b/config/ipblocklist/IP-Blocklist.sh
new file mode 100755
index 00000000..14ca535d
--- /dev/null
+++ b/config/ipblocklist/IP-Blocklist.sh
@@ -0,0 +1 @@
+/usr/local/www/packages/ipblocklist/convert-execute.sh
\ No newline at end of file
diff --git a/config/ipblocklist/convert-execute.sh b/config/ipblocklist/convert-execute.sh
new file mode 100755
index 00000000..f50baa98
--- /dev/null
+++ b/config/ipblocklist/convert-execute.sh
@@ -0,0 +1,77 @@
+pfctl -t ipblocklist -T kill

+sed -i -e '/ipblocklist/d' /tmp/rules.debug

+

+#ipfw -f -q flush (Version 0.1.4)

+ls lists > file_list.txt

+filelist="file_list.txt"

+

+#READ contents in file_list.txt and process as file

+for fileline in $(cat $filelist); do

+iplist="lists/$fileline"

+iplistout="lists/ipfw.ipfw"

+perl convert.pl $iplist $iplistout

+done

+#echo "ipfw made"

+

+#clean up ipfw.ipfw (duplicates)

+rm lists/ipfw.ipfwTEMP

+sort lists/ipfw.ipfw | uniq -u >> lists/ipfw.ipfwTEMP

+mv lists/ipfw.ipfwTEMP lists/ipfw.ipfw

+#echo "ipfw clean"

+

+

+

+#Now edit /tmp/rules.debug

+

+#find my line for table

+export i=`grep -n 'block quick from any to <snort2c>' /tmp/rules.debug | grep -o '[0-9]\{2\}'`

+export t=`grep -n 'User Aliases' /tmp/rules.debug |grep -o '[0-9]'`

+

+i=$(($i+'1'))

+t=$(($t+'1'))

+#echo $i

+#echo $t

+

+rm /tmp/rules.debug.tmp

+

+#Insert table-entry limit 

+sed -i -e '/900000/d' /tmp/rules.debug

+while read line

+	do a=$(($a+1)); 

+	#echo $a;

+	if [ "$a" = "$t" ]; then

+		echo "" >> /tmp/rules.debug.tmp

+		echo "set limit table-entries 900000" >> /tmp/rules.debug.tmp

+	fi

+	echo $line >> /tmp/rules.debug.tmp

+done < "/tmp/rules.debug"

+

+mv /tmp/rules.debug /tmp/rules.debug.old

+mv /tmp/rules.debug.tmp /tmp/rules.debug

+

+pfctl -o basic -f /tmp/rules.debug > errorOUT.txt 2>&1

+

+rm /tmp/rules.debug.tmp

+#Insert ipblocklist rules

+a="0"

+echo $a

+while read line

+	do a=$(($a+1));

+	echo $a; 

+	if [ "$a" = "$i" ]; then

+		echo "" >> /tmp/rules.debug.tmp

+		echo "#ipblocklist" >> /tmp/rules.debug.tmp

+		echo "table <ipblocklist> persist file '/usr/local/www/packages/ipblocklist/lists/ipfw.ipfw'" >> /tmp/rules.debug.tmp

+		echo "block quick from <ipblocklist> to any label 'IP-Blocklist'" >> /tmp/rules.debug.tmp

+		echo "block quick from any to <ipblocklist> label 'IP-Blocklist'" >> /tmp/rules.debug.tmp

+	fi

+	echo $line >> /tmp/rules.debug.tmp

+done < "/tmp/rules.debug"

+

+mv /tmp/rules.debug /tmp/rules.debug.old

+mv /tmp/rules.debug.tmp /tmp/rules.debug

+

+#Now execute the ipfw list (Take a long time in old version)

+#sh lists/ipfw.ipfw (Version 0.1.4)

+rm errorOUT.txt

+pfctl -o basic -f /tmp/rules.debug > errorOUT.txt 2>&1

diff --git a/config/ipblocklist/convert.pl b/config/ipblocklist/convert.pl
new file mode 100755
index 00000000..44b4add2
--- /dev/null
+++ b/config/ipblocklist/convert.pl
@@ -0,0 +1,67 @@
+#!/usr/bin/perl -w

+use strict;

+

+if($#ARGV != 1) {

+    print("Usage: $0 <input file> <output file>\n");

