Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlockerNG

    Scheduled Pinned Locked Moved pfBlockerNG
    1.2k Posts 211 Posters 2.1m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • marcellocM
      marcelloc
      last edited by

      @Jamerson:

      I was curious what kind of website is this ?
      http://bgp.he.net

      Hurricane Electric BGP Toolkit
      bgp.he.net/
      Welcome to the Hurricane Electric BGP Toolkit. You are visiting from 66.249.79.114 (crawl-66-249-79-114.googlebot.com). United States. Announced as …
      ‎Looking Glass - ‎BGP Prefix Report - ‎BGP Peer Report - ‎World Report

      Bgp.he.net Explained - YouTube

      Treinamentos de Elite: http://sys-squad.com

      Help a community developer! ;D

      1 Reply Last reply Reply Quote 0
      • T
        trumee
        last edited by

        Hello,

        I have selected Germany in the Top20 list and defined it as Deny Inbound. However, snort is still picking up German ip address. Why isnt pfblocker blocking this ip address?

        Ip address in snort

        PfblockerNG

        Firewall rules

        Thanks

        1 Reply Last reply Reply Quote 0
        • F
          f34rinc
          last edited by

          Trumee - Snort sees all traffic regardless of pfSense firewall rules.  Even if you have zero allow inbound rules Snort still sees the attempted connection and will generate an alert block even if its already blocked by pfSense.

          1 Reply Last reply Reply Quote 0
          • R
            RpR
            last edited by

            Does the ip4 txt file care about double ip's?
            I mean if you have a txt:

            1.2.3.4
            2.3.4.5
            1.2.3.4

            will it work or does it require a unique list?
            Also if a list exist:
            192.168.1.200
            192.168.1.0/24
            does it work?

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              Enable "De-Duplication" in the General Tab. This will remove all duplication's (Including CIDR). If you already have lists downloaded, you can make that change and then execute a "Force Reload".

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • B
                badger
                last edited by

                hi,

                outstanding work. Just stumbled about a little problem. I'm using pfblockerNG in combination with CARP. Settings should be synced to configured backup server - which i'm not sure they really get. I can clearly find the rules pfblocker added on the WAN-tab - but on the secondary firewall i can neither find selected entries in the individual tabs nor do filter list under "IPv4"-tab get synced.

                Am I doing something wrong - or must sees settings be performed additionally on the backup firewall?

                Thank you very much =)

                1 Reply Last reply Reply Quote 0
                • T
                  taryezveb
                  last edited by

                  BBcan177,

                  Was finally able to do what you suggested. Got rid of those IBlock
                  lists, did not bother to see which list was causing the no internet
                  issue on reboot. Using your pfBlockerNG_import.php script, posted
                  here[0] by doktornotor and following superweasel's instructions[1]. No
                  more reboot issues.

                  For those that are going to use the pfBlockerNG_import.php script. There
                  are a few things you still need to do, after following superweasel's
                  instructions:

                  Firewall => pfBlockerNG => IPv4 tab

                  Edit each Alias/List Configuration to:

                  Enable the lists you want to use. Ie. 'State' to 'ON'.

                  And 'List Action' as needed.

                  Do not forget to 'Save' your changes. And also Force an Update and
                  Reload]; in:

                  Firewall => pfBlockerNG => Update tab

                  Once all that is done, will still need to adjust the feeds as they
                  change from time to time. Take a look at the error.log log file:

                  Firewall => pfBlockerNG => Logs tab

                  And this post[2] from BBcan177 for some hints. When done repeat the
                  Force [Update, Reload].

                  • [0] https://forum.pfsense.org/index.php?topic=86212.msg508975#msg508975

                  • [1] https://forum.pfsense.org/index.php?topic=86212.msg510369#msg510369

                  • [2] https://forum.pfsense.org/index.php?topic=86212.msg548372#msg548372

                  Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search
                  did not bring up anything.

