Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 210 Posters 1.8m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      Bummer
      last edited by

      Is anyone familiar with Block List at https://www.blocklist.de/en/index.html ? They look very interesting.

      I run Fail2Ban on my servers. It's set with a hair trigger that after 2 failed login attempts via SSH, FTP, etc the IP is blocked for 2 hours. It then sends out an email for the IP and ownership to me. Block List gets their IPs from servers running Fail2Ban. Their lists are updated every 30 minutes and it's free. So if I get a hack attempt and I have Fail2Ban notifiy Block List, they will then update their lists in 30 minutes. Tf I have pfBlockerNG checking every hour, that IP is automatically blocked from my entire network.

      At least the above sounds it could be too good to be true. So has anyone had any experience with them? Are there any holes in my theory?

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        Yes I use that list also but I do not participate in the IP sharing part.

        I use Ossec (part of my Security Onion deployment) on my servers which is similar to what fail2ban is doing. If you can get fail2ban to output the IP to a local logfile, You can have pfBlockerNG pull that file on an hourly basis to block that IP for your whole network. I actually block the whole /24. My mail server can get a spam email or a brute force attack from several different IPs in the same /24 over a short period of time. I really hate spammers and pfBNG really has cut down on my Inbound Spam traffic. (like over 95% reduction)… ;D

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • D
          doktornotor Banned
          last edited by

          @Bummer:

          Is anyone familiar with Block List at https://www.blocklist.de/en/index.html ? They look very interesting.

          Yeah it works pretty well… Using it for mailservers.

          1 Reply Last reply Reply Quote 0
          • B
            Bummer
            last edited by

            Hey BBScan and doktornotor,

            Thanks for the input.

            I like that idea of subscribing to them because of the other IPs reported to them by Fail2Ban.

            Can you point me to instructions on how to prevent the duplication of IPs from several different lists? I've seen the de-duplication box to check, but surely it can't be that easy. There must be more to that.

            BTW, the new pfBlockerNG looks really great. It has a lot more bells and whistles I want to play with. It's just learning the terminology and playing with them. Much of this I've never messed wtih before.

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              @Bummer:

              Can you point me to instructions on how to prevent the duplication of IPs from several different lists? I've seen the de-duplication box to check, but surely it can't be that easy. There must be more to that.

              Yup.. One checkbox to enable de-duplication. Then hit "Force Reload"

              BTW, the new pfBlockerNG looks really great. It has a lot more bells and whistles I want to play with. It's just learning the terminology and playing with them. Much of this I've never messed wtih before.

              Thanks. It was a lot of work. I hope users try to use more of the advanced features (like Reputation) to help protect their networks…

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • B
                Bummer
                last edited by

                Hey BBScan177,

                Okay, now for stupid question #2…

                Yup.. One checkbox to enable de-duplication. Then hit "Force Reload"

                If I have the lists set to update hourly, daily, or whatever, the de-duplication remains? If that's the case, it's simple simon, too good to be true!

                Yes, I've seen the back and forth on reputation. I'm still not sure what it does, I can be a little slow on things like this. But once I get it down, them I'm on it!

                1 Reply Last reply Reply Quote 0
                • S
                  stuck
                  last edited by

                  @marcelloc:

                  Check if you still have aliases and rules from pfBlocker version.
                  If so, remove it.

                  Thanks marcelloc,
                  I did find a firewall rule that referenced a pfBlocker version and removed it.  I don't see any aliases that were used by the old pfBlocker.
                  This still caused the same error.

                  1 Reply Last reply Reply Quote 0
                  • BBcan177B
                    BBcan177 Moderator
                    last edited by

                    It's strange that there are no aliases. (url tables) listed? Are you sure you checked it properly?

                    Try to run this command from the shell :

                    pfctl -sa      (and at the end of the output, do you see any pfblocker tables?)

                    Also try to delete all files in

                    /var/db/aliastables  (then reboot)

                    "Experience is something you don't get until just after you need it."

                    Website: http://pfBlockerNG.com
                    Twitter: @BBcan177  #pfBlockerNG
                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                    1 Reply Last reply Reply Quote 0
                    • panzP
                      panz
                      last edited by

                      I just upgraded from pfSense 2.1.5 to 2.2 and pfblocker disappeared from Firewall menu; however, all my blocklists are still there, because pfblocker was setup to use aliases only.

                      Now:

                      1. how do I install pfblockerNG? Is pfblockerNG going to recover my config or will I have to enter the settings again? I'm asking just to be sure I'm not going to make a mess…

                      2. 18 block rules are present in my WAN interface Firewall setup (1 row for each IBlockList list I'm using) do I have to manually delete them before installing pfblockerNG?

                      pfSense 2.3.2-RELEASE-p1 (amd64)
                      motherboard: MSI C847MS-E33 Micro ATX (with Intel Celeron CPU 847 @ 1.10 GHz) ~ PSU: Corsair VS350 ~ RAM: Kingston KVR1333D3E9S 4096 MB 240-pin DIMM DDR3 SDRAM 1.5 volt ~ NIC: Intel EXPI9301CTBLK (LAN) ~ NIC: D-Link DFE-528TX (CAM) ~ Hard Disk: Western Digital WD10JFCX Red ~ Case: Cooler Master HAF XB ~ power consumption: 21 Watts.

                      1 Reply Last reply Reply Quote 0
                      • BBcan177B
                        BBcan177 Moderator
                        last edited by

                        You will need to re-configure, as it doesn't share the same settings.

