Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 211 Posters 2.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      @fragged:

      @Derek:

      Thanks for that BB.  I'd been trying https://www.dan.me.uk/torlist/ and was seeing Download FAIL messages.  I'll tinker a bit more.

      For this particular list I ended up setting a cron job on one of my RaspberryPi's to fetch the list on schedule and then fetch it from the Pi to pfBlockerNG.

      Its strange that you guys are seeing errors in downloading this list from www.dan.me.uk?

      If you load that URL in a browser does it fail to download also? Did you try http instead? I use this list in several other boxes and have not seen anyone else complain about that list.

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • N
        n3by
        last edited by

        I had this error… and now I think maybe because:

        Umm… You can only fetch the data every 30 minutes - sorry.  It's pointless any faster as I only update every 30 minutes anyway.
        If you keep trying to download this list too often, you may get blocked from accessing it completely.
        (this is due to some people trying to download this list every minute!)

        1 Reply Last reply Reply Quote 0
        • T
          thehasty
          last edited by

          @BBcan177:

          @thehasty:

          I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.

          When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.

          Apparently it is no longer blocking inbound spam from my custom list?

          2015-07-16 23:57:19 Copper-Fit-Back-Relief@cdkql.xyz [myemail] 198.154.80.46 127.0.0.1 SMTP ? 250 5467

          fit in a range on my custom block list: 198.154.80.2-198.154.80.219

          Please advise

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            @thehasty:

            Please advise

            Please post your "custom list". Plus how's that list configured in pfBNBG. Noone can advise with no info.

            1 Reply Last reply Reply Quote 0
            • T
              thehasty
              last edited by

              It was working until I changed the setting he advised. I've changed it back for now.

              top to bottom

              manualMail
              IPs added manually to be blocked from sending mail.
              txt
              on
              blank
              blank
              deny inbound
              never
              Monday
              enable
              tick'd with my smtp_ports alias in the box
              unticked
              unticked
              any (was tcp/udb)

              5.56.133.231-5.56.133.237
              5.255.94.149-5.255.94.243
              23.108.42.1-23.108.42.138
              23.227.199.146-23.227.199.158
              23.231.63.12-23.231.63.139
              50.2.66.2-50.2.66.50
              50.2.70.2-50.2.70.44
              50.30.36.45-50.30.36.182
              69.12.64.24-69.12.64.230
              80.79.17.10-80.79.179.51
              81.31.44.2-81.31.44.64
              82.118.242.107-82.118.242.140
              82.192.81.134-82.192.81.157
              85.187.151.170-85.187.151.184
              94.228.219.2-94.228.219.14
              94.242.202.227-94.242.202.254
              95.211.147.113-95.211.147.117
              95.211.159.9-95.211.159.12
              107.158.123.194-107.158.123.253
              107.179.25.195-107.179.25.252
              109.200.217.177-109.200.217.192
              138.99.218.6-138.99.218.223
              159.8.217.192-159.8.217.198
              173.224.115.142-173.224.115.144
              173.247.227.2-173.247.227.19
              185.7.34.116-185.7.34.173
              185.82.202.20-185.82.202.222
              192.3.11.82-192.3.11.94
              192.3.207.187-192.3.207.190
              192.161.194.131-192.161.194.148
              192.169.69.131-192.169.69.141
              198.23.190.35-198.23.190.157
              198.52.147.34-198.52.147.62
              198.52.150.34-198.52.150.61
              198.52.231.141-198.52.231.147
              198.52.246.137-198.52.246.163
              198.52.251.134-198.52.251.232
              198.52.152.34-198.52.152.62
              198.154.80.2-198.154.80.219
              209.126.121.18-209.126.121.35
              216.144.241.194-216.144.241.205
              216.169.105.172-216.169.105.211
              216.169.112.80-216.169.112.206

              default

              Thank you.

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                @thehasty:

                It was working until I changed the setting he advised.

                Which setting?