+    exit(1);

+}

+

+my ($line,$title,$iprange,$cidr);

+my $i = 30000;

+

+open(INFILE,'<',$ARGV[0]) or die("Could not open input file $ARGV[0]");

+open(OUTFILE,'>>',$ARGV[1]) or die("Could not open output file $ARGV[1]");

+

+foreach $line (<INFILE>) {

+    chomp($line);

+    $line =~ s/:((\d{1,3}[-\.]*){8})//;

+    $iprange = $1;

+    print OUTFILE "#$line\n";

+    foreach $cidr (split(/\n/,range($iprange))) {

+        print OUTFILE "$cidr\n";     

+        #print OUTFILE "ipfw -q add 1000 drop ip from any to $cidr\n";   (version 0.1.4)

+        #$i++;

+        #print OUTFILE "ipfw -q add 1001 drop ip from $cidr to any\n";   (version 0.1.4) 

+        #$i++;

+    }

+}

+

+close(INFILE);

+close(OUTFILE);

+

+sub ntoa {

+    return join ".",unpack("CCCC",pack("N",shift));

+}

+sub aton {

+    return unpack 'N', pack 'C4', split/\./, shift;

+}

+sub deaggregate {

+    my $thirtytwobits = 4294967295;

+    my $start = shift;

+    my $end = shift;

+    my $base = $start;

+    my ($step,$output);

+    while ($base <= $end) {

+        $step = 0;

+        while (($base | (1 << $step)) != $base) {

+            if (($base | (((~0) & $thirtytwobits) >> (31-$step))) > $end) {

+                last;

+            }

+            $step++;

+        }

+        if($step == 0) {

+            $output .= ntoa($base);

+        }else{

+            $output .= ntoa($base)."/" .(32-$step);

+        }

+        $output .= "\n";

+        $base += 1 << $step;

+    }

+    return $output;

+}

+sub range {

+    my ($address,$address2) = split /-/, shift;

+    $address = aton($address);

+    $address2 = aton($address2);

+    return deaggregate($address,$address2);

