Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 211 Posters 2.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      thehasty
      last edited by

      It was working until I changed the setting he advised. I've changed it back for now.

      top to bottom

      manualMail
      IPs added manually to be blocked from sending mail.
      txt
      on
      blank
      blank
      deny inbound
      never
      Monday
      enable
      tick'd with my smtp_ports alias in the box
      unticked
      unticked
      any (was tcp/udb)

      5.56.133.231-5.56.133.237
      5.255.94.149-5.255.94.243
      23.108.42.1-23.108.42.138
      23.227.199.146-23.227.199.158
      23.231.63.12-23.231.63.139
      50.2.66.2-50.2.66.50
      50.2.70.2-50.2.70.44
      50.30.36.45-50.30.36.182
      69.12.64.24-69.12.64.230
      80.79.17.10-80.79.179.51
      81.31.44.2-81.31.44.64
      82.118.242.107-82.118.242.140
      82.192.81.134-82.192.81.157
      85.187.151.170-85.187.151.184
      94.228.219.2-94.228.219.14
      94.242.202.227-94.242.202.254
      95.211.147.113-95.211.147.117
      95.211.159.9-95.211.159.12
      107.158.123.194-107.158.123.253
      107.179.25.195-107.179.25.252
      109.200.217.177-109.200.217.192
      138.99.218.6-138.99.218.223
      159.8.217.192-159.8.217.198
      173.224.115.142-173.224.115.144
      173.247.227.2-173.247.227.19
      185.7.34.116-185.7.34.173
      185.82.202.20-185.82.202.222
      192.3.11.82-192.3.11.94
      192.3.207.187-192.3.207.190
      192.161.194.131-192.161.194.148
      192.169.69.131-192.169.69.141
      198.23.190.35-198.23.190.157
      198.52.147.34-198.52.147.62
      198.52.150.34-198.52.150.61
      198.52.231.141-198.52.231.147
      198.52.246.137-198.52.246.163
      198.52.251.134-198.52.251.232
      198.52.152.34-198.52.152.62
      198.154.80.2-198.154.80.219
      209.126.121.18-209.126.121.35
      216.144.241.194-216.144.241.205
      216.169.105.172-216.169.105.211
      216.169.112.80-216.169.112.206

      default

      Thank you.

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by

        @thehasty:

        It was working until I changed the setting he advised.

        Which setting?

        @thehasty:

        manualMail
        IPs added manually to be blocked from sending mail.
        txt
        on
        blank
        blank
        deny inbound
        never
        Monday
        enable
        tick'd with my smtp_ports alias in the box
        unticked
        unticked
        any (was tcp/udb)

        Post screenshots. Not such mess. You changed exactly what?

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          @thehasty:

          Apparently it is no longer blocking inbound spam from my custom list?

          When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)?  If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.

          Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.

          I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
          https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • P
            pfcode
            last edited by

            Using pfB_TOR rules (List: Blut_Tor), it blocks IP 162.244.25.186, the host is 0.ca.pool.ntp.org, Whats the reason to block LAN to access this IP with port 123?

            Release: pfSense 2.4.3(amd64)
            M/B: Supermicro A1SRi-2558F
            HDD: Intel X25-M 160G
            RAM: 2x8Gb Kingston ECC ValueRAM
            AP: Netgear R7000 (XWRT), Unifi AC Pro

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by

              The reason is that you configured it so…

              1 Reply Last reply Reply Quote 0
              • P
                pfcode
                last edited by

                @doktornotor:

                The reason is that you configured it so…

                Well, whats the pfB_TOR rules for then?  since its turned on by default. why we need to block these IPs if they are good, no harm?

                Release: pfSense 2.4.3(amd64)
                M/B: Supermicro A1SRi-2558F
                HDD: Intel X25-M 160G
                RAM: 2x8Gb Kingston ECC ValueRAM
                AP: Netgear R7000 (XWRT), Unifi AC Pro

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  There is NO list turned on by default, anywhere. The blocklist simply lists tor exit nodes. You do not need to block anything. Simply stop using the "offending" blocklist to block outbound traffic, or whitelist the IP, or whatever.

                  1 Reply Last reply Reply Quote 0
                  • M
                    Marvho
                    last edited by

                    Hello everyone,

                    I'm new to pfblockerng and I want some sugestions from you guys.

                    Which list could be useful for a home use scenario with no open ports, just outbound traffic is important.

                    I'm also interested in blocking adverts with pfblockerng. Is there a way to use the easylist from ADBlock Plus ?

                    Which lists are you using actual? And where do I get them?

                    Thanks for any advice.

                    Best regards

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by

                      @Marvho:

                      Which lists are you using actual? And where do I get them?

                      https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                      1 Reply Last reply Reply Quote 0
                      • D
                        dzeanah
                        last edited by

                        @doktornotor:

                        @Marvho:

                        Which lists are you using actual? And where do I get them?

                        https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                        I totally missed that.  Thanks so much for pointing it out.

                        1 Reply Last reply Reply Quote 0
                        • M
                          Marvho
                          last edited by

                          Thanks for the list.

                          I imported it successfully and set these to "deny outbound" but they won't show up in the Dashboard listing.

                          Did I miss something?

                          //edit: Nevermind, had to switch the state of the link to "ON".

                          1 Reply Last reply Reply Quote 0
                          • T
                            thehasty
                            last edited by

                            @BBcan177:

                            When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)?  If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.

                            Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.

                            I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
                            https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272

                            I always run a Force Update after changes, however I did not have "Update Custom List" set. It is now set and I've changed the scope back to TCP/UDP. I'll report back with any issues.

                            Thanks again for your help!

                            1 Reply Last reply Reply Quote 0
                            • M
                              Marvho
                              last edited by

                              How can I suppress a IP for example 192.16.71.176:443 ?

                              It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

                              Thanks!

                              1 Reply Last reply Reply Quote 0
                              • M
                                Mr. Jingles
                                last edited by

                                @Marvho:

                                How can I suppress a IP for example 192.16.71.176:443 ?

                                It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

                                Thanks!

                                Click on the suppress icon in the alerts?

                                (I'm probably saying something stupid now  :-[ ).

                                6 and a half billion people know that they are stupid, agressive, lower life forms.

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by

                                  Yeah, the suppress icon is there for a reason.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    Marvho
                                    last edited by

                                    Thanks.

                                    Is there a way to see a list with the suppressed hosts?

                                    1 Reply Last reply Reply Quote 0
                                    • D
                                      doktornotor Banned
                                      last edited by

                                      It's in Firewall - Aliases.

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        Marvho
                                        last edited by

                                        Do I have to add this alias manually to the specific interfaces?

                                        Sorry for asking so many questions..

                                        1 Reply Last reply Reply Quote 0
                                        • D
                                          doktornotor Banned
                                          last edited by

                                          No.

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            Marvho
                                            last edited by

                                            Well then something is working wrong.

                                            If I try to access "twitch.tv" the alert tab shows me this "IBlock_Ads 192.16.64.0/21" and the connection gets refused. (Tested in Firefox) (PfSense 2.2.3 amd64 full install)

                                            Pressing the "+" button ends in this "Host IP address 192.16.71.176 already exists in the pfBlockerNG Suppress Table."

                                            In the Interface rules, there is no auto created rule using the alias "pfBlockerNGSuppress".

                                            I hope I provided enough information to figure this out.

                                            Thanks for your help!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.