                  Would like to Thank all for the information in this thread. Specifically
                  for the information above, BBcan177, doktornotor and superweasel.
                  Especially BBcan177, without whom this would not be possible.

                  Thank You

                  1 Reply Last reply Reply Quote 0
                  • P
                    pfcode
                    last edited by

                    @taryezveb:

                    Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search
                    did not bring up anything.

                    Its one time use. you may delete it after you were done.

                    Release: pfSense 2.4.3(amd64)
                    M/B: Supermicro A1SRi-2558F
                    HDD: Intel X25-M 160G
                    RAM: 2x8Gb Kingston ECC ValueRAM
                    AP: Netgear R7000 (XWRT), Unifi AC Pro

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @taryezveb:

                      Was finally able to do what you suggested. Got rid of those IBlock lists ….. No more reboot issues.

                      IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)

                      Is pfBlockerNG_import.php hosted somewhere and kept up to date? A search did not bring up anything.

                      I am contemplating adding a feature to allow auto updating the Lists/Feeds for a future release. I am finalizing v2.0 which has DNSBL domain name blocking via Unbound Resolver and hope to get that released soon…

                      Especially BBcan177, without whom this would not be possible.

                      Thank You!

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • F
                        foetus
                        last edited by

                        @BBcan177:

                        @taryezveb:

                        Was finally able to do what you suggested. Got rid of those IBlock lists ….. No more reboot issues.

                        IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)

                        I remember a long time ago I managed to break several boxes that way during the beta period, with a certain list :).

                        I must say pfblockerng is still my favorite package. Maintained and pretty much bug free. Now I should finally start testing the DNSBL..

                        1 Reply Last reply Reply Quote 0
                        • S
                          serialdie
                          last edited by

                          @cauthier:

                          Problem solved by BBcan177 with a minor edit to the following file:

                          /usr/local/www/pfblockerng/pfblockerng.php

                          Line 192

                          if (file_exists($local_file)) {
                                // Determine if URL is Remote or Local
                                if ($host['host'] == "127.0.0.1" || $host['host'] == $pfb['iplocal'] || empty($host['host'])) {
                                  $remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));
                                } else {

                          Original:
                          $remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($local_file));

                          NEW:
                          $remote_tds = gmdate ("D, d M Y H:i:s T", filemtime($list_url));

                          Thanks!

                          To be very clear, change the variable $local_file to $list_url

                          I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list.
                          Once I regain my IP list I can see my updates.

                          Any ideas?

                          1 Reply Last reply Reply Quote 0
                          • BBcan177B
                            BBcan177 Moderator
                            last edited by

                            @serialdie:

                            I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list. Once I regain my IP list I can see my updates.

                            Hi serialdie,

                            How many pfBNG Aliases did you configure? I think you hit another bug that I haven't merged into the release… If you only have one, create a second Alias and use a list like Spamhaus drop. I think creating a second alias will fix this issue for you... (2 bugs for you in one day :) )

                            https://www.spamhaus.org/drop/drop.txt

                            "Experience is something you don't get until just after you need it."

                            Website: http://pfBlockerNG.com
                            Twitter: @BBcan177  #pfBlockerNG
                            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                            1 Reply Last reply Reply Quote 0
                            • S
                              serialdie
                              last edited by

                              @BBcan177:

                              @serialdie:

                              I apply this and after each update the IP count resets to 0 and I have to Force Reload to regain my IP list. Once I regain my IP list I can see my updates.

                              Hi serialdie,

                              How many pfBNG Aliases did you configure? I think you hit another bug that I haven't merged into the release… If you only have one, create a second Alias and use a list like Spamhaus drop. I think creating a second alias will fix this issue for you... (2 bugs for you in one day :) )

                              https://www.spamhaus.org/drop/drop.txt

                              HAHAHA! I get a cookie? :P
                              Yes I do have one list setup only so looks like you nailed it with this one.
                              I will try that and report back.

                              Thanks!