+}
\ No newline at end of file
diff --git a/config/ipblocklist/index.tmp b/config/ipblocklist/index.tmp
new file mode 100755
index 00000000..7c768af6
--- /dev/null
+++ b/config/ipblocklist/index.tmp
@@ -0,0 +1,11 @@
+<html>
+<HEAD>
+<SCRIPT language="JavaScript">
+<!--
+window.parent.location="../../index.php";
+//-->
+</SCRIPT>
+</HEAD>
+
+
+</html>
\ No newline at end of file
diff --git a/config/ipblocklist/ipblocklist.inc b/config/ipblocklist/ipblocklist.inc
new file mode 100755
index 00000000..a950d188
--- /dev/null
+++ b/config/ipblocklist/ipblocklist.inc
@@ -0,0 +1,130 @@
+<?php
+/* $Id$ */
+/*
+/* ========================================================================== */
+/*
+	dnsblacklist.inc
+	Copyright (C) 2010 Tom Schaefer
+	All rights reserved.
+																			*/
+/* ========================================================================== */
+/*
+	Redistribution and use in source and binary forms, with or without
+	modification, are permitted provided that the following conditions are met:
+
+	1. Redistributions of source code must retain the above copyright notice,
+		this list of conditions and the following disclaimer.
+
+	2. Redistributions in binary form must reproduce the above copyright
+		notice, this list of conditions and the following disclaimer in the
+		documentation and/or other materials provided with the distribution.
+
+	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+	POSSIBILITY OF SUCH DAMAGE.
+*/
+
+function pkg_is_service_running($servicename) 
+{
+	exec("/bin/ps ax | awk '{ print $5 }'", $psout);
+	array_shift($psout);
+	foreach($psout as $line) {
+		$ps[] = trim(array_pop(explode(' ', array_pop(explode('/', $line)))));
+	}
+	if(is_service_running($servicename, $ps) or is_process_running($servicename) ) {
+		return true;
+	}
+	else {
+		return false;
+	}
+}
+
+function byte_convert( $bytes ) {
+	if ($bytes<=0)
+		return '0 Byte';
+
+	$convention=1000; //[1000->10^x|1024->2^x]
+	$s=array('B', 'kB', 'MB', 'GB', 'TB', 'PB', 'EB', 'ZB');
+	$e=floor(log($bytes,$convention));
+	return round($bytes/pow($convention,$e),2).' '.$s[$e];
+}
+
+ 
+
+
+function php_sync_package() 
+{
+	global $config;
+}
+
+
+function php_install_command() 
+{
+
+	global $config;
+	conf_mount_rw();
+	config_lock();
+
+	if (!is_dir('/usr/local/www/packages/')) {
+		exec("mkdir /usr/local/www/packages/");
+	}
+
+	if (!is_dir('/usr/local/www/packages/ipblocklist/')) {
+		exec("mkdir /usr/local/www/packages/ipblocklist/");
+	}
+
+	
+	//install PERL
+	exec("pkg_add -r ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7.2-release/All/perl-5.8.9_2.tbz");
+	exec("pkg_add -r ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-7.2-release/All/p5-Net-CIDR-0.13.tbz");
+
+	//rename PHP files from .tmp to .php
+	exec("cp /tmp/ipblocklist.tmp /usr/local/www/packages/ipblocklist/ipblocklist.php");
+	unlink_if_exists("/tmp/ipblocklist.tmp");
+	exec("cp /tmp/ipblocklist_list.tmp /usr/local/www/packages/ipblocklist/ipblocklist_list.php");
+	unlink_if_exists("/tmp/ipblocklist_list.tmp");
+	exec("cp /tmp/purge.tmp /usr/local/www/packages/ipblocklist/purge.php");
+	unlink_if_exists("/tmp/purge.tmp");
+	exec("cp /tmp/index.tmp /usr/local/www/packages/ipblocklist/index.php");
+	unlink_if_exists("/tmp/index.tmp");
+	exec("cp /tmp/manual_add.tmp /usr/local/www/packages/ipblocklist/manual_add.php");
+	unlink_if_exists("/tmp/manual_add.tmp");
+	exec("cp /tmp/purgeip.tmp /usr/local/www/packages/ipblocklist/purgeip.php");
+	unlink_if_exists("/tmp/purgeip.tmp");
+	//Get scripts
+	exec("cp /tmp/convert.pl /usr/local/www/packages/ipblocklist/convert.pl");
+	unlink_if_exists("/tmp/convert.pl");
+	exec("cp /tmp/convert-execute.sh /usr/local/www/packages/ipblocklist/convert-execute.sh");
+	unlink_if_exists("/tmp/convert-execute.sh");
+	exec("cp /tmp/IP-Blocklist.sh /usr/local/etc/rc.d/IP-Blocklist.sh");
+	unlink_if_exists("/tmp/convert-execute.sh");
+	
+	
+
+	conf_mount_ro();
+	config_unlock();
+}
+
+
+function deinstall_command() 
+{
+	conf_mount_rw();
+	$handle = popen("/usr/local/etc/rc.d/ipblocklist.sh stop", "r");
+	unlink_if_exists("/usr/local/pkg/ipblocklist.xml");
+	unlink_if_exists("/usr/local/pkg/ipblocklist.inc");
+	exec("rm -R /usr/local/www/packages/ipblocklist/ipblocklists");
+	exec("rm -R /usr/local/www/packages/ipblocklist");
+	exec("rm /usr/local/etc/rc.d/IP-Blocklist.sh");
+	exec("pfctl -t ipblocklist -T kill");
+	exec("ipfw -f flush");
+	conf_mount_ro();
+}
+
+?>
\ No newline at end of file
diff --git a/config/ipblocklist/ipblocklist.tmp b/config/ipblocklist/ipblocklist.tmp
