PfBlockerNG
-
I am using custom inbound IPv4 lists (spamhaus, DShield, etc) set to Deny_Inbound with a custom port alias set up. When I look at the alerts, it shows entries for ports that I do not have specified to block.
When using "Adv. Inbound Settings", you need to set the "Custom Protocol" setting. If you use "any" it will act on all ports, suggest to use "TCP/UDP" or as required.
Apparently it is no longer blocking inbound spam from my custom list?
2015-07-16 23:57:19 Copper-Fit-Back-Relief@cdkql.xyz [myemail] 198.154.80.46 127.0.0.1 SMTP ? 250 5467
fit in a range on my custom block list: 198.154.80.2-198.154.80.219
Please advise
-
Please advise
Please post your "custom list". Plus how's that list configured in pfBNBG. Noone can advise with no info.
-
It was working until I changed the setting he advised. I've changed it back for now.
top to bottom
manualMail
IPs added manually to be blocked from sending mail.
txt
on
blank
blank
deny inbound
never
Monday
enable
tick'd with my smtp_ports alias in the box
unticked
unticked
any (was tcp/udb)5.56.133.231-5.56.133.237
5.255.94.149-5.255.94.243
23.108.42.1-23.108.42.138
23.227.199.146-23.227.199.158
23.231.63.12-23.231.63.139
50.2.66.2-50.2.66.50
50.2.70.2-50.2.70.44
50.30.36.45-50.30.36.182
69.12.64.24-69.12.64.230
80.79.17.10-80.79.179.51
81.31.44.2-81.31.44.64
82.118.242.107-82.118.242.140
82.192.81.134-82.192.81.157
85.187.151.170-85.187.151.184
94.228.219.2-94.228.219.14
94.242.202.227-94.242.202.254
95.211.147.113-95.211.147.117
95.211.159.9-95.211.159.12
107.158.123.194-107.158.123.253
107.179.25.195-107.179.25.252
109.200.217.177-109.200.217.192
138.99.218.6-138.99.218.223
159.8.217.192-159.8.217.198
173.224.115.142-173.224.115.144
173.247.227.2-173.247.227.19
185.7.34.116-185.7.34.173
185.82.202.20-185.82.202.222
192.3.11.82-192.3.11.94
192.3.207.187-192.3.207.190
192.161.194.131-192.161.194.148
192.169.69.131-192.169.69.141
198.23.190.35-198.23.190.157
198.52.147.34-198.52.147.62
198.52.150.34-198.52.150.61
198.52.231.141-198.52.231.147
198.52.246.137-198.52.246.163
198.52.251.134-198.52.251.232
198.52.152.34-198.52.152.62
198.154.80.2-198.154.80.219
209.126.121.18-209.126.121.35
216.144.241.194-216.144.241.205
216.169.105.172-216.169.105.211
216.169.112.80-216.169.112.206default
Thank you.
-
It was working until I changed the setting he advised.
Which setting?
manualMail
IPs added manually to be blocked from sending mail.
txt
on
blank
blank
deny inbound
never
Monday
enable
tick'd with my smtp_ports alias in the box
unticked
unticked
any (was tcp/udb)Post screenshots. Not such mess. You changed exactly what?
-
Apparently it is no longer blocking inbound spam from my custom list?
When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)? If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.
Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.
I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272 -
Using pfB_TOR rules (List: Blut_Tor), it blocks IP 162.244.25.186, the host is 0.ca.pool.ntp.org, Whats the reason to block LAN to access this IP with port 123?
-
The reason is that you configured it so…
-
The reason is that you configured it so…
Well, whats the pfB_TOR rules for then? since its turned on by default. why we need to block these IPs if they are good, no harm?
-
There is NO list turned on by default, anywhere. The blocklist simply lists tor exit nodes. You do not need to block anything. Simply stop using the "offending" blocklist to block outbound traffic, or whitelist the IP, or whatever.
-
Hello everyone,
I'm new to pfblockerng and I want some sugestions from you guys.
Which list could be useful for a home use scenario with no open ports, just outbound traffic is important.
I'm also interested in blocking adverts with pfblockerng. Is there a way to use the easylist from ADBlock Plus ?
Which lists are you using actual? And where do I get them?
Thanks for any advice.
Best regards
-
Which lists are you using actual? And where do I get them?
https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975
-
Which lists are you using actual? And where do I get them?
https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975
I totally missed that. Thanks so much for pointing it out.
-
Thanks for the list.
I imported it successfully and set these to "deny outbound" but they won't show up in the Dashboard listing.
Did I miss something?
//edit: Nevermind, had to switch the state of the link to "ON".
-
When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)? If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.
Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.
I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272I always run a Force Update after changes, however I did not have "Update Custom List" set. It is now set and I've changed the scope back to TCP/UDP. I'll report back with any issues.
Thanks again for your help!
-
How can I suppress a IP for example 192.16.71.176:443 ?
It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.
Thanks!
-
How can I suppress a IP for example 192.16.71.176:443 ?
It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.
Thanks!
Click on the suppress icon in the alerts?
(I'm probably saying something stupid now :-[ ).
-
Yeah, the suppress icon is there for a reason.
-
Thanks.
Is there a way to see a list with the suppressed hosts?
-
It's in Firewall - Aliases.
-
Do I have to add this alias manually to the specific interfaces?
Sorry for asking so many questions..
