PfBlockerNG
-
pfSense is a stateful firewall by design. By default all Inbound is set to Deny (implicit).
So the only reasons to have Deny Inbound or Deny Both, is if you have Open ports that you would like to protect.
That's absolutely clear, but what if we do have Open ports? Which settings will be recommended and considered sufficient in this case? For example, I have some TCP ports open (for ssh, OpenVPN) and UDP (for IPSec), even now when I have entire Asia blocked I see occasional connection attempts in both IPSec and OpenVPN logs.
-
That's absolutely clear, but what if we do have Open ports? Which settings will be recommended and considered sufficient in this case?
Do it the other way round! Whitelist, not blacklist! A single-country whitelist is a whole LOT smaller than the entire-world minus one country blacklist.
-
That's absolutely clear, but what if we do have Open ports? Which settings will be recommended and considered sufficient in this case? For example, I have some TCP ports open (for ssh, OpenVPN) and UDP (for IPSec), even now when I have entire Asia blocked I see occasional connection attempts in both IPSec and OpenVPN logs.
To continue with Doktornotor's post, you can make a new IPv4 "Alias" as "Alias Permit". In the URL field, enter the path to the Country Code files (Change the amd64 to i386, if required). You can add any number of Countries to a single Alias but they all have to be IPv4 or IPv6 depending on which Tab you created them in IPv4 or IPv6 Tabs. Set it to update once per week.
/usr/pbi/pfblockerng-amd64/share/GeoIP/US_v4.txt
Then create a Firewall Rule, select the Interfaces and the Ports etc for this particular rule. Make sure this rule is above the other Deny Rules.
You would need to create an IPv6 also, if you require that. This way you are reducing the size of the Aliastables. You still can be hammered by any USA IPs thou! So its just stopping all of the other countries from hitting those open ports. When creating the Manual Rule, follow the instructions in the Alias Tab for the proper "Description" Settings. Use the prefix pfb_ (Lowercase) and the name of the Alias. This way it will show in the widget packet counts. Using pfB_ in the Manual Alias will cause these Rules to disappear at the next Cron event..
For the question about seeing traffic on the IPSec and OpenVPN interfaces, did you enable rules for these Interfaces?
-
Thanks a lot for the suggestions, I'm already trying to build a simpler config. Will stay with a short country list and Permit Inbound rule.
P.S. It seems I managed to find a glitch - some rules got multiplied, see screenshot.
-
For the question about seeing traffic on the IPSec and OpenVPN interfaces, did you enable rules for these Interfaces?
I've noticed some connection attempts (through WAN), from the countries which were not included into my country blocking, i.e. USA. So it's not about functionality of the Package, it's more about proper protection design. Thanks a lot!
-
I am in the same boat as AndrewZ, in that I really don't want the whole world pounding on my IPSec and OpenVPN connections. The IPSec point to point tunnels are already protected to a degree by an alias specifying allowed hosts, but the road warrior VPN needs to be a bit more open. I also have a vanity web server in the mix serving pictures for friends and family. The web server runs on a small VM protected by an even smaller VM that pre-filters requests via ModSecurity.
While I understand that the lists are huge and setting up the rules is computationally intensive, what bewilders me is that the process shows absolutely no load in top.
Thank you for the pointers. I will try to implement a more sensible scheme, but I will miss my dashboard full of countries and blocked packets.
-
what bewilders me is that the process shows absolutely no load in top.
After reading some pfsense base code today, I see that compared to 2.1.x, 2.2 has a 60 second delay while trying to find a non-existent file in /var/db/aliastables. So this 60 second delay will occur for each and every Alias. So if you have 10 aliases, it will timeout for 10 mins. Obviously there is no load as its not doing anything ;D So this only affects Nano and Ramdisk installations as they have the /var/db folders wiped at reboot.
Its simple to change the timeout to say 5 secs, but the issue still remains that on Reboot, Nano and Ramdisk installs have no aliastables. The only way to get them back is to do a "Force Update" or wait for Cron to execute.
So while you guys have been drinking Beer and relaxing….
I wrote some code that Compresses the contents of /var/db/aliastables at reboot, and can restore this file on Bootup... Just need some testers ;D and the Devs to approve it of course.
-
what bewilders me is that the process shows absolutely no load in top.
So while you guys have been drinking Beer and relaxing….
I wrote some code that Compresses the contents of /var/db/aliastables at reboot, and can restore this file on Bootup... Just need some testers ;D and the Devs to approve it of course.
Thank you! I had a feeling there was a whole lot of nothing going on. I would be happy to test code related to this.
-
BB do you recommend enabling Floating Rules or have the auto-rules generated in the WAN/LAN interfaces? I dont currently have Floating Rules enabled. I also don't have an interface selected for Inbound Interfaces since I'll only be rejecting on my Outbound Interface.
-
There is a thread all about this topic of floating vs Std Interfaces. Its not difficult to flip back and forth. With Floating they will match quicker.
https://forum.pfsense.org/index.php?topic=78062.0
-
what bewilders me is that the process shows absolutely no load in top.
So while you guys have been drinking Beer and relaxing….
I wrote some code that Compresses the contents of /var/db/aliastables at reboot, and can restore this file on Bootup... Just need some testers ;D and the Devs to approve it of course.