new file mode 100755
index 00000000..cf61bfc8
--- /dev/null
+++ b/config/ipblocklist/ipblocklist.tmp
@@ -0,0 +1,156 @@
+<?php
+
+	
+	require_once('config.inc');
+	require("guiconfig.inc");
+	include("head.inc");
+
+	//set the config as a global variable
+	global $config;
+
+	$global_usage = '/usr/local/www/packages/ipblocklist/global_usage';
+	//$fh = fopen($global_usage, 'r');
+
+	//phpinfo();
+	
+if (count($_POST)>0) {
+
+	conf_mount_rw();
+
+	$ent = array();
+
+	if ($_POST['enable'] == 1) {
+		//echo "enabled";
+		$config['installedpackages']['ipblocklist_settings']['config'][0]['enable'] = 1;
+		
+	//Load ipfw.ko
+	//exec("kldload ipfw.ko"); (Version 0.1.4)
+	//Process list by downloading and extracting
+		$myFile = "lists.txt";
+		$fileContents = file_get_contents($myFile);
+		$lines = explode(PHP_EOL, $fileContents);
+	//Remove DIR lists to eliminate duplates
+		exec("rm -R lists");
+	//Process each list URL, Extract, and put in DIR lists
+		exec("mkdir lists");
+		foreach ($lines as $line) {
+			exec("fetch -o lists $line");
+		 	$filename = basename($line);
+		 	//Extract list
+		 	exec("gzip -d lists/$filename");
+		 	}
+	//Prep pfctl
+	mwexec("touch lists/ipfw.ipfw");
+       //Now clear ipfw, and process each list to ipfw commands
+		mwexec("sh convert-execute.sh");
+				
+	}
+	else {
+		//echo "disabled";
+		$config['installedpackages']['ipblocklist_settings']['config'][0]['enable'] = 0;
+		//Clear Lists
+		mwexec("ipfw -f flush"); 
+		mwexec("pfctl -t ipblocklist -T kill");
+		mwexec("rm -R /usr/local/www/packages/ipblocklist/lists");
+		mwexec("sed -i -e '/ipblocklist/d' /tmp/rules.debug");
+		mwexec("pfctl -o basic -f /tmp/rules.debug");
+		//Clear errorOUT.txt
+		mwexec("rm errorOUT.txt");
+		
+	}
+
+
+	write_config();
+	//services_dnsmasq_configure();
+	sleep(1);
+	$savemsg_dnsb = "IP-Blocklist settings have been saved/updated. ";
+	conf_mount_ro();
+}
+?>
+
+<?php include("fbegin.inc"); ?>
+<p class="pgtitle">Firewall: IP-Blocklist</p>
+<form method=POST action="">
+
+<?php
+if ($config['installedpackages']['ipblocklist_settings']['config'][0]['enable'] == 1) {
+	echo "<input name='enable' type='checkbox' value='1' checked>\n";
+}
+else {
+	echo "<input name='enable' type='checkbox' value='1'>\n";
+}
+?>
+
+<strong>Enable IP-Blocklist</strong><br><br>
+<table width="100%" border="0" cellpadding="0" cellspacing="0">
+<tr>
+	<td class="tabcont" >
+	<?php if ($savemsg_dnsb) print_info_box($savemsg_dnsb); ?>
+
+	</form>
+	<center>
+	<iframe frameboarder=0 boarder=0 src="ipblocklist_list.php" name="lists" id="lists" width="100%" height="200">
+	</iframe>
+	</center>
+	<br/>
+	<u>Usage</u>
+	<br/>
+	Add direct link to list and press <img src="../../themes/nervecenter/images/icons/icon_plus.gif">
+ 	(Example: 
+	<a href="http://iblocklist.whitacrecomputers.com/files/bt_level1.gz">Level1</a>,
+	<a href="http://iblocklist.whitacrecomputers.com/files/bt_level2.gz">Level2</a>,
+	<a href="http://iblocklist.whitacrecomputers.com/files/bt_level3.gz">Level3</a>)
+	<br/>
+	Compressed lists should have .gz extention	<br/>
+	<br/>
+	<!--
+	<br/>
+	Be Patient - <u>Level3</u> lists take about 5m. <u>Level1</u> lists take about 1h<br/>
+	
+	 
+	<br/>If you use a Level1 list or multiple lists, the webserver will become unresponsive <a href="http://forum.pfsense.org/index.php/topic,24769.0.html"><img src="../../themes/nervecenter/images/icons/icon_log.gif"></a>
+	(version 0.1.4) 
+	-->
+	<br/><span style="color:red">Warning!</span> - Apply after each reboot or firewall change. Use at your own risk.
+	<?php 
+	echo "<br/><br/>Current Status = ";
+	ob_start();
+	$results = exec("pfctl -s rules | grep -c ipblocklist");
+	ob_end_clean(); 
+	if ($results == '2') echo "Running";
+	else
+	 echo "<span style='color:red'>NOT running</span>";
+		
+	//Get Errors if exists
+	ob_start();
+	$results = exec("tail -r errorOUT.txt");
+	ob_end_clean(); 
+	echo "<br/><span style='color:red'>";
+	echo $results;
+	echo "</span>";
+	?>
+
+
+
+<br/>
+<br/>
+
+
+
+
+</div>
+<?php
+	//This input guarantees that a POST is sent
+	echo "<input type='hidden' name='zzz' value='required'>";
+?>
+
+</td>
+</tr>
+</table>
+<input type="submit" value="Save/Update">
+</form>
+
+<?php include("fend.inc"); ?>
+
+</body>
+</html>
\ No newline at end of file
diff --git a/config/ipblocklist/ipblocklist.xml b/config/ipblocklist/ipblocklist.xml
new file mode 100755
index 00000000..9b9e3c72
--- /dev/null
+++ b/config/ipblocklist/ipblocklist.xml
@@ -0,0 +1,145 @@
+<?xml version="1.0" encoding="utf-8" ?>

