Differences between revisions 36 and 38 (spanning 2 versions)

ContentsBR TableOfContents(2)

MoBlock is an application that enables you to block internet traffic based on large lists of IP address ranges in order to protect your privacy. It uses a file in PeerGuardian format (guarding.p2p) or an ipfilter.dat.

There are plans to make it the official PeerGuardian for Linux.

Note: Since version 0.9 MoBlock does no more conflict with other firewalls. But you have to make sure that MoBlock is started after them and the iptables rules don't get changed later. You may also try [http://iplist.sourceforge.net/ iplist] by [http://forums.phoenixlabs.org/member.php?u=8022 uljanow]. Also consider that routers can make software firewalls on your computer redundant.

Add Repository

Add the correct gpg key to the apt keyring

All repositories use this. In terminal, type the following.

gpg --keyserver wwwkeys.eu.pgp.net --recv 9072870B
gpg --export --armor 9072870B | sudo apt-key add -

Add specific repository for release

You have to add the repository sources to your /etc/apt/sources.list:

```
gksu gedit /etc/apt/sources.list
```

In Kubuntu, replace gksu with kdesu.

Add the two lines for your specific release (i.e. Ubuntu 7.10):

Ubuntu 8.04 ("Hardy Heron") 32-bit and 64-bit

deb http://moblock-deb.sourceforge.net/debian hardy main
deb-src http://moblock-deb.sourceforge.net/debian hardy main

Ubuntu 7.10 ("Gutsy Gibbon") 32-bit 64-bit

deb http://moblock-deb.sourceforge.net/debian gutsy main
deb-src http://moblock-deb.sourceforge.net/debian gutsy main

Ubuntu 7.04 ("Feisty Fawn") 32-bit 64-bit

deb http://moblock-deb.sourceforge.net/debian feisty main
deb-src http://moblock-deb.sourceforge.net/debian feisty main

Package Installation

Using Repositories

Install the moblock package. If you want a graphical interface you can also install mobloquer (only hardy and Gutsy). There are also two other packages (moblock-ipq and moblock-nfq) - they are deprecated and will soon be removed.

Ubuntu (development) ("Hardy Heron"), Ubuntu 7.10 ("Gutsy Gibbon") and Ubuntu 7.04 ("Feisty Fawn")

Add the repositories using the above instructions.

Via [:Synaptic:Synaptic Package Manager]

Via aptitude

sudo aptitude update
sudo aptitude install moblock

Ubuntu 6.10 ("Edgy Eft")

These instructions are currently broken, most likely due to a bug in lsb init-functions (lsb-base). Note: there's a working "init-functions" on [http://moblock-deb.svn.sourceforge.net/viewvc/*checkout*/moblock-deb/stuff/init-functions]

Add the repositories using the above instructions.

Then, you need to install two netfilter lib packages.

[http://www.ubuntuforums.org/attachment.php?attachmentid=20162&stc=1&d=1164741758 libnfnetlink] (Hosted by Ubuntu Forums)

[http://www.ubuntuforums.org/attachment.php?attachmentid=20163&stc=1&d=1164741758 libnetfilter-queue] (Hosted by Ubuntu Forums)

Finally, install the moblock package from the repository.

Via [:Synaptic:Synaptic Package Manager]
Via aptitude
```
sudo aptitude install moblock
```

Ubuntu 6.06 ("Dapper Drake")

These instructions have not been confirmed to work. Please report in [http://ubuntuforums.org/showthread.php?t=803183] if they are valid.

Add the repositories using the above instructions.

Then, you need to install two netfilter lib packages.

[http://www.ubuntuforums.org/attachment.php?attachmentid=20165&stc=1&d=1164742172 libnfnetlink] (Hosted by Ubuntu Forums)

[http://www.ubuntuforums.org/attachment.php?attachmentid=20166&stc=1&d=1164742172 libnetfilter-queue] (Hosted by Ubuntu Forums)

Finally, install the moblock package from the repository.

Via [:Synaptic:Synaptic Package Manager]
Via aptitude
```
sudo aptitude install moblock
```

Compile a package

If you want to make your own MoBlock binary package from source and install it, you can use the following instructions. Most users will not need to compile a package, but this can be used for unsupported architectures or for an older release (you will also have to compile netfilter lib packages).

First, make sure you have added a source repository for your release. Then, run the following in terminal.

sudo aptitude update
sudo aptitude install fakeroot
mkdir moblock
cd moblock
sudo apt-get build-dep -y moblock
apt-get source moblock
cd moblock-*
dpkg-buildpackage -rfakeroot
cd ..
sudo dpkg -i moblock*.deb
sudo apt-get install -f

Some of these commands can be combined into one, but this lets you make changes like adding a patch if necessary and explains the process better.

