pfBlockerNG custom block list

deveals

Hello and good day!
Searched this forum, found valuable suggestions, and looking for assistance configuring pfBlockerNG to add inbound/outbound blocking for custom TCP/IP address list. I added 103.10.4.85 address and received the following error during update/run:

[ Nazgul_custom_v4 ] Downloading update
Collecting host IP: 103.10.4.85... completed
. completed ..
[ pfB_Nazgul_v4 Nazgul_custom_v4 ] Custom List: No IPs found! Ensure only IP based Feeds are used! ]

It this time, I'm still able to ping 103.10.4.85 address. Whereas I'm still learning:

Did I miss something in setup for IP address format or should I add the IP to a file (if so, file name, format, and location)?
If configured correctly, are pings for blocked IP addresses allowed

Thanks. Danny.

johnpoz

@deveals you don't need pfblocker to create a basic IP list, you can do that in the normal alias function.

while you can add specific IPs to an alias in pfblocker, its more designed to grab lists of ips, it really is great for geoip based for example.

But if you create some list in pfblocker, you would need to apply it to a rule to block. And if you do block, you have to keep in mind that if there is existing state, the block will not take effect until the existing state has expired, or you kill it, etc.

With some exact details of what you did, its impossible to say what step your missing or what you did wrong, etc.

deveals

@johnpoz
Hello and good day! Review and suggestions appreciated! I think I figured out how to create a custom IP list and now testing including force (kill) expired state :-). Whereas I still learning, what's the best way to see results of applied changes for Firewall/pfBlockerNG/IP/IP4/Info/Links/Custom Lists? Is there a way to generate periodic reports showing statistics for custom IPs? Thanks.

bgroper

@deveals
Danny
I'm also a newbie, and we're using pfBlockerNG with a custom list.
Our custom list is derived and compiled from a combination of sources, including AbuseIP.com, local fail2ban, and others.
The custom list contains about 100k addresses.
pfSense gets list updates a few times each day by a cron task.
The activity against this list is easily visible.
There's a pfBlockerNG widget for the pfSense GUI dashboard that gives summary data.
If you need more granular data using the GUI, go to Firewall, Rules, WAN, select and edit the custom rule, scroll to bottom of page and note the Tracking ID number.
Also make sure logging is enabled for this rule. Log = tick.
Then use Status, System logs, Firewall, Advanced Log filter (enabled in System, General Setup, Log Filtering), and enter the Tracking ID in the filtering criteria. Apply Filter.
Now you see all the traffic actioned by your custom rule.
If there's a better way to do this, I hope somebuddy with more experience will chime in with correction/s and/or suggestion/s.
HTH