+<!DOCTYPE packagegui SYSTEM "./schema/packages.dtd">

+<?xml-stylesheet type="text/xsl" href="./xsl/package.xsl"?>

+<packagegui>

+	<copyright>

+	<![CDATA[

+/* $Id$ */

+/* ========================================================================== */

+/*

+	ipblocklist.xml

+	Copyright (C) 2010 Tom Schaefer

+	All rights reserved.

+                                                                              */

+/* ========================================================================== */

+/*

+	Redistribution and use in source and binary forms, with or without

+	modification, are permitted provided that the following conditions are met:

+

+	1. Redistributions of source code must retain the above copyright notice,

+		this list of conditions and the following disclaimer.

+

+	2. Redistributions in binary form must reproduce the above copyright

+		notice, this list of conditions and the following disclaimer in the

+		documentation and/or other materials provided with the distribution.

+

+	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,

+	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY

+	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE

+	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,

+	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF

+	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS

+	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN

+	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

+	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE

+	POSSIBILITY OF SUCH DAMAGE.

+                                                                              */

+/* ========================================================================== */

+		]]>

+		</copyright>

+	<description>IP Blocklist</description>

+	<requirements>perl</requirements>

+	<faq>http://forum.pfsense.org/index.php/topic,24769.0.html</faq>

+	<name>IP Blocklist Settings</name>

+	<version>0.1.9</version>

+	<title>Settings</title>

+	<include_file>/usr/local/pkg/ipblocklist.inc</include_file>

+	<menu>

+		<name>IP Blocklist</name>

+		<tooltiptext>IP Blocklist settings.</tooltiptext>

+		<section>Firewall</section>

+		<configfile>ipblocklist.xml</configfile>

+		<url>/packages/ipblocklist/ipblocklist.php</url>

+	</menu>

+	<tabs>

+		<tab>

+			<text>Settings</text>

+			<url>/packages/ipblocklist/ipblocklist.php</url>

+			<active/>

+		</tab>

+	</tabs>

+	<configpath>installedpackages->package->$packagename->configuration->ipblocklist</configpath>	

+	<additional_files_needed>

+		<prefix>/usr/local/pkg/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/ipblocklist.xml</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/usr/local/pkg/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/ipblocklist.inc</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/ipblocklist.tmp</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/ipblocklist_list.tmp</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/convert.pl</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/convert-execute.sh</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/purge.tmp</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/index.tmp</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/manual_add.tmp</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/purgeip.tmp</item>

+	</additional_files_needed>

+	<additional_files_needed>

+		<prefix>/tmp/</prefix>

+		<chmod>0755</chmod>

+		<item>http://www.tomschaefer.org/temp/pfsense/packages/packages/config/IP-Blocklist/IP-Blocklist.sh</item>

+	</additional_files_needed>

+	<fields>

+		<field>

+			<fielddescr>Variable One</fielddescr>

+			<fieldname>var1</fieldname>

+			<description>Enter the variable one here.</description>

+			<type>input</type>

+		</field>

+		<field>

+			<fielddescr>Variable Two</fielddescr>

+			<fieldname>var1</fieldname>

+			<description>Enter the variable one here.</description>

+			<type>input</type>

+		</field>

+	</fields>

+	<custom_add_php_command>

+	</custom_add_php_command>

+	<custom_php_resync_config_command>

+		php_sync_package();

