Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 211 Posters 2.0m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pf3000
      last edited by

      @BBcan177:

      You can use a service like Hurricane Electric to collect IPs for Domain names that are changing more frequently and collect the list with the "html" format.

      http://bgp.he.net/search?search%5Bsearch%5D=twitter&commit=Search
          http://bgp.he.net/search?search%5Bsearch%5D=facebook&commit=Search
          http://bgp.he.net/search?search%5Bsearch%5D=spotify&commit=Search
          http://bgp.he.net/search?search%5Bsearch%5D=dropbox&commit=Search

      Fantastic… these hidden features/hacks that should be in a pfBNG FAQ or OP or something.

      1 Reply Last reply Reply Quote 0
      • A
        azurata
        last edited by

        I was waiting the pfBlockerNG new version to do adblock using the unbound, but until it's released I add a VIRTUAL IP to the Lan interface, made a script to convert http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext to unbound advanced rules to redirect to the VIRTUAL IP and setup a nginx to listen to both 80 and 443 on the VIRTUAL IP and respond to all with "204 No Content". For my surprise is working better that I was expecting.

        1 Reply Last reply Reply Quote 0
        • M
          marcus556
          last edited by

          Is there anyway to EXclude an ip from the pfblocker?  I have a PS4 and when I have the top 20 countries selected it affects game play online and when i disable it doesn't block some of the ads. So is there anyway to exclude an IP address?

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @marcus556:

            Is there anyway to EXclude an ip from the pfblocker?  I have a PS4 and when I have the top 20 countries selected it affects game play online and when i disable it doesn't block some of the ads. So is there anyway to exclude an IP address?

            There is a post about this five posts before this one!  And also in several places in this thread… Either Suppress the IP (/32 or /24 Ranges only) or Create a Permit Outbound Alias with the IP listed in the Custom Input Entry. Ensure the Permit Rule is before the Block/Reject Rules.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • M
              marcus556
              last edited by

              @BBcan177:

              @marcus556:

              Is there anyway to EXclude an ip from the pfblocker?  I have a PS4 and when I have the top 20 countries selected it affects game play online and when i disable it doesn't block some of the ads. So is there anyway to exclude an IP address?

              There is a post about this five posts before this one!  And also in several places in this thread… Either Suppress the IP (/32 or /24 Ranges only) or Create a Permit Outbound Alias with the IP listed in the Custom Input Entry. Ensure the Permit Rule is before the Block/Reject Rules.

              Woah… sorry to push a button there. I actually tried setting it up with the permit rules before the block/reject but then it wouldnt block anything.  Just thought there might be an easier solution.... Ill try the suppressing... thanks!

              1 Reply Last reply Reply Quote 0
              • BBcan177B
                BBcan177 Moderator
                last edited by

                If it's a Top20 Block, then you have to use the "Permit Outbound" method, as suppression will only work on /32 or /24 ranges. In the alias enter just the IP range required and set it to "permit outbound". It shouldn't interfere with other block/reject rules.

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • N
                  ntct
                  last edited by

                  Hello BBcan177,

                  If pfblockerng integrate with mailreport in the future? For example, I add "botnet" alias and set action to deny outbound. When infiltrated computers traffic is outbound, and send mail trigger by mailreport(Report Logs).

                  But I can only use firewall log (raw) filter in report Logs,so i can't filter by botnet alias

                  Or I can use other methods?

                  Thanks!

                  1 Reply Last reply Reply Quote 0
                  • K
                    killmasta93
                    last edited by

                    Does pfBlockerNG support 2.1.5? or should i just stick to pfBlocker?

                    Thanks

                    Tutorials:

                    https://www.mediafire.com/folder/v329emaz1e9ih/Tutorials

                    1 Reply Last reply Reply Quote 0
                    • S
                      Supermule Banned
                      last edited by

                      It does not unless you use an unofficiel package repository :)

                      1 Reply Last reply Reply Quote 0
                      • B
                        bodam
                        last edited by

                        NEVERMIND:  I was able to get this resolved from help on IRC.  It looks like, despite running the php cleanup script, I had some original pfBlocker aliases still around.  Deleting them fixed the problem.

