PfBlockerNG
-
log looks a lot cleaner, except for BBC_GOZ and Feodo_BAD returning empty lists.
Use the following URL for BBC. It incorporates all of their IP lists into one IP feed:
http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txtFollow that with a "Force Reload"
-
Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?
I had one user complain about this a few months back, but couldn't figure out why its doing that. I suspect an issue with the browser or a conflict with another widget.
What Browser are you using (Can you try a different browser)? and what widgets are enabled? Are you on 2.2.4? Full/Nano/Ramdisk installation? Do the other pfBNG widget settings work for you?
-
Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?
Works fine for me. In past versions of pfSense I had issues with most of the widgets not saving their settings. It improved in later releases. I'm on 2.2.4 right now without issue.
-
To download from HE, you need to select the format as "html" or it will fail to download.
Disable this list for 24hrs as HE is denying access (rate-limiting) because you probably have this list attempting to download every hour using the wrong download format.
I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.
Hypertext Transfer Protocol Line-based text data: text/html \n \n <title>403 Forbidden</title>\n \n # Forbidden \n You don't have permission to access /search\n on this server. \n * * * \n <address>Apache/2.4.7 (Ubuntu) Server at bgp.he.net Port 80</address> \n \n 18 GET /search?search%5Bsearch%5D=facebook&commit=Search HTTP/1.1 Hypertext Transfer Protocol 20 HTTP/1.1 403 Forbidden (text/html) Hypertext Transfer Protocol Line-based text data: text/html \n \n <title>403 Forbidden</title>\n \n # Forbidden \n You don't have permission to access /search\n on this server. \n * * * \n <address>Apache/2.4.7 (Ubuntu) Server at bgp.he.net Port 80</address> \n \n -
Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?
Yes metoo. on 2.2.4 (Alix) nano (rw).
Widgets: System Information; Interfaces; Services Status; NTP Status and pfBlockerNG.
Mozilla FF(40.0.2). -
Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?
I would love to keep it ticked. Alas, it keeps unticking itself.
-
Does the same on both Chrome and Safari on OS X (latest versions of each).
I have the following widgets on the homepage:
System Info, Interfaces, Services Status, Interface Statistics, Installed Packages, PFBlockerNG, Snort Alerts, Firewall Logs.
PFsense 2.2.4 full all other widgets seem to work fine.
Thanks
Rob
-
I have multiple forwarded ports in different aliases (some are tcp only and others are udp only). Is it possible to specify multiple aliases in "Enable Custom Port"?
Thanks
-
You should use one of the Alias list actions and create and manage your own firewall rules using those.
-
Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng? -
@JC2:
I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.
Can you browse to http://bgp.he.net ?
-
Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng?When pfB_Top_v4 creates an Auto Firewall Rule, you can manually create another Rule and reference the same "pfB_Top_v4" table without issue…
-
@JC2:
I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.
Can you browse to http://bgp.he.net ?
Yes. I attempted to do another update and same results, 403.
-
Apparently you got banned… :P
-
Apparently you got banned… :P
I was curious what kind of website is this ?
http://bgp.he.net -
I was curious what kind of website is this ?
http://bgp.he.netHurricane Electric BGP Toolkit
bgp.he.net/
Welcome to the Hurricane Electric BGP Toolkit. You are visiting from 66.249.79.114 (crawl-66-249-79-114.googlebot.com). United States. Announced as …
Looking Glass - BGP Prefix Report - BGP Peer Report - World Report -
Hello,
I have selected Germany in the Top20 list and defined it as Deny Inbound. However, snort is still picking up German ip address. Why isnt pfblocker blocking this ip address?
Ip address in snort
PfblockerNG
Firewall rules
Thanks
-
Trumee - Snort sees all traffic regardless of pfSense firewall rules. Even if you have zero allow inbound rules Snort still sees the attempted connection and will generate an alert block even if its already blocked by pfSense.
-
Does the ip4 txt file care about double ip's?
I mean if you have a txt:1.2.3.4
2.3.4.5
1.2.3.4will it work or does it require a unique list?
Also if a list exist:
192.168.1.200
192.168.1.0/24
does it work? -
Enable "De-Duplication" in the General Tab. This will remove all duplication's (Including CIDR). If you already have lists downloaded, you can make that change and then execute a "Force Reload".