                              1 Reply Last reply Reply Quote 0
                              • C
                                cyberbot
                                last edited by

                                I have asked this before but didn't get a answer
                                is there is a possibility to use PFblockerNG  to block porns like proxy server ?

                                1 Reply Last reply Reply Quote 0
                                • F
                                  f34rinc
                                  last edited by

                                  @cyberbot:

                                  is there is a possibility to use PFblockerNG  to block porns like proxy server ?

                                  Once pfBlockerNG 2.0 is ready it will have DNSBL available which could be used to block porn.  Ive had good success using the DansGuardian formatted lists from http://www.squidblacklist.org

                                  ![2015-08-30 18_19_25.png](/public/imported_attachments/1/2015-08-30 18_19_25.png)
                                  ![2015-08-30 18_19_25.png_thumb](/public/imported_attachments/1/2015-08-30 18_19_25.png_thumb)

                                  1 Reply Last reply Reply Quote 0
                                  • BBcan177B
                                    BBcan177 Moderator
                                    last edited by

                                    pfBlockerNG v1.10 - Pull Request has been posted -

                                    Changelog:
                                    https://github.com/pfsense/pfsense-packages/pull/1033

                                    "Experience is something you don't get until just after you need it."

                                    Website: http://pfBlockerNG.com
                                    Twitter: @BBcan177  #pfBlockerNG
                                    Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      taryezveb
                                      last edited by

                                      @BBcan177:

                                      IBlock again! Would have been nice to see which list was causing the issue… Some other poor sucker is going to get hit with that at some point... :)

                                      Unfortunately did not have the time to test, sorry.

                                      @BBcan177:

                                      I am contemplating adding a feature to allow auto updating the Lists/Feeds for a future release. I am finalizing v2.0 which has DNSBL domain name blocking via Unbound Resolver and hope to get that released soon…

                                      Looking forward to try this.

                                      Thank You

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        tonymorella
                                        last edited by

                                        @BBcan177:

                                        @tonymorella:

                                        It seems logical to have detail allow rules followed by pfBlockerNG block rules before allowing destination ANY rules, did I miss an option to have it work in this order?

                                        If I am reading your request correctly, you are asking to sort the pfSense (Permit/Match) rules to be placed before and after the pfBNG rules… I would think it would be rather cumbersome and not sure if others would use it? For more complex setups, that is where the "Alias" type Rules are better utilized. If I have read this incorrectly, please let me know.

                                        Yes, you are reading this correctly.  Figured out how to get floating rules working the way I needed then changed settings to pfBlockerNG block > pfSence Allow and it fixed my set .

                                        Thanks

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          tonymorella
                                          last edited by

                                          Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN.  One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6

                                          
                                          http://bgp.he.net/search?search%5Bsearch%5D=facebook&com
                                          
                                          

                                          Another option is a script, ugly I know :)

                                          
                                          whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'
                                          
                                          

                                          It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.

                                          Say you want to find all the hosts for a domain that does not have an ASN.  Still trying to figure this one out, it's a quick start:

                                          nmap -R -sL 64.98.161.0/24 | grep ting.com
                                          
                                          

                                          Is there any way of doing this in pfBlockerNG?

                                          Thanks
                                          Tony

                                          1 Reply Last reply Reply Quote 0
                                          • M
                                            musicwizard
                                            last edited by

                                            @tonymorella:

                                            Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN.  One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6

                                            
                                            http://bgp.he.net/search?search%5Bsearch%5D=facebook&com
                                            
                                            

                                            Another option is a script, ugly I know :)

                                            
                                            whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'
                                            
                                            

                                            It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.

                                            Say you want to find all the hosts for a domain that does not have an ASN.  Still trying to figure this one out, it's a quick start:

                                            nmap -R -sL 64.98.161.0/24 | grep ting.com
                                            
                                            

                                            Is there any way of doing this in pfBlockerNG?

                                            Thanks
                                            Tony

                                            Pfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.