PfBlockerNG
-
I would recommend for users to please read the text beside each setting in pfBlockerNG. There is a lot of good detail there to follow. Also Hover over in the Alerts Tab will show more comments as well.
pfSense is a stateful firewall by design. By default all Inbound is set to Deny (implicit).
So the only reasons to have Deny Inbound or Deny Both, is if you have Open ports that you would like to protect. Most often a "Deny Outbound" is sufficient. If you wish to log activity that is hitting your firewall then you can set "Deny Both". This is a generalization. You need to think about your needs in your network first.
Suppression does not work on Country Blocking. It can only be used for IPv4 Lists and only on /32 or /24 IPs.
If you want to circumvent a Country Block, Create a pfBNG Alias ie "Whitelist" and set the Action to "Permit Outbound". You most likely do not want to set it as "Permit Both" or Permit Inbound" as that allows those IPs to get past all other rules in the Firewall. Then add the IPs that you want to allow Outbound access to in the Custom Box entry for the Whitelist Alias. You can also Whitelist a list of IPs with the URL settings. Then make sure to select the Rule Order setting to allow the Permit rule to be above the Block rules.
If users want to block the world, (Not recommending it but if you did want this option) pfSense is already set as Deny Inbound. So instead of adding all IPs to a Block list, you would do the inverse and just make a list of Countries to Allow and have that rule above a Deny all rule.
IPv6 needs some more work on the Regex. (Did I say I Really hate Regex… any help appreciated to make that part better !! )
-
I don't have a terribly compelling use for pfblockerng right now, but I was playing around with it just to see if I could get it to block ads with reasonable effectiveness. I added some lists from iblocklist (the ads list there, plus the YoYo list) and configured them to reject on outbound LAN. When I had logging on, I saw lots of hits (so many I turned off logging), but no noticeable decrease in ads. Is this to be expected?
I'm guessing that DNSBL+Adblock-easylist functionality in pfblockerng-v2 will improve things, I'm just curious how this lines up with other users' experiences.
Hi reggie14,
pfBNG is an IP based solution. Some lists for Domain blocking (DNSBL) have some IPs listed. So if you did use one of those Domain Lists, it would pull those IPs. IBlock Ads is not that great. So if you are looking for Ads blocking, you will need to wait for v2 of pfBNG. However, you should consider using pfBlockerNG as a tool to help block Outbound traffic to known malicious IPs.. There are lots of lists around.
Here are a few lists to use:
https://rules.emergingthreats.net/blockrules/compromised-ips.txt ET_Comp txt
https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt ET_Block txt
http://www.spamhaus.org/drop/drop.txt Spamhaus_Drop txt
http://www.spamhaus.org/drop/edrop.txt Spamhaus_eDrop txt
https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.csv Abuse_SSLBL html
https://reputation.alienvault.com/reputation.snort.gz Alienvault gz_2
https://danger.rulez.sk/projects/bruteforceblocker/blist.php DangerRulez txt
http://www.us.openbl.org/lists/base_90days.txt OpenBL txt
https://malc0de.com/bl/IP_Blacklist.txt Malcode txt -
I have already tried the force update. When I run it I get this
Hi nckwebtech, Did you select the Interfaces in the General Tab? IN/Outbound? Also please ensure that you selected the "Action Setting" in the Alias settings.
BBCan177 That was the problem the In and Outbound were not selected. When I looked at the setting I did not realize I had to select one.
They should be selected by default but they are not.Thanks for the help
-
~~I cant for the world get the P.S alias going….
Havent got a clue why. GRRRRRRRRRRRRRRRRRRR!!~~
FFS….. I am stupid as a bat.... :D
Wont tell you why...
-
BBCan177 That was the problem the In and Outbound were not selected. When I looked at the setting I did not realize I had to select one.
They should be selected by default but they are not.Glad that its working for you now.. There is nothing there to indicate that its set to Default :)
-
~~I cant for the world get the P.S alias going….
Havent got a clue why. GRRRRRRRRRRRRRRRRRRR!!~~
FFS….. I am stupid as a bat.... :D
Wont tell you why...
LOL.. "common sense is not so common!!"
-
-
HAHAHAHAHAHAHHAHA :D
-
Given the increase in traffic in this thread I thought it was released, but according to the package manager in the GUI it is not there yet; lots of hackers here then ;D
-
@Mr.:
Given the increase in traffic in this thread I thought it was released, but according to the package manager in the GUI it is not there yet; lots of hackers here then ;D
It is released and available on pfSense 2.2 only.
