PfBlockerNG

Topper727 · Feb 10, 2015, 8:05 AM

Suggestion if not already done. Put the block to block both for each list.

And I get a lot of blocks from it. Go surf around some bad sites and watch the numbers grow.

![Snap 2015-02-10 at 03.03.26.jpg](/public/imported_attachments/1/Snap 2015-02-10 at 03.03.26.jpg)
![Snap 2015-02-10 at 03.03.26.jpg_thumb](/public/imported_attachments/1/Snap 2015-02-10 at 03.03.26.jpg_thumb)

Topper727 · Feb 10, 2015, 8:53 AM

Also a suggestion from BBcan I was told about this. Setup this page like I did and then force reload to get rid of bad nets not just 1 ip from it.

![screencapture-192-168-1-1-pkg_edit-php (3).png](/public/imported_attachments/1/screencapture-192-168-1-1-pkg_edit-php (3).png)
![screencapture-192-168-1-1-pkg_edit-php (3).png_thumb](/public/imported_attachments/1/screencapture-192-168-1-1-pkg_edit-php (3).png_thumb)

SixXxShooTeR · Feb 10, 2015, 9:03 AM

@Topper727:

try
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware ]
.

Just added this list, it's only showing a Count of 1 tho.

Topper727 · Feb 10, 2015, 9:06 AM

add them all in a group is what I did so I not see how many each have. But I have them all and I get pretty good amount of blocks from those lists.. I also have deduplication on so all my lists are stripped of duplicates making them smaller too

SixXxShooTeR · Feb 10, 2015, 9:13 AM

Okay, ill give it a try. Tho I have been able to find out what lists are blocking what, like malwarebytes or deviantart.com, by having them displayed individually and not in groups. Once you visit a site you can see which lists are denying or blocking packets.

I also have de-duplication enabled.

Question, I see that you've selected "Unknown" in the ET IQRISK BLOCK LISTS and ET IQRISK Match LISTS. What does that do?

Topper727 · Feb 10, 2015, 9:30 AM

I made mistake when first setting that up. That is a paid subscription so it does nothing for me. I do not pay for it.

Click the thanks at top right of my message if I helped you

ch1ll1man · Feb 10, 2015, 3:03 PM

We've started using PFBlockerNG on a couple of our firewalls and are using the country block to keep some countries out. However there are a few IP ranges we would like to let through within those blocked countries and these IP ranges change weekly so we're pulling a txt file into an IPV4 alias via PFBlocker daily updates.

Everything so far is working great but the permit rule created by PFBlockerNG is

IPv4 * pfB_Cloudflare * * * * none pfB_Cloudflare auto rule

What we'd like that rule to say is

IPv4 * pfB_Cloudflare * AN_IP 80 * none pfB_Cloudflare auto rule
IPv4 * pfB_Cloudflare * AN_IP 443 * none pfB_Cloudflare auto rule

AN_IP = an internal IP of a server we have

What's the best advice on this for achieving that? If I edit the rule PFBlockerNG just destroys it on the Update.

marcelloc · Feb 10, 2015, 3:20 PM

@wavetune:

What's the best advice on this for achieving that? If I edit the rule PFBlockerNG just destroys it on the Update.

Did you tried alias only and then create a manual rule?

Cino · Feb 10, 2015, 5:10 PM

@marcelloc:

@wavetune:

What's the best advice on this for achieving that? If I edit the rule PFBlockerNG just destroys it on the Update.

Did you tried alias only and then create a manual rule?

I think that would be the best way to approach this. pfBlockerNG is meant to block all ports, if you need specific ports opened; then alias with a manual rule

McFuzz · Feb 10, 2015, 5:59 PM

I left it running overnight - plenty of blocks now :D

SixXxShooTeR · Feb 10, 2015, 6:04 PM

@Topper727:

I made mistake when first setting that up. That is a paid subscription so it does nothing for me. I do not pay for it.

Click the thanks at top right of my message if I helped you

I've been trying to find out how much a subscription cost for the IQRisk Lists but their website doesn't offer a price. How many people have this subscription?

The iBlock list subscription is only 9.99 a year and that is what I'm using.

McFuzz · Feb 10, 2015, 6:20 PM

@Topper727:

Suggestion if not already done. Put the block to block both for each list.

And I get a lot of blocks from it. Go surf around some bad sites and watch the numbers grow.

When you say 'block both' - do you mean block inbound and outbound?

q54e3w · Feb 10, 2015, 6:29 PM

@SixXxShooTeR:

@Topper727:

I made mistake when first setting that up. That is a paid subscription so it does nothing for me. I do not pay for it.

Click the thanks at top right of my message if I helped you

I've been trying to find out how much a subscription cost for the IQRisk Lists but their website doesn't offer a price. How many people have this subscription?

The iBlock list subscription is only 9.99 a year and that is what I'm using.