+	</custom_php_resync_config_command>

+	<custom_delete_php_command>    

+		php_sync_package();

+	</custom_delete_php_command>

+	<custom_php_install_command>

+		php_install_command();

+	</custom_php_install_command>

+	<custom_php_deinstall_command>

+		deinstall_command();

+	</custom_php_deinstall_command>

+</packagegui>
\ No newline at end of file
diff --git a/config/ipblocklist/ipblocklist_list.tmp b/config/ipblocklist/ipblocklist_list.tmp
new file mode 100755
index 00000000..669f4384
--- /dev/null
+++ b/config/ipblocklist/ipblocklist_list.tmp
@@ -0,0 +1,115 @@
+<html>
+<head>
+<a href="manual_add.php"><img src="../../themes/nervecenter/images/icons/icon_plus.gif" ALT="Manual" ALIGN=RIGHT></a>
+Add List URL: <form method="post" action="">
+<input name="content" type="text" />
+<input type="image" src="../../themes/nervecenter/images/icons/icon_plus.gif" value="submit">
+<a href="purge.php?line=0">Purge All</a>
+
+<STYLE type="text/css">
+   a img {border:none; }
+ </STYLE>
+</head>
+
+<?php
+
+function delLineFromFile($fileName, $lineNum){
+// check the file exists 
+  if(!is_writable($fileName))
+    {
+    // print an error
+    print "The file $fileName is not writable";
+    // exit the function
+    exit;
+    }
+  else
+      {
+    // read the file into an array    
+    $arr = file($fileName);
+    }
+
+  // the line to delete is the line number minus 1, because arrays begin at zero
+  $lineToDelete = $lineNum-1;
+ 
+  // check if the line to delete is greater than the length of the file
+  if($lineToDelete > sizeof($arr))
+    {
+      // print an error
+    print "You have chosen a line number, <b>[$lineNum]</b>,  higher than the length of the file.";
+    // exit the function
+    exit;
+    }
+
+  //remove the line
+  unset($arr["$lineToDelete"]);
+
+  // open the file for reading
+  if (!$fp = fopen($fileName, 'w+'))
+    {
+    // print an error
+        print "Cannot open file ($fileName)";
+      // exit the function
+        exit;
+        }
+  
+  // if $fp is valid
+  if($fp)
+    {
+        // write the array to the file
+        foreach($arr as $line) { fwrite($fp,$line); }
+
+        // close the file
+        fclose($fp);
+        }
+
+echo "done";
+}
+
+
+$myFile = "lists.txt";
+$content = $_REQUEST['content'];
+$fh = fopen($myFile, 'a+');
+fwrite($fh, $content);
+if (strlen($content) > 1) {
+	fwrite($fh, "\n");
+	} else {
+}
+fclose($fh);
+
+
+//echo (filesize($myFile));
+if (filesize($myFile) > 1) {
+	//$fh = fopen($myFile, 'r');
+	//$theData = fread($fh, filesize($myFile));
+	//fclose($fh);
+	echo "<br/> Current List(s): <br/>";
+	// Get the whole file into a single string
+	$fileContents = file_get_contents($myFile);
+ 
+	// Explode the file contents string by each line
+	$lines = explode(PHP_EOL, $fileContents); // Replace PHP_EOL with "\r\n" or "\n" or "\r" if you like
+ 
+	// Iterate through each line and do what you need with it
+
+	foreach ($lines as $line) {
+	 $i++;
+	 echo "<a href=purge.php?line=$i style='border-style: none'><img src='../../themes/nervecenter/images/icons/icon_x.gif'></a>";
+	 echo " ";
+  	 echo $line;
+	 //echo "";
+       // echo $i;
+	 echo "<br/>";
+	 
+	}
+
+	
+	//echo $theData;
+
+
+}
+echo "<br/><br/>";
+
+
+
+
+?>
\ No newline at end of file
diff --git a/config/ipblocklist/manual_add.tmp b/config/ipblocklist/manual_add.tmp
