• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG

pfBlockerNG
210
1.2k
1.8m
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • H
    hda
    last edited by Aug 24, 2015, 12:56 PM

    @hulleyrob:

    Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?

    Yes metoo. on 2.2.4 (Alix) nano (rw).
    Widgets: System Information; Interfaces; Services Status; NTP Status and pfBlockerNG.
    Mozilla FF(40.0.2).

    1 Reply Last reply Reply Quote 0
    • D
      doktornotor Banned
      last edited by Aug 24, 2015, 12:58 PM

      @hulleyrob:

      Does "Enable Alias Table Popup" work for anyone as if i untick it and save not only does it have no effect but the tick is back when i got back into the settings on the homepage?

      I would love to keep it ticked. Alas, it keeps unticking itself.

      1 Reply Last reply Reply Quote 0
      • H
        hulleyrob
        last edited by Aug 24, 2015, 6:07 PM

        Does the same on both Chrome and Safari on OS X (latest versions of each).

        I have the following widgets on the homepage:

        System Info, Interfaces, Services Status, Interface Statistics, Installed Packages, PFBlockerNG, Snort Alerts, Firewall Logs.

        PFsense 2.2.4 full all other widgets seem to work fine.

        Thanks

        Rob

        1 Reply Last reply Reply Quote 0
        • T
          trumee
          last edited by Aug 24, 2015, 6:37 PM Aug 24, 2015, 6:28 PM

          I have multiple forwarded ports in different aliases (some are tcp only and others are udp only).  Is it possible to specify multiple aliases in "Enable Custom Port"?

          Thanks

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by Aug 24, 2015, 6:51 PM

            You should use one of the Alias list actions and create and manage your own firewall rules using those.

            1 Reply Last reply Reply Quote 0
            • T
              trumee
              last edited by Aug 24, 2015, 8:13 PM

              Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
              This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng?

              1 Reply Last reply Reply Quote 0
              • B
                BBcan177 Moderator
                last edited by Aug 25, 2015, 12:10 AM

                @JC2:

                I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.

                Can you browse to  http://bgp.he.net  ?

                "Experience is something you don't get until just after you need it."

                Website: http://pfBlockerNG.com
                Twitter: @BBcan177  #pfBlockerNG
                Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                1 Reply Last reply Reply Quote 0
                • B
                  BBcan177 Moderator
                  last edited by Aug 25, 2015, 12:12 AM

                  @trumee:

                  Pfblocker inserts the rule swith the name withpfB_Top_v4. Can I simply clone this rule in Firewall>Rules and specify my own alias?
                  This way I can reuse the list created by pfblocker. Will this cause a problem with pfblockerng?

                  When pfB_Top_v4 creates an Auto Firewall Rule, you can manually create another Rule and reference the same "pfB_Top_v4" table without issue…

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • J
                    joshcch
                    last edited by Aug 25, 2015, 12:12 PM

                    @BBcan177:

                    @JC2:

                    I came across this thread before attempting to make a new alias from HE data and made sure that HTML was selected before my first update and immediately received a 403 response. Just wondering if anyone else is using HE with any success.

                    Can you browse to  http://bgp.he.net  ?

                    Yes. I attempted to do another update and same results, 403.

                    1 Reply Last reply Reply Quote 0
                    • D
                      doktornotor Banned
                      last edited by Aug 25, 2015, 12:16 PM

                      Apparently you got banned… :P

                      1 Reply Last reply Reply Quote 0
                      • J
                        Jamerson
                        last edited by Aug 25, 2015, 3:28 PM

                        @doktornotor:

                        Apparently you got banned… :P

                        I was curious what kind of website is this ?
                        http://bgp.he.net

                        1 Reply Last reply Reply Quote 0
                        • M
                          marcelloc
                          last edited by Aug 25, 2015, 5:02 PM

                          @Jamerson:

                          I was curious what kind of website is this ?
                          http://bgp.he.net

                          Hurricane Electric BGP Toolkit
                          bgp.he.net/
                          Welcome to the Hurricane Electric BGP Toolkit. You are visiting from 66.249.79.114 (crawl-66-249-79-114.googlebot.com). United States. Announced as …
                          ‎Looking Glass - ‎BGP Prefix Report - ‎BGP Peer Report - ‎World Report

                          Bgp.he.net Explained - YouTube

                          Treinamentos de Elite: http://sys-squad.com

                          Help a community developer! ;D

                          1 Reply Last reply Reply Quote 0
                          • T
                            trumee
                            last edited by Aug 26, 2015, 12:18 PM

                            Hello,

                            I have selected Germany in the Top20 list and defined it as Deny Inbound. However, snort is still picking up German ip address. Why isnt pfblocker blocking this ip address?