                @thehasty:

                manualMail
                IPs added manually to be blocked from sending mail.
                txt
                on
                blank
                blank
                deny inbound
                never
                Monday
                enable
                tick'd with my smtp_ports alias in the box
                unticked
                unticked
                any (was tcp/udb)

                Post screenshots. Not such mess. You changed exactly what?

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  @thehasty:

                  Apparently it is no longer blocking inbound spam from my custom list?

                  When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)?  If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.

                  Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.

                  I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
                  https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfcode
                    last edited by

                    Using pfB_TOR rules (List: Blut_Tor), it blocks IP 162.244.25.186, the host is 0.ca.pool.ntp.org, Whats the reason to block LAN to access this IP with port 123?

                    Release: pfSense 2.4.3(amd64)
                    M/B: Supermicro A1SRi-2558F
                    HDD: Intel X25-M 160G
                    RAM: 2x8Gb Kingston ECC ValueRAM
                    AP: Netgear R7000 (XWRT), Unifi AC Pro

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      The reason is that you configured it so…

                      1 Reply Last reply Reply Quote 0
                      • P
                        pfcode
                        last edited by

                        @doktornotor:

                        The reason is that you configured it so…

                        Well, whats the pfB_TOR rules for then?  since its turned on by default. why we need to block these IPs if they are good, no harm?

                        Release: pfSense 2.4.3(amd64)
                        M/B: Supermicro A1SRi-2558F
                        HDD: Intel X25-M 160G
                        RAM: 2x8Gb Kingston ECC ValueRAM
                        AP: Netgear R7000 (XWRT), Unifi AC Pro

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          There is NO list turned on by default, anywhere. The blocklist simply lists tor exit nodes. You do not need to block anything. Simply stop using the "offending" blocklist to block outbound traffic, or whitelist the IP, or whatever.

                          1 Reply Last reply Reply Quote 0
                          • M
                            Marvho
                            last edited by

                            Hello everyone,

                            I'm new to pfblockerng and I want some sugestions from you guys.

                            Which list could be useful for a home use scenario with no open ports, just outbound traffic is important.

                            I'm also interested in blocking adverts with pfblockerng. Is there a way to use the easylist from ADBlock Plus ?

                            Which lists are you using actual? And where do I get them?

                            Thanks for any advice.

                            Best regards

                            1 Reply Last reply Reply Quote 0
                            • D
                              doktornotor Banned
                              last edited by

                              @Marvho:

                              Which lists are you using actual? And where do I get them?

                              https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                              1 Reply Last reply Reply Quote 0
                              • D
                                dzeanah
                                last edited by

                                @doktornotor:

                                @Marvho:

                                Which lists are you using actual? And where do I get them?

                                https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                                I totally missed that.  Thanks so much for pointing it out.

                                1 Reply Last reply Reply Quote 0
                                • M
                                  Marvho
                                  last edited by

                                  Thanks for the list.

                                  I imported it successfully and set these to "deny outbound" but they won't show up in the Dashboard listing.

                                  Did I miss something?

                                  //edit: Nevermind, had to switch the state of the link to "ON".

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    thehasty
                                    last edited by

                                    @BBcan177:

                                    When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)?  If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.

                                    Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.

                                    I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
                                    https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272

                                    I always run a Force Update after changes, however I did not have "Update Custom List" set. It is now set and I've changed the scope back to TCP/UDP. I'll report back with any issues.

                                    Thanks again for your help!

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      Marvho
                                      last edited by

                                      How can I suppress a IP for example 192.16.71.176:443 ?

                                      It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

                                      Thanks!

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Mr. Jingles
                                        last edited by

                                        @Marvho:

                                        How can I suppress a IP for example 192.16.71.176:443 ?

                                        It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

                                        Thanks!

                                        Click on the suppress icon in the alerts?

                                        (I'm probably saying something stupid now  :-[ ).

                                        6 and a half billion people know that they are stupid, agressive, lower life forms.

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          doktornotor Banned
                                          last edited by

                                          Yeah, the suppress icon is there for a reason.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            Marvho
                                            last edited by

                                            Thanks.

                                            Is there a way to see a list with the suppressed hosts?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.