new file mode 100755
index 00000000..ecf42678
--- /dev/null
+++ b/config/ipblocklist/manual_add.tmp
@@ -0,0 +1,69 @@
+<html>
+<head>
+<STYLE type="text/css">
+   a img {border:none; }
+ </STYLE>
+</head>
+<a href="ipblocklist_list.php"><img src="../../themes/nervecenter/images/icons/icon_alias_url_reload.gif" ALT="Manual" ALIGN=RIGHT></a>
+
+<span style="color:red">Experimental!</span> - This uses a different process to block IPs (uses IPFW) <a href="http://forum.pfsense.org/index.php/topic,24822.0.html" target="_blank"><img src="../../themes/nervecenter/images/icons/icon_log.gif"></a>
+  <br/>Enter in IP format (xx.xx.xx.xx) or CIDR format (xx.xx.xx.xx/xx)
+<br/><form method="post" action="">
+<input name="content" type="text" />
+<input type="image" src="../../themes/nervecenter/images/icons/icon_plus.gif" value="submit">
+<br/>
+
+<?php
+
+
+$myFile = "ips.ipfw";
+$content = $_REQUEST['content'];
+$fh = fopen($myFile, 'a+');
+fwrite($fh, $content);
+if (strlen($content) > 1) {
+	fwrite($fh, "\n");
+	} else {
+
+}
+fclose($fh);
+
+
+//echo (filesize($myFile));
+if (filesize($myFile) > 1) {
+	//$fh = fopen($myFile, 'r');
+	//$theData = fread($fh, filesize($myFile));
+	//fclose($fh);
+	echo "<br/> Current List(s): <br/>";
+	// Get the whole file into a single string
+	$fileContents = file_get_contents($myFile);
+ 
+	// Explode the file contents string by each line
+	$lines = explode(PHP_EOL, $fileContents); // Replace PHP_EOL with "\r\n" or "\n" or "\r" if you like
+ 
+	// Iterate through each line and do what you need with it
+
+	foreach ($lines as $line) {
+	 $i++;
+	 echo "<a href=purgeip.php?line=$i style='border-style: none'><img src='../../themes/nervecenter/images/icons/icon_x.gif'></a>";
+	 echo " ";
+	 exec("kldload ipfw.ko");
+	 exec("ipfw -q add 2000 drop ip from any to $line");
+	 exec("ipfw -q add 2001 drop ip from $line to any");
+  	 echo $line;
+	 //echo "";
+       // echo $i;
+	 echo "<br/>";
+	 
+	}
+
+	
+	
+
+
+}
+echo "<br/><br/>";
+
+
+
+
+?>
\ No newline at end of file
diff --git a/config/ipblocklist/purge.tmp b/config/ipblocklist/purge.tmp
new file mode 100755
index 00000000..47dbed98
--- /dev/null
+++ b/config/ipblocklist/purge.tmp
@@ -0,0 +1,26 @@
+<?php
+$line = $_GET["line"];
+
+//echo("$line");
+//exec("more lists.txt > temp_lists.txt");
+if ($line == 0) {
+	exec("rm lists.txt");
+	} else {
+	exec("sed $line'd' lists.txt > temp_lists.txt");
+	}
+exec("more temp_lists.txt > lists.txt");
+exec("rm temp_lists.txt");
+
+
+?>
+<html>
+<HEAD>
+<SCRIPT language="JavaScript">
+<!--
+window.parent.location="ipblocklist.php";
+//-->
+</SCRIPT>
+</HEAD>
+
+
+</html>
\ No newline at end of file
diff --git a/config/ipblocklist/purgeip.tmp b/config/ipblocklist/purgeip.tmp
new file mode 100755
index 00000000..3622797a
--- /dev/null
+++ b/config/ipblocklist/purgeip.tmp
@@ -0,0 +1,26 @@
+<?php
+$line = $_GET["line"];
+
+//echo("$line");
+//exec("more ips.ipfw > temp_ips.ipfw");
+if ($line == 0) {
+	exec("rm ips.ipfw");
+	} else {
+	exec("sed $line'd' ips.ipfw > temp_ips.ipfw");
+	}
+exec("more temp_ips.ipfw > ips.ipfw");
+exec("rm temp_ips.ipfw");
+
+
+?>
+<html>
+<HEAD>
+<SCRIPT language="JavaScript">
+<!--
+window.parent.location="ipblocklist.php";
+//-->
+</SCRIPT>
+</HEAD>
+
+
+</html>
\ No newline at end of file