If you have to ask…. ;) ...when I enquired last year it around $500 per year I recall. There isn't a 'consumer' level subscription like Snorts either as it was abused.

SixXxShooTeR · Feb 10, 2015, 6:49 PM

@irj972:

@SixXxShooTeR:

@Topper727:

I made mistake when first setting that up. That is a paid subscription so it does nothing for me. I do not pay for it.

Click the thanks at top right of my message if I helped you

I've been trying to find out how much a subscription cost for the IQRisk Lists but their website doesn't offer a price. How many people have this subscription?

The iBlock list subscription is only 9.99 a year and that is what I'm using.

If you have to ask…. ;) ...when I enquired last year it around $500 per year I recall. There isn't a 'consumer' level subscription like Snorts either as it was abused.

lol I was thinking it's never a good thing when prices aren't listed. Kind of like when you walk into an art gallery.

q54e3w · Feb 10, 2015, 7:06 PM

register here to see prices.
https://portal.emergingthreats.net/login#

I was hoping there may have been a deal cut with a pfsense gold subscription you know…..hint hint guys ;D

Topper727 · Feb 10, 2015, 7:53 PM

When you say 'block both' - do you mean block inbound and outbound?

Yes, inbound and outbound. Helps keep your browser from going to those IP's to begin with there for never waking the monsters in the cave.

BBcan177 · Feb 10, 2015, 9:13 PM

@doktornotor:

Whoever puts 0.0.0.0 in a blocklist should not maintain one in the first place… WTF! :o >:(

Yes exactly.. It should never be used. Some list also post 127.0.0.1… You have to remember that IBlock is used predominantly for their PeerBlock Software. This is why these lists are in range format. To use IBlock lists in pfSense, the ranges need to be converted to CIDR.

For IBlock the only Format setting that will convert those lists is "GZ" not "GZ_2"

I also see people using Lists from Sources (Like SigmaProjects and IBlock) that are a Copy of another List Provider. I recommend that people use the Original Provider so that they get accurate and the most up to date data.

So for example - Spamhaus is the Original provider :
http://www.spamhaus.org/drop/drop.txt

Lists that are using a copy of the Spamhaus Data :
https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=drop
http://list.iblocklist.com/?list=zbdlwrqkabxbcppvrnos&fileformat=p2p&archiveformat=gz

Same can be said for IBlock - DShield, Zeus, Palevo, CI Army, Bogon, Cruzit, Malcode.

sigmaprojects also have Country Lists which are probably not as accurate as MaxMind and should also not be required.

The IBlock Anti-Infringement list should also be used with care. This is not a typical blocklist. It should be used with the "Alias Native" Format. And only used to block certain ports (P2P - and not that I am recommending it either :) ) "Alias Native" will avoid these lists from being De-Duplicated and also avoid these lists from being processed by the "Reputation Settings" if used.

Block Lists need to be evaluated before arbitrarily enabling them.

The pfBNG Log Browser has tabs where you can see the original list and the Final list that is being used by pfBNG.

BBcan177 · Feb 10, 2015, 9:15 PM

@Topper727:

Suggestion if not already done. Put the block to block both for each list.

And I get a lot of blocks from it. Go surf around some bad sites and watch the numbers grow.

Hi Topper. You don't need to make an Alias with a Single list. You can stack lists in a Alias that are similar in function.

BBcan177 · Feb 10, 2015, 9:18 PM

@SixXxShooTeR:

@Topper727:

try
.

[ https://blocklist.sigmaprojects.org/api.cfc?method=getList&lists=spyware ]
.

Just added this list, it's only showing a Count of 1 tho.

Count of 1, probably means that the List is empty or is all duplicates. Look at the pfblockerng.log and it will show more details about each download. I put a placeholder address of "1.1.1.1" in all empty lists.

Also see my previous post about sigmaproject lists…

BBcan177 · Feb 10, 2015, 9:24 PM

@irj972:

@SixXxShooTeR:

@Topper727:

I made mistake when first setting that up. That is a paid subscription so it does nothing for me. I do not pay for it.

Click the thanks at top right of my message if I helped you

I've been trying to find out how much a subscription cost for the IQRisk Lists but their website doesn't offer a price. How many people have this subscription?

The iBlock list subscription is only 9.99 a year and that is what I'm using.

If you have to ask…. ;) ...when I enquired last year it around $500 per year I recall. There isn't a 'consumer' level subscription like Snorts either as it was abused.

The IDS list from Emerging Threats (for Snort/Suricata) is $425.00/yr.

The ET IQRisk IP Rep subscription is $1400/yr.. Expensive, but if you are protecting a lot of devices, I would recommend as they post IPs that are not in any other 'free' lists. ET IQRisk is one of the best Lists available… They also have a Domain Blocklist which will be great for pfBNG v2.0 DNSBL.

I think if ET dropped these prices, that they will see subscriptions increase...