                        I'm a bit new to pfsense and not a network guy.  I implemented PFBlockerNG and, overall it seems to be working well.  The problem is that I am getting the errors shown in the attachment.  I used the php script earlier to set the lists up.  Not sure how to resolve these.  Any suggestions would be appreciated.

                        Selection_331.png
                        Selection_331.png_thumb

                        1 Reply Last reply Reply Quote 0
                        • N
                          n3by
                          last edited by

                          @Supermule:

                          It does not unless you use an unofficiel package repository :)

                          Hi,

                          can you please give us more details how to install PFBlockerNG in 2.1.5

                          thank you

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by

                            Well, you don't. Simple.

                            1 Reply Last reply Reply Quote 0
                            • W
                              wcrowder
                              last edited by

                              Update to 2.2+ and it will work fine. If you haven't you need to. Keeping your software up to date is part of security. Skip 5 or 6 versions and the updates become more difficult.

                              1 Reply Last reply Reply Quote 0
                              • BBcan177B
                                BBcan177 Moderator
                                last edited by

                                pfBlockerNG had support for 2.1.x. but the current version only supports 2.2 and above. Sorry about that.

                                "Experience is something you don't get until just after you need it."

                                Website: http://pfBlockerNG.com
                                Twitter: @BBcan177  #pfBlockerNG
                                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                1 Reply Last reply Reply Quote 0
                                • BBcan177B
                                  BBcan177 Moderator
                                  last edited by

                                  @ntct:

                                  Hello BBcan177,

                                  If pfblockerng integrate with mailreport in the future? For example, I add "botnet" alias and set action to deny outbound. When infiltrated computers traffic is outbound, and send mail trigger by mailreport(Report Logs).

                                  But I can only use firewall log (raw) filter in report Logs,so i can't filter by botnet alias

                                  Or I can use other methods?

                                  Thanks!

                                  Hi ntct,

                                  You can try the following :

                                  View the Firewall or pfBNG Alerts log and find the Rule Number associated with the Alias. If you don't see the rule number in the Firewall logs, you can edit the log settings to display the Rule column.

                                  In mail reports, when you select "Filter Logs (Raw), enter the "filter" as - Example rule number 90 :

                                  90,

                                  This will search the log for those characters. Please note that any Firewall rule changes can alter the Rule Number.

                                  Hope this helps.

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    stanthewizard
                                    last edited by

                                    Hello

                                    Issue
                                    Fatal error: Call to undefined function subnetv6_expand() in /etc/inc/util.inc on line 714

                                    Fix in this thread works

                                    1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator
                                      last edited by

                                      Hi stanthewizard,

                                      Are you using the latest version of pfBNG? If not, please upgrade as that issue has been fixed.

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        stanthewizard
                                        last edited by

                                        This is the latest updated this morning

                                        1 Reply Last reply Reply Quote 0
                                        • BBcan177B
                                          BBcan177 Moderator
                                          last edited by

                                          Do you have any Virtual IPs? And are you using IPv6?

                                          Could you post a screenshot of the VIP addresses and masks?

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            stanthewizard
                                            last edited by

                                            192.168.0.1/24 (vhid 1) LAN  carp LANVirIPv4 
                                            192.168.1.200/24 (vhid 2) WAN  carp WANVirIPv4 
                                            fd28:8ccb:1874:a09e::1/64 (vhid 3) LAN  carp LANVirIPv6

                                            https://www.dropbox.com/s/pso662buzfjvfnw/carp%20ipv4.jpg?dl=0

                                            https://www.dropbox.com/s/xqxk04u5133w0jo/carp%20ipv6.jpg?dl=0

                                            ::)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.