Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 211 Posters 1.9m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      doktornotor Banned
      last edited by

      @nckwebtech:

      Any suggestions on what I need to do to get the rules created?

      Changes are Applied via CRON or 'Force Update'. In red, and in bold letters at the bottom.

      1 Reply Last reply Reply Quote 0
      • R
        reggie14
        last edited by

        I don't have a terribly compelling use for pfblockerng right now, but I was playing around with it just to see if I could get it to block ads with reasonable effectiveness.  I added some lists from iblocklist (the ads list there, plus the YoYo list) and configured them to reject on outbound LAN.  When I had logging on, I saw lots of hits (so many I turned off logging), but no noticeable decrease in ads.  Is this to be expected?

        I'm guessing that DNSBL+Adblock-easylist functionality in pfblockerng-v2 will improve things, I'm just curious how this lines up with other users' experiences.

        1 Reply Last reply Reply Quote 0
        • S
          Supermule Banned
          last edited by

          Install adblock in firefox and "borrow" the list from there…it works.

          1 Reply Last reply Reply Quote 0
          • marcellocM
            marcelloc
            last edited by

            @Supermule:

            Install adblock in firefox and steal the list from there…it works.

            borrow :)

            Treinamentos de Elite: http://sys-squad.com

            Help a community developer! ;D

            1 Reply Last reply Reply Quote 0
            • S
              Supermule Banned
              last edited by

              Corrected :D

              @marcelloc:

              @Supermule:

              Install adblock in firefox and steal the list from there…it works.

              borrow :)

              1 Reply Last reply Reply Quote 0
              • R
                reggie14
                last edited by

                Sorry for my ignorance, but that works?  Maybe I'm missing something.  Are you saying that I can use the easyList with pfblockerNG already?

                I thought we needed to use IP lists.  The easyList rules appear to be URL filters- and not even full URLs.

                Is there some other list I'm not aware of?

                1 Reply Last reply Reply Quote 0
                • N
                  nckwebtech
                  last edited by

                  @doktornotor:

                  @nckwebtech:

                  Any suggestions on what I need to do to get the rules created?

                  Changes are Applied via CRON or 'Force Update'. In red, and in bold letters at the bottom.

                  I have already tried the force update.  When I run it I get this

                  UPDATE PROCESS START [ 02/05/15 13:15:17 ]

                  [ pfB_Top_v4 ] exists, Reloading File [ 02/05/15 13:15:18 ]

                  ===[  Aliastables / Rules  ]================================

                  No Changes to Firewall Rules, Skipping Filter Reload

                  Updating: pfB_Top_v4
                  no changes.

                  UPDATE PROCESS ENDED [ 02/05/15 13:15:22 ]

                  After running this I have no blocking rules

                  Any suggestions

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    @jonna99:

                    Here is the logfile you asked for.

                    Hi Jonna, The log file shows that its failing to download the Maxmind files. Can you run the following command from the shell and try to see what is stopping it from completing?

                    Suggestions:

                    Try to goto the MaxMind Website and see if you can get there first? If you are having issues getting to that site, you need to fix that first.

                    The following command can be executed from the Shell to manually download the MaxMind Database and Update the pfBNG XML files.

                    php /usr/local/www/pfblockerng/pfblockerng.php dc
                    

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @nckwebtech:

                      I have already tried the force update.  When I run it I get this

                      Hi nckwebtech, Did you select the Interfaces in the General Tab? IN/Outbound? Also please ensure that you selected the "Action Setting" in the Alias settings.

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        I would recommend for users to please read the text beside each setting in pfBlockerNG. There is a lot of good detail there to follow. Also Hover over in the Alerts Tab will show more comments as well.

                        pfSense is a stateful firewall by design. By default all Inbound is set to Deny (implicit).

                        So the only reasons to have Deny Inbound or Deny Both, is if you have Open ports that you would like to protect. Most often a "Deny Outbound" is sufficient. If you wish to log activity that is hitting your firewall then you can set "Deny Both". This is a generalization. You need to think about your needs in your network first.

                        Suppression does not work on Country Blocking. It can only be used for IPv4 Lists and only on /32 or /24 IPs.

                        If you want to circumvent a Country Block, Create a pfBNG Alias ie "Whitelist" and set the Action to "Permit Outbound". You most likely do not want to set it as "Permit Both" or Permit Inbound" as that allows those IPs to get past all other rules in the Firewall. Then add the IPs that you want to allow Outbound access to in the Custom Box entry for the Whitelist Alias. You can also Whitelist a list of IPs with the URL settings. Then make sure to select the Rule Order setting to allow the Permit rule to be above the Block rules.

                        If users want to block the world, (Not recommending it but if you did want this option) pfSense is already set as Deny Inbound. So instead of adding all IPs to a Block list, you would do the inverse and just make a list of Countries to Allow and have that rule above a Deny all rule.

