PfBlockerNG

doktornotor

The reason is that you configured it so…

pfcode

The reason is that you configured it so…

Well, whats the pfB_TOR rules for then? since its turned on by default. why we need to block these IPs if they are good, no harm?

doktornotor

There is NO list turned on by default, anywhere. The blocklist simply lists tor exit nodes. You do not need to block anything. Simply stop using the "offending" blocklist to block outbound traffic, or whitelist the IP, or whatever.

Marvho

Hello everyone,

I'm new to pfblockerng and I want some sugestions from you guys.

Which list could be useful for a home use scenario with no open ports, just outbound traffic is important.

I'm also interested in blocking adverts with pfblockerng. Is there a way to use the easylist from ADBlock Plus ?

Which lists are you using actual? And where do I get them?

Thanks for any advice.

Best regards

doktornotor

@Marvho:

Which lists are you using actual? And where do I get them?

https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

dzeanah

@doktornotor:

@Marvho:

Which lists are you using actual? And where do I get them?

https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

I totally missed that. Thanks so much for pointing it out.

Marvho

Thanks for the list.

I imported it successfully and set these to "deny outbound" but they won't show up in the Dashboard listing.

Did I miss something?

//edit: Nevermind, had to switch the state of the link to "ON".

thehasty

@BBcan177:

When you add IPs to a custom list, did you select "Update Custom List" at the bottom of the Alias Settings when you saved it (and ran a Force Update)? If you don't select this option, then it will only update the alias as per the defined Frequency setting of the Alias.

Its best to look at the Aliastable to see if the IP is actually in the table. You can view the table by hovering over the Alias in the Widget or Firewall Rules. You can also view the table in Diagnostics: Tables: in the pfSense GUI.

I will also be submitting a PR for a small bug. The details of the workaround can be found in the following link:
https://forum.pfsense.org/index.php?topic=86212.msg526272#msg526272

I always run a Force Update after changes, however I did not have "Update Custom List" set. It is now set and I've changed the scope back to TCP/UDP. I'll report back with any issues.

Thanks again for your help!

Marvho

How can I suppress a IP for example 192.16.71.176:443 ?

It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

Thanks!

Mr. Jingles

@Marvho:

How can I suppress a IP for example 192.16.71.176:443 ?

It's blocked by IBlock_ADS but it stops the twitch.tv Mobile App to work.

Thanks!

Click on the suppress icon in the alerts?

(I'm probably saying something stupid now :-[ ).

doktornotor

Yeah, the suppress icon is there for a reason.

Marvho

Thanks.

Is there a way to see a list with the suppressed hosts?

doktornotor

It's in Firewall - Aliases.

Marvho

Do I have to add this alias manually to the specific interfaces?

Sorry for asking so many questions..

doktornotor

No.

Marvho

Well then something is working wrong.

If I try to access "twitch.tv" the alert tab shows me this "IBlock_Ads 192.16.64.0/21" and the connection gets refused. (Tested in Firefox) (PfSense 2.2.3 amd64 full install)

Pressing the "+" button ends in this "Host IP address 192.16.71.176 already exists in the pfBlockerNG Suppress Table."

In the Interface rules, there is no auto created rule using the alias "pfBlockerNGSuppress".

I hope I provided enough information to figure this out.

Thanks for your help!

BBcan177

@Marvho:

Well then something is working wrong.

If I try to access "twitch.tv" the alert tab shows me this "IBlock_Ads 192.16.64.0/21" and the connection gets refused. (Tested in Firefox) (PfSense 2.2.3 amd64 full install)

Pressing the "+" button ends in this "Host IP address 192.16.71.176 already exists in the pfBlockerNG Suppress Table."

In the Interface rules, there is no auto created rule using the alias "pfBlockerNGSuppress".

I hope I provided enough information to figure this out.

Thanks for your help!

Please read the following post to answer your questions :
https://forum.pfsense.org/index.php?topic=86212.msg513676#msg513676

Marvho

I read that posting but it doesn't helped really.

This is what I do:

Try to access "www.twitch.tv"

See that it's blocked by following Alias List "IBlock_Ads 192.16.64.0/21"

Try to supress it with the "+".

Message that it's already supressed pops up.

Checking the PfBlockerNGSupress alias and see this "pfBlockerNGSuppress 192.16.71.176/32, 192.16.71.176/24 "

Running a forced cron task.

Try to access "www.twitch.tv" again. It is still blocked.

There is something I'm doing wrong, but I can't figure it out.

BBcan177

You can't use suppression when the blocked IP is in a CIDR like /21.

Hover over the "+" or the List column in the Alerts tab and you are presented with instructions.

So to circumvent this, create a new "permit Outbound" alias in pfBNG and add the IP to the custom entry box. This will create a permit outbound firewall rule above the Block rules.

Marvho

@BBcan177:

You can't use suppression when the blocked IP is in a CIDR like /21.

So to circumvent this, create a new "permit Outbound" alias in pfBNG and add the IP to the custom entry box. This will create a permit outbound firewall rule above the Block rules.

Ahh thats it! Thank you!

Just one last question, how can I delete hosts from the suppression list? I removed the the Alias but there are still 2 Hosts suppressed.