How do I whitelist a few countries only?

[NogBadTheBad]

Disable them in the actions pull down.

[paul2019]

@NogBadTheBad said in How do I whitelist a few countries only?:

Disable them in the actions pull down.

Correct, that's what I did, they still remain list in the firewall rules though, is that normal?

[NogBadTheBad]

@paul2019

Do an update Firewall -> pfBlockerNG -> Update

Also no need to hide RFC1918 IP addresses, they aren't routable on the internet.

The ALLOWED_INCOMMING needs to be added to the rules at the bottom, don't allow ALLOWED_INCOMMING to any.

[paul2019]

@NogBadTheBad said in How do I whitelist a few countries only?:

@paul2019

Do an update Firewall -> pfBlockerNG -> Update

Also no need to hide RFC1918 IP addresses, they aren't routable on the internet.

The ALLOWED_INCOMMING needs to be added to the rules at the bottom, don't allow ALLOWED_INCOMMING to any.

You mean the protocol here has to be set like this? (I require UDP as well for SIP). I have many ports to open, from sip to rdp, cameras, etc, so setting up a rule to permit each port can be done and I have to agree that is definitely safer;

Is this the correct place for the new rule to show up?

btw, pfB_IPv4_DENY_v4 is a custom list of US ip addresses that show up every now and then and I need to manually block by adding them to that list.

[paul2019]

@NogBadTheBad Now get it, since I already have those ports open there, of all kinds, I just duplicate them and assign the source to the country permit alias. I have to duplicate cause when editing the source fields are read only for some reason.

[paul2019]

This post is deleted!

[NogBadTheBad]

@paul2019

[paul2019]

@NogBadTheBad said in How do I whitelist a few countries only?:

@paul2019

Awesome, thanks a lot!

[paul2019]

@nogbadthebad said in How do I whitelist a few countries only?:

Use pfBlocker to create an Alias permit and use it on an inbound firewall rule:-

I use the above rule to allow sftp inbound from the UK.

By default everything is blocked by the default WAN rule.

Question, I'm trying to recreate this setup again but after creating this Alias Permit list and force reloading pfblocker the alias doesn't get created and I can't assign it to the source field like I did back in the day when you helped me out here, what could I be doing wrong this time?

[johnpoz]

@paul2019 I do this for my plex access, just create a native alias in pfblocker adding the countries you want to allow. Then just use that alias in your port forward.

I have family in Morocco temporarily, all others are just in the US. And I also allow status cake IPs to monitor if my plex is up, and then the IPs that plex uses to validate if your remote access is available.

[paul2019]

@johnpoz Just changed it to native alias, saved, went to update, did force update and force reload and it still sees only the default ipv4 list and not the new one I created, what could it be...

Alias table IP Counts
-----------------------------
   17630 /var/db/aliastables/pfB_PRI1_v4.txt

[johnpoz]

@paul2019 well you have them all off

[paul2019]

@johnpoz said in How do I whitelist a few countries only?:

@paul2019 well you have them all off

Damn, that was it! These are OFF by default and went completely unnoticed until you mentioned it, thanks a lot.