                        IPv6 needs some more work on the Regex. (Did I say I Really hate Regex… any help appreciated to make that part better !! )

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 1
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          @reggie14:

                          I don't have a terribly compelling use for pfblockerng right now, but I was playing around with it just to see if I could get it to block ads with reasonable effectiveness.  I added some lists from iblocklist (the ads list there, plus the YoYo list) and configured them to reject on outbound LAN.  When I had logging on, I saw lots of hits (so many I turned off logging), but no noticeable decrease in ads.  Is this to be expected?

                          I'm guessing that DNSBL+Adblock-easylist functionality in pfblockerng-v2 will improve things, I'm just curious how this lines up with other users' experiences.

                          Hi reggie14,

                          pfBNG is an IP based solution. Some lists for Domain blocking (DNSBL) have some IPs listed. So if you did use one of those Domain Lists, it would pull those IPs. IBlock Ads is not that great. So if you are looking for Ads blocking, you will need to wait for v2 of pfBNG. However, you should consider using pfBlockerNG as a tool to help block Outbound traffic to known malicious IPs.. There are lots of lists around.

                          Here are a few lists to use:

                          https://rules.emergingthreats.net/blockrules/compromised-ips.txt    ET_Comp              txt
                          https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt      ET_Block              txt
                          http://www.spamhaus.org/drop/drop.txt                                        Spamhaus_Drop    txt
                          http://www.spamhaus.org/drop/edrop.txt                                      Spamhaus_eDrop  txt
                          https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv            Abuse_SSLBL        html
                          https://reputation.alienvault.com/reputation.snort.gz                      Alienvault            gz_2
                          https://danger.rulez.sk/projects/bruteforceblocker/blist.php              DangerRulez        txt
                          http://www.us.openbl.org/lists/base_90days.txt                              OpenBL                txt
                          https://malc0de.com/bl/IP_Blacklist.txt                                          Malcode                txt

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • N
                            nckwebtech
                            last edited by

                            @BBcan177:

                            @nckwebtech:

                            I have already tried the force update.  When I run it I get this

                            Hi nckwebtech, Did you select the Interfaces in the General Tab? IN/Outbound? Also please ensure that you selected the "Action Setting" in the Alias settings.

                            BBCan177 That was the problem the In and Outbound were not selected.  When I looked at the setting I did not realize I had to select one.
                            They should be selected by default but they are not.

                            Thanks for the help

                            1 Reply Last reply Reply Quote 0
                            • S
                              Supermule Banned
                              last edited by

                              ~~I cant for the world get the P.S alias going….

                              Havent got a clue why. GRRRRRRRRRRRRRRRRRRR!!~~

                              FFS….. I am stupid as a bat.... :D

                              Wont tell you why...

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                @nckwebtech:

                                BBCan177 That was the problem the In and Outbound were not selected.  When I looked at the setting I did not realize I had to select one.
                                They should be selected by default but they are not.

                                Glad that its working for you now.. There is nothing there to indicate that its set to Default  :)

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @Supermule:

                                  ~~I cant for the world get the P.S alias going….

                                  Havent got a clue why. GRRRRRRRRRRRRRRRRRRR!!~~

                                  FFS….. I am stupid as a bat.... :D

                                  Wont tell you why...

                                  LOL.. "common sense is not so common!!"

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    doktornotor Banned
                                    last edited by

                                    @Supermule:

                                    FFS….. I am stupid as a bat.... :D
                                    Wont tell you why...

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Supermule Banned
                                      last edited by

                                      HAHAHAHAHAHAHHAHA :D

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Mr. Jingles
                                        last edited by

                                        Given the increase in traffic in this thread I thought it was released, but according to the package manager in the GUI it is not there yet; lots of hackers here then  ;D

                                        6 and a half billion people know that they are stupid, agressive, lower life forms.

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          phil.davis
                                          last edited by

                                          @Mr.:

                                          Given the increase in traffic in this thread I thought it was released, but according to the package manager in the GUI it is not there yet; lots of hackers here then  ;D

                                          It is released and available on pfSense 2.2 only.

                                          As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                          If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            McFuzz
                                            last edited by

                                            Apologies ahead of time if this was already mentioned in the thread - it's late, and I just spent a couple of hours restoring from a botched 2.1.5->2.2 upgrade :(

                                            Anyway - I just did a clean install of 2.2 and used a backed up config.xml to restore all my settings. In 2.1.5, I had pfBlocker installed with a few lists and once 2.2 was installed, I noticed that pfBlocker was no-mo and instead, pfBlockerNG was available.

                                            Unfortunately, most of the pfBlocker XML data was loaded but since there was no package available, it was all broken; pfBlockerNG thought pfBlocker was installed but after I manually cleaned up config.xml of any mention of the old package, it seems pfBlockerNG started working.

                                            I did not wipe any rules/lists in config.xml as far as I can tell… I was hoping that the new pfBlockerNG package would automagically import everything... alas, that is not the case.

                                            So my question is, any idea how to get pfBlockerNG to 'pick up' the old settings and just automagically work? There's a whole lot more options in the new package than there were before...

                                            Thanks :)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.