Thank you! I had a feeling there was a whole lot of nothing going on. I would be happy to test code related to this.
I am also happy to test. I have 32 and 64 bit nanoBSD systems that I can test with. PM me about any code…
-
I wrote some code that Compresses the contents of /var/db/aliastables at reboot, and can restore this file on Bootup… Just need some testers ;D and the Devs to approve it of course.
It that available in your unofficial repo ATM?
-
'Header' : The 'Header' Field must be Unique, it will name the List File and it will be referenced in the pfBlockerNG Widget. Use a Unique Prefix per 'Alias Category' followed by a unique descriptor for each List.
What is an 'Alias Category'? Is it just an alias where the corresponding lists are used?
For example, I have 2 aliases, one for VPN and another for SSH, they are not identical. Both aliases have some country lists in common (ex.: /usr/pbi/pfblockerng-i386/share/GeoIP/GB_v4.txt). Can I use the header like Country_UK in both aliases? -
Can I use the header like Country_UK in both aliases?
Yes. Thats the purpose of a pfSense Alias. So it can be used easily in the Firewall Rules.
I would suggest naming it "CC_GB4" and "CC_GB6" For example.
-
BBcan177, thanks a lot!
Already cleaning up my configs. -
You can add any number of Countries to a single Alias but they all have to be IPv4 or IPv6 depending on which Tab you created them in IPv4 or IPv6 Tabs. Set it to update once per week.
/usr/pbi/pfblockerng-amd64/share/GeoIP/US_v4.txt
Just a note - this apparently fails for IPv6 (Download FAIL/Local File Failure)
-
Yes I have a fix for IPv6 Regex. Should have it posted today or tomorrow…
PM me if you need to get it sooner.
-
-
PM me if you need to get it sooner.
Noooo, definitely not urgent. Was just testing. :)
Was kinda leading you to test it ;D I did say I really Hate Regex! Right!
You could edit pfblockerng.inc and replace the following (Starting at Line 1166)
$pattern1 = '([A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}'; $pattern2 = '[A-Fa-f0-9]{1,4}::([A-Fa-f0-9]{1,4}:){0,5}[A-Fa-f0-9]{1,4}'; $pattern3 = '([A-Fa-f0-9]{1,4}:){2}:([A-Fa-f0-9]{1,4}:){0,4}[A-Fa-f0-9]{1,4}'; $pattern4 = '([A-Fa-f0-9]{1,4}:){3}:([A-Fa-f0-9]{1,4}:){0,3}[A-Fa-f0-9]{1,4}'; $pattern5 = '([A-Fa-f0-9]{1,4}:){4}:([A-Fa-f0-9]{1,4}:){0,2}[A-Fa-f0-9]{1,4}'; $pattern6 = '([A-Fa-f0-9]{1,4}:){5}:([A-Fa-f0-9]{1,4}:){0,1}[A-Fa-f0-9]{1,4}'; $pattern7 = '([A-Fa-f0-9]{1,4}:){6}:[A-Fa-f0-9]{1,4}'; $pattern8 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern9 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}:[A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern10 = '[A-Fa-f0-9]{1,4}::\/[0-9]{2}'; $pfb['ipv6'] = "/^($pattern1)$|^($pattern2)$|^($pattern3)$|^($pattern4)$|^($pattern5)$|^($pattern6)$|^($pattern7)$|^($pattern8)$|^($pattern9)$|^($pattern10)$/"; -
edit pfblockerng.inc and replace the following (Starting at Line 1166)
$pattern1 = '([A-Fa-f0-9]{1,4}:){7}[A-Fa-f0-9]{1,4}'; $pattern2 = '[A-Fa-f0-9]{1,4}::([A-Fa-f0-9]{1,4}:){0,5}[A-Fa-f0-9]{1,4}'; $pattern3 = '([A-Fa-f0-9]{1,4}:){2}:([A-Fa-f0-9]{1,4}:){0,4}[A-Fa-f0-9]{1,4}'; $pattern4 = '([A-Fa-f0-9]{1,4}:){3}:([A-Fa-f0-9]{1,4}:){0,3}[A-Fa-f0-9]{1,4}'; $pattern5 = '([A-Fa-f0-9]{1,4}:){4}:([A-Fa-f0-9]{1,4}:){0,2}[A-Fa-f0-9]{1,4}'; $pattern6 = '([A-Fa-f0-9]{1,4}:){5}:([A-Fa-f0-9]{1,4}:){0,1}[A-Fa-f0-9]{1,4}'; $pattern7 = '([A-Fa-f0-9]{1,4}:){6}:[A-Fa-f0-9]{1,4}'; $pattern8 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern9 = '[A-Fa-f0-9]{1,4}:([A-Fa-f0-9]{1,4}:[A-Fa-f0-9]{1,4}::)\/[0-9]{2}'; $pattern10 = '[A-Fa-f0-9]{1,4}::\/[0-9]{2}'; $pfb['ipv6'] = "/^($pattern1)$|^($pattern2)$|^($pattern3)$|^($pattern4)$|^($pattern5)$|^($pattern6)$|^($pattern7)$|^($pattern8)$|^($pattern9)$|^($pattern10)$/";That works. 8)