                            Ip address in snort

                            PfblockerNG

                            Firewall rules

                            Thanks

                            1 Reply Last reply Reply Quote 0
                            • F
                              f34rinc
                              last edited by Aug 26, 2015, 1:09 PM

                              Trumee - Snort sees all traffic regardless of pfSense firewall rules.  Even if you have zero allow inbound rules Snort still sees the attempted connection and will generate an alert block even if its already blocked by pfSense.

                              1 Reply Last reply Reply Quote 0
                              • R
                                RpR
                                last edited by Aug 27, 2015, 10:47 PM

                                Does the ip4 txt file care about double ip's?
                                I mean if you have a txt:

                                1.2.3.4
                                2.3.4.5
                                1.2.3.4

                                will it work or does it require a unique list?
                                Also if a list exist:
                                192.168.1.200
                                192.168.1.0/24
                                does it work?

                                1 Reply Last reply Reply Quote 0
                                • B
                                  BBcan177 Moderator
                                  last edited by Aug 27, 2015, 10:54 PM

                                  Enable "De-Duplication" in the General Tab. This will remove all duplication's (Including CIDR). If you already have lists downloaded, you can make that change and then execute a "Force Reload".

                                  "Experience is something you don't get until just after you need it."

                                  Website: http://pfBlockerNG.com
                                  Twitter: @BBcan177  #pfBlockerNG
                                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                  1 Reply Last reply Reply Quote 0
                                  • B
                                    badger
                                    last edited by Aug 28, 2015, 8:59 AM

                                    hi,

                                    outstanding work. Just stumbled about a little problem. I'm using pfblockerNG in combination with CARP. Settings should be synced to configured backup server - which i'm not sure they really get. I can clearly find the rules pfblocker added on the WAN-tab - but on the secondary firewall i can neither find selected entries in the individual tabs nor do filter list under "IPv4"-tab get synced.

                                    Am I doing something wrong - or must sees settings be performed additionally on the backup firewall?

                                    Thank you very much =)

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      taryezveb
                                      last edited by Aug 28, 2015, 8:07 PM

                                      BBcan177,

                                      Was finally able to do what you suggested. Got rid of those IBlock
                                      lists, did not bother to see which list was causing the no internet
                                      issue on reboot. Using your pfBlockerNG_import.php script, posted
                                      here[0] by doktornotor and following superweasel's instructions[1]. No
                                      more reboot issues.

                                      For those that are going to use the pfBlockerNG_import.php script. There
                                      are a few things you still need to do, after following superweasel's
                                      instructions:

                                      Firewall => pfBlockerNG => IPv4 tab

                                      Edit each Alias/List Configuration to:

                                      Enable the lists you want to use. Ie. 'State' to 'ON'.

                                      And 'List Action' as needed.

                                      Do not forget to 'Save' your changes. And also Force an Update and
                                      Reload]; in:

                                      Firewall => pfBlockerNG => Update tab

                                      Once all that is done, will still need to adjust the feeds as they
                                      change from time to time. Take a look at the error.log log file:

                                      Firewall => pfBlockerNG => Logs tab

                                      And this post[2] from BBcan177 for some hints. When done repeat the
                                      Force [Update, Reload].

                                      • [0] https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                                      • [1] https://forum.pfsense.org/index.php?topic=86212.msg510369#msg510369

                                      • [2] https://forum.pfsense.org/index.php?topic=86212.msg548372#msg548372

                                      Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search
                                      did not bring up anything.

                                      Would like to Thank all for the information in this thread. Specifically
                                      for the information above, BBcan177, doktornotor and superweasel.
                                      Especially BBcan177, without whom this would not be possible.

                                      Thank You

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        pfcode
                                        last edited by Aug 28, 2015, 8:16 PM

                                        @taryezveb:

                                        Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search
                                        did not bring up anything.

                                        Its one time use. you may delete it after you were done.

                                        Release: pfSense 2.4.3(amd64)
                                        M/B: Supermicro A1SRi-2558F
                                        HDD: Intel X25-M 160G
                                        RAM: 2x8Gb Kingston ECC ValueRAM
                                        AP: Netgear R7000 (XWRT), Unifi AC Pro

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          BBcan177 Moderator
                                          last edited by Aug 29, 2015, 4:09 PM

                                          @taryezveb:

                                          Was finally able to do what you suggested. Got rid of those IBlock lists ….. No more reboot issues.

                                          IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)

                                          Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search did not bring up anything.

                                          I am contemplating adding a feature to allow auto updating the Lists/Feeds for a future release. I am finalizing v2.0 which has DNSBL domain name blocking via Unbound Resolver and hope to get that released soon…

                                          Especially BBcan177, without whom this would not be possible.

                                          Thank You!

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          843 out of 1196
                                          • First post
                                            843/1196
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.