Explanation: the directory moblock is created and the current working directory is changed to it. Moblock's development dependencies are then installed. The MoBlock source package is downloaded and the current working directory is changed to it. The source and binary packages are built and the working directory is moved one directory up. Then the moblock*.deb is installed and its dependencies are installed.

Install a package

Use the instructions at the [:InstallingSoftware] page under [:InstallingSoftware#head-c0628aa246e0b55ea2009705d1b5a84ede8736b5:Installing downloaded packages]

Configuration and Usage

The packages contain the moblock-control script with the following features:

start and stop MoBlock (including handling of the iptables rules if desired)
update the specified blocklists from online sources
use local blocklists
modify the blocklist and whitelist IPs and ports

The logfiles are rotated daily.

In the default configuration MoBlock starts at system boot and some preconfigured blocklists are updated once a day. You can specify the blocklists to use in /etc/moblock/blocklists.list. Everything else (automatic start and update, iptables handling, IP and port whitelisting) is configured in /etc/moblock/moblock.conf. This is important especially if MoBlock blocks sites that it should not block.

Start MoBlock

```
sudo moblock-control start
```

Stop MoBlock

```
sudo moblock-control stop
```

Restart MoBlock

```
sudo moblock-control restart
```

Rebuild Blocklist

```
sudo moblock-control reload
```

Moblock is then reloaded.

Update Blocklists

```
sudo moblock-control update
```

Moblock is then reloaded.

MoBlock Status

```
sudo moblock-control status
```

It receives the iptables settings and the status of the MoBlock daemon.

Test MoBlock

```
sudo moblock-control test
```

The test has been known to have problems in older versions of MoBlock. Look at the log to check if you are unsure. This can be done interactively (this command will show you the log in real-time).

```
tail -f /var/log/moblock.log
```

Frequently Asked Questions (FAQ)

I cannot connect to the internet any more!

MoBlock often blocks your complete LAN, including your router. So you have to whitelist your LAN. If you don't know your local IP check it with "sudo ifconfig". It's the value after "inet addr:" of the interface that you use for networking. For wired connections this might be "eth0", for wireless connections "wlan0".

Example: You found out that your IP is 192.168.0.39. Then your LAN will most probably cover the IP range 192.168.0.1-192.168.0.255. Then you need to whitelist this range for incoming and outgoing connections.

Edit /etc/default/moblock (in Kubuntu, replace gksu with kdesu)

```
gksu gedit /etc/default/moblock
```

and add these lines:

WHITE_IP_IN="192.168.0.0/24"
WHITE_IP_OUT="192.168.0.0/24"

Do a

```
moblock-control restart
```

when you have changed these settings.

Some applications cannot connect to the internet any more!

No ports are whitelisted by default. So, if the IP address that your application is trying to reach is in the blocklist, it will be blocked. To change this edit /etc/default/moblock (in Kubuntu, replace gksu with kdesu)

```
gksu gedit /etc/default/moblock
```

and add this line:

```
WHITE_TCP_OUT="http https"
```

Do a

```
moblock-control restart
```

when you have changed these settings.

See? By default port 80 and 443 (also called http and https) is configured, for outgoing connections. In effect, you can now browse blocked ips, with firefox/konqueror or any other browser. If you know the port number of an application you use, then this is the place to put it. If you want to put a range of ports, use the format "startport:endport".

But why can I not just remove the IP address from the blocklist instead?

You can. And this is remommended for your LAN, see above! Find out what you want to whitelist by checking /var/log/moblock.log. This can be done interactively (this command will show you the log in real-time).

```
tail -f /var/log/moblock.log
```

Then, edit /etc/default/moblock (in Kubuntu, replace gksu with kdesu)

```
gksu gedit /etc/default/moblock
```

To whitelist IPs add the following variables:

WHITE_IP_IN=""
WHITE_IP_OUT=""
WHITE_IP_FORWARD=""

Insert e.g. "192.168.178.1" to whitelist a single IP, or e.g. "192.168.178.0/24" to whitelist an IP range (192.168.178.0 - 192.168.178.255) or e.g. "192.168.0.0/16" to whitelist a bigger IP range (192.168.0.0 - 192.168.255.255)

Separate IP addresses with a whitespace. So you might have an entry like this:

WHITE_IP_IN="192.168.0.0/24"
WHITE_IP_OUT="192.168.0.0/24 123.123.123.123 234.234.234.234"

Do a

```
moblock-control restart
```

when you have changed these settings.

You can also use a search phrase, such as Google, Hotmail, or an actual IP address range (as specified in the blocklists). Add the following variable to /etc/default/moblock:

```
IP_REMOVE=""
```

Separate phrases with a semicolon. So you might have an entry like this:

IP_REMOVE="google;yahoo;altavista"

Do a

moblock-control reload

when you have changed these settings.