                        I would recommend that you create aliases with more than one list. No real need to have a rule per list.

                        If you want to stay with "Alias" rules, you can modify the existing rules from pfblocker, and change the "alias table" setting and change the description to :

                        pfb_  then the name of the aliastable
                            (more details in the alias settings tab)

                        "Experience is something you don't get until just after you need it."

                        Website: http://pfBlockerNG.com
                        Twitter: @BBcan177  #pfBlockerNG
                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                        1 Reply Last reply Reply Quote 0
                        • panzP
                          panz
                          last edited by

                          I created an Alias for each list because, with one "big" list, pfblocker crashed with pfSense's message "PF was wedged/busy and has been reset".

                          So, I'm going to follow this procedure:

                          1. delete any previous firewall rule created by pfblocker;

                          2. delete any Alias also created by pfblocker;

                          3. enter the setting again in the new package pfblockerNG.

                          pfSense 2.3.2-RELEASE-p1 (amd64)
                          motherboard: MSI C847MS-E33 Micro ATX (with Intel Celeron CPU 847 @ 1.10 GHz) ~ PSU: Corsair VS350 ~ RAM: Kingston KVR1333D3E9S 4096 MB 240-pin DIMM DDR3 SDRAM 1.5 volt ~ NIC: Intel EXPI9301CTBLK (LAN) ~ NIC: D-Link DFE-528TX (CAM) ~ Hard Disk: Western Digital WD10JFCX Red ~ Case: Cooler Master HAF XB ~ power consumption: 21 Watts.

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            @panz:

                            I created an Alias for each list because, with one "big" list, pfblocker crashed with pfSense's message "PF was wedged/busy and has been reset".

                            Enable "De-duplication" in the General Tab. You will see the total size of the Block lists shrink substantially.

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • B
                              Bummer
                              last edited by

                              Hey guys,

                              I set up a few lists from BlockList.de and have it set to run via cron. I'm getting the errors below. What am I doing wrong?

                              CRON  PROCESS  START [ 02/21/15 13:00:00 ]
                                Updates Found
                                Updates Found
                              UPDATE PROCESS START

                              [ pfB_Africa_v4 ] exists, Reloading File

                              [ pfB_Africa_v6 ] exists, Reloading File

                              [ pfB_Top_v4 ] exists, Reloading File
                              [ pfB_Top_v6 ] exists, Reloading File

                              [ White Listed IPs_custom ] exists, Reloading File

                              [  http://lists.blocklist.de/lists/ssh.txt ]
                              ** TERMINATED - Header contains Blank/International/Special or Spaces

                              [ SSH-BlockList_custom ] Loading Custom File
                              –--------------------------------------------------------
                              Original  Masterfile Outfile    [ Post Duplication count ] 
                              –--------------------------------------------------------
                              952        952        952        [ Passed ]                 
                              –--------------------------------------------------------

                              [ http://lists.blocklist.de/lists/ssh.txt ]
                              ** TERMINATED - Header contains Blank/International/Special or Spaces
                              \ Email-BlockList_custom ] exists, Reloading File

                              ===[  Aliastables / Rules  ]================================

                              No Changes to Firewall Rules, Skipping Filter Reload
                              Updating: pfB_SSHBlockList
                              no changes.
                              UPDATE PROCESS ENDED

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                Make sure you set the "Header" in the IPv4 tab for each list. The log usually has all the details to diagnose issues.

                                ** TERMINATED - Header contains Blank/International/Special or Spaces

                                Also - try to use. "https" when possible.

                                EDIT:

                                You can't use "-" in the Header field…

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • B
                                  Bummer
                                  last edited by

                                  Okay, BBScan177,

                                  OKay, call me stupid. Okay, very stupid. How do I set the header for each list? When making the list is says to make a unique header. I saw the area and put the same thing in the "header" area as I did for the "List Description" and "List Name". So now that I know that's not correct, what do I do?

                                  Sorry, I feel stupid.

                                  Thanks!

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    I usually setup an Alias for "Malicious", "Ads", "IBlock", "Mail" etc (group common lists into one alias) and for each list enter a unique name for each list/header. If the List source has multiple lists, then use a prefix like so:

                                    blocklistde_ssh
                                        blocklistde_spam

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      Bummer
                                      last edited by

                                      I am missing something? Attached here is a partial screen cap of what I have set up.

                                      bbacan177.png
                                      bbacan177.png_thumb

                                      1 Reply Last reply Reply Quote 0
                                      • BBcan177B
                                        BBcan177 Moderator
                                        last edited by

                                        Unfortunately you can't use "-" in the header name. I also added that to a previous post above.

                                        "Experience is something you don't get until just after you need it."

                                        Website: http://pfBlockerNG.com
                                        Twitter: @BBcan177  #pfBlockerNG
                                        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          Bummer
                                          last edited by

                                          I"ve read so much on these posts my head spins! I try to go back and look at something that I wanted to research and can't find it.

                                          Thank you very much for letting me know. I appreciate it.

                                          Time to make the changes!

                                          1 Reply Last reply Reply Quote 0
                                          • B
                                            Bummer
                                            last edited by

                                            Well, most of it worked! But, there is an error below. It doesn't say much for the SSH block list.

                                            I'm sorry, I hope this isn't something stupid again. I'm very excited with the new pfBlockerNG and want to use it to it's fullest! See the attached screen cap.

                                            pfblockerNG.png
                                            pfblockerNG.png_thumb

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.