-
Apologies ahead of time if this was already mentioned in the thread - it's late, and I just spent a couple of hours restoring from a botched 2.1.5->2.2 upgrade :(
Anyway - I just did a clean install of 2.2 and used a backed up config.xml to restore all my settings. In 2.1.5, I had pfBlocker installed with a few lists and once 2.2 was installed, I noticed that pfBlocker was no-mo and instead, pfBlockerNG was available.
Unfortunately, most of the pfBlocker XML data was loaded but since there was no package available, it was all broken; pfBlockerNG thought pfBlocker was installed but after I manually cleaned up config.xml of any mention of the old package, it seems pfBlockerNG started working.
I did not wipe any rules/lists in config.xml as far as I can tell… I was hoping that the new pfBlockerNG package would automagically import everything... alas, that is not the case.
So my question is, any idea how to get pfBlockerNG to 'pick up' the old settings and just automagically work? There's a whole lot more options in the new package than there were before...
Thanks :)
-
There is no way to import configuration from the old pfBlocker. And frankly don't think it's ever gonna happen.
-
@Mr.:
Given the increase in traffic in this thread I thought it was released, but according to the package manager in the GUI it is not there yet; lots of hackers here then ;D
It is released and available on pfSense 2.2 only.
WUT??
Not on 2.1.5?(??)
-
No, really, it's for 2.2 only?
I'm on 2.1.5, and plan to stay there for quite some time. I was looking forward to this package tremendelously, even back last year when BB tried to help me become a beta tester for it.
I'm a little bit like the attached pic now :'(
-
Good Evening,
I am attempting to use the IP Lists from https://blocklist.sigmaprojects.org/, but each time it goes to update, I am receiving an error:
[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=anti-infringement ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=webexploit ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=dshield ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=drop ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=zeus ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=china ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=forumspam ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=pedophiles ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=northkorea ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=russia ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=atma ]
** TERMINATED - Header contains Blank/International/Special or Spaces[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spammers ]
** TERMINATED - Header contains Blank/International/Special or SpacesAny thoughts or guidance that might have to help resolve this issue would be greatly appreciated.
Best-
-
** TERMINATED - Header contains Blank/International/Special or Spaces
In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.
-
** TERMINATED - Header contains Blank/International/Special or Spaces
In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.
Thank you for the help. I have updated the Alias with these instructions but still receive the same error. The Header field is blank for each of the lists. Does something needed to be added to the Header field to make it work?
Best-
-
** TERMINATED - Header contains Blank/International/Special or Spaces
In the IPv4 Tab, when you create the Alias, ensure that there are no Spaces, International or Special Characters in the Header Name field.
Thank you for the help. I have updated the Alias with these instructions but still receive the same error. The Header field is blank for each of the lists. Does something needed to be added to the Header field to make it work?
Best-
** TERMINATED - Header contains Blank/International/Special or Spaces
Enter a name for the header like: sigma-anti-infringement, sigma-webexploit, sigma-dshield
'Header' : The 'Header' Field must be Unique, it will name the List File and it will be referenced in the pfBlockerNG Widget. Use a Unique Prefix per 'Alias Category' followed by a unique descriptor for each List. -
Ok just to let everyone know that I tried his lists and found that same error. There is something wrong with fetching of list. I can download gz lists if I use browser to get it. It looks legit inside
Example from file
1.0.128.0/17
1.0.192.0/18
1.1.128.0/17
1.2.128.0/17
1.9.0.0/16
1.20.128.0/17
1.27.1.231/32
1.27.100.88/32
1.34.0.0/16
1.36.71.108/32
1.36.79.146/32
1.48.0.0/16
1.50.0.0/16
1.54.224.0/20
1.56.44.42/32
1.56.122.145/32
1.56.145.114/32I do not get his Header problem he sees but I get
[ Sigantiinfringement ] Downloading New File
[ pfB_sigmaprojects Sigantiinfringement ] Download FAIL [ 02/06/15 22:00:47 ]
[ Sigwebexploit ] Downloading New File
[ pfB_sigmaprojects Sigwebexploit ] Download FAIL [ 02/06/15 22:00:48 ]
[ Sigdshield ] Downloading New File
[ pfB_sigmaprojects Sigdshield ] Download FAIL [ 02/06/15 22:00:49 ]
I took the link and had Free Download manager try to get it and that worked. FDM got the file no problem.
.png)
.png_thumb)
 -
If the lists are gz format and in CIDR format, you need to select "gz_2".
However, these are not the best lists to use. It's best to use lists from the original provider.