Remember to reload or restart MoBlock after modifying the configuration.

How do I choose what blocklists to include in the update function?

Edit /etc/moblock/blocklists.list

```
gksu gedit /etc/moblock/blocklists.list
```

In Kubuntu, replace gksu with kdesu.

Uncomment the blocklists, that is, remove the hash (#) to enable certain blocklists or comment them out by adding a hash before the blocklists to disable them.

Do a

```
moblock-control update
```

when you have changed these settings.

How do I keep it installed, without having it run at startup?

Edit /etc/default/moblock.

```
gksu gedit /etc/default/moblock
```

In Kubuntu, replace gksu with kdesu.

Set the following:

```
MOBLOCK_INIT="0"
```

What happens when I install MoBlock the first time?

It will download a new blocklist for you during installation, and start it as a deamon. In other words, it will start automatically everytime you boot up.

I have a custom compiled kernel. Moblock does not work.

MoBlock depends on netfilter support in the kernel. There are two possibilities:

Netfilter support as kernel modules (recommended): Enable netfilter support in xconfig, or in the kernel source config file as modules.

Netfilter support built-in directly in the kernel: Enable netfilter support in xconfig, or in the kernel source config file. Then edit /etc/default/moblock:

```
gksu gedit /etc/default/moblock
```

In Kubuntu, replace gksu with kdesu.

Set the following:

```
IPTABLES_MODULES="0"
```

This will turn off the module loading and assume that the necessary netfilter support is compiled in the kernel (available since moblock 0.9~rc2-12).

How do I change automatic updating?

MoBlock automatically updates its blocklists everyday. To configure automatic updating, edit /etc/default/moblock.

```
gksu gedit /etc/default/moblock
```

The number in the following setting enables (1) or disables (2) automatic updating.

```
MOBLOCK_CRON="1"
```

To disable automatic updating, set the following.

```
MOBLOCK_CRON="0"
```

MoBlock fails to start or stop

Have a look at /var/log/moblock-control.log and /var/log/moblock.log. In most cases an incorrect configuration option is the reason. If you don't understand the logfiles post them at the forum (please do this in CODE tags). If you think you messed thinks up you can make a clean reinstall:

aptitude purge moblock
aptitude install moblock

Credits

Special thanks to [http://ubuntuforums.org/member.php?u=50108 pelle.k] for the Ubuntu Forums [http://ubuntuforums.org/showthread.php?p=1114891 thread] this is derived from, the MoBlock Debian Packages maintainer [http://ubuntuforums.org/member.php?u=228584 jre], and the contributors to MoBlock. The Ubuntu 7.10 64-bit package and source page shell script were provided by [http://ubuntuforums.org/member.php?u=182332 daradib]. The Ubuntu 7.04 64-bit package was provided by [http://ubuntuforums.org/member.php?u=58418 minijoe]. The Ubuntu 6.06 netfilter lib packages were provided by [http://ubuntuforums.org/member.php?u=14921 foxy123].

-  ⇤ ← Revision 36 as of 2008-05-31 11:12:16 → 
  Size: 12804
  Editor: yangmei
  Comment:
+   ← Revision 38 as of 2008-06-23 16:32:10 → ⇥
  Size: 14084
  Editor: yangmei
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 196:
+== I cannot connect to the internet any more! ==

MoBlock often blocks your complete LAN, including your router. So you have to whitelist your LAN. If you don't know your local IP check it with "sudo ifconfig". It's the value after "inet addr:" of the interface that you use for networking. For wired connections this might be "eth0", for wireless connections "wlan0".

Example: You found out that your IP is 192.168.0.39. Then your LAN will most probably cover the IP range 192.168.0.1-192.168.0.255. Then you need to whitelist this range for incoming and outgoing connections.
  
Edit /etc/default/moblock (in Kubuntu, replace gksu with kdesu)
 {{{
gksu gedit /etc/default/moblock
}}}
and add these lines:
 {{{
WHITE_IP_IN="192.168.0.0/24"
WHITE_IP_OUT="192.168.0.0/24"
}}}

Do a
 {{{
moblock-control restart
}}}
when you have changed these settings.
-Line 198:
+Line 220:
-No ports are whitelisted by default. So, if the IP address your application is trying to reach, is in the blocklist, it is blocked.
To change that add the following to /etc/default/moblock
 {{{
gksu gedit /etc/default/moblock
}}}

In Kubuntu, replace gksu with kdesu.
+No ports are whitelisted by default. So, if the IP address that your application is trying to reach is in the blocklist, it will be blocked.
To change this edit /etc/default/moblock (in Kubuntu, replace gksu with kdesu)
 {{{
gksu gedit /etc/default/moblock
}}}
and add this line:
-Line 221:
+Line 242:
-You can. And this is remommended for your LAN! Find out what you want to whitelist by checking /var/log/moblock.log. This can be done interactively (this command will show you the log in real-time).
+You can. And this is remommended for your LAN, see above! Find out what you want to whitelist by checking /var/log/moblock.log. This can be done interactively (this command will show you the log in real-time).
-Line 226:
+Line 247:
-Then, edit /etc/default/moblock
 {{{
gksu gedit /etc/default/moblock
}}}

In Kubuntu, replace gksu with kdesu.
+Then, edit /etc/default/moblock (in Kubuntu, replace gksu with kdesu)
 {{{
gksu gedit /etc/default/moblock
}}}
-Line 244:
+Line 263:
-Separate IP addresses with a whitespace. Do a
+Separate IP addresses with a whitespace. So you might have an entry like this:
 {{{
WHITE_IP_IN="192.168.0.0/24"
WHITE_IP_OUT="192.168.0.0/24 123.123.123.123 234.234.234.234"
}}}

Do a
-Line 251:
+Line 276:
-You can also use a search phrase, such as Google, Hotmail, or an actual IP address range (as specified in the blocklists). Add the following variable:
 {{{
# Do a "moblock-control reload" when you have changed these settings.
+You can also use a search phrase, such as Google, Hotmail, or an actual IP address range (as specified in the blocklists). Add the following variable to /etc/default/moblock:
 {{{
-Line 257:
+Line 281:
-Separate phrases with a semicolon. Do a
+Separate phrases with a semicolon. So you might have an entry like this:
 {{{
IP_REMOVE="google;yahoo;altavista"
}}}

 Do a
-Line 303:
+Line 332:
+MoBlock depends on netfilter support in the kernel. There are two possibilities:

'''Netfilter support as kernel modules (recommended):'''
-Line 305:
+Line 337:
-Alternatively, if you have iptables support built-in directly in the kernel edit /etc/default/moblock:
+'''Netfilter support built-in directly in the kernel:'''
Enable netfilter support in xconfig, or in the kernel source config file. Then edit /etc/default/moblock:
-Line 316:
+Line 349:
-This will turn off the module loading and assume that the necessary iptables support is compiled in the kernel (available since moblock 0.9~rc2-12).
+This will turn off the module loading and assume that the necessary netfilter support is compiled in the kernel (available since moblock 0.9~rc2-12).
-Line 336:
+Line 369:
-== How do I find out which port a blocked packet was sent on?

Edit /etc/default/moblock.
 {{{
gksu gedit /etc/default/moblock
}}}

The number in the following setting enables (1) or disables (2) automatic updating.
 {{{
LOG_IPTABLES="LOG --log-level info"
}}}

Separate IP addresses with a whitespace. Do a
 {{{
moblock-control restart"
}}}
when you have changed these settings.
+== MoBlock fails to start or stop ==
Have a look at /var/log/moblock-control.log and /var/log/moblock.log. In most cases an incorrect configuration option is the reason. If you don't understand the logfiles post them at the forum (please do this in CODE tags).
If you think you messed thinks up you can make a clean reinstall: 
 {{{
aptitude purge moblock
aptitude install moblock
}}}

Ubuntu Documentation

Diff for "MoBlock"

Add Repository

Add the correct gpg key to the apt keyring

Add specific repository for release

Ubuntu 8.04 ("Hardy Heron") 32-bit and 64-bit

Ubuntu 7.10 ("Gutsy Gibbon") 32-bit 64-bit

Ubuntu 7.04 ("Feisty Fawn") 32-bit 64-bit

Package Installation

Using Repositories

Ubuntu (development) ("Hardy Heron"), Ubuntu 7.10 ("Gutsy Gibbon") and Ubuntu 7.04 ("Feisty Fawn")

Ubuntu 6.10 ("Edgy Eft")

Ubuntu 6.06 ("Dapper Drake")

Compile a package

Install a package

Configuration and Usage

Start MoBlock

Stop MoBlock

Restart MoBlock

Rebuild Blocklist

Update Blocklists

MoBlock Status

Test MoBlock

Frequently Asked Questions (FAQ)

I cannot connect to the internet any more!

Some applications cannot connect to the internet any more!

But why can I not just remove the IP address from the blocklist instead?

How do I choose what blocklists to include in the update function?

How do I keep it installed, without having it run at startup?

What happens when I install MoBlock the first time?

I have a custom compiled kernel. Moblock does not work.

How do I change automatic updating?

MoBlock fails to start or stop

Credits

Further Reading