PfBlockerNG
-
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
Tony -
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
TonyPfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.
-
pfBlockerNG v1.10 - Pull Request has been posted -
Changelog:
https://github.com/pfsense/pfsense-packages/pull/1033
**Pull request has been merged. Following this update, please execute a "Force Reload".Thanks!**
-
a small bug: After a pfBlockerNG upgrade, All the rules prior to original pfBlokerNG rules were put at the bottom in the floating rules page. I have to move them to the top.
-
@Music:
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
TonyPfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.
Not trying to block, want to allow any host for a domain :) I have been beta testing 2.0, at the moment have not seen any way to do via the GUI
Thanks
Tony -
If you are trying to suppress a domain, you can click the "+" icon in the Alerts Tab which will remove the domain instantly and not allow that domain to be added again. You can also add a domain to the "DNSBL" suppression list box but that will only take effect when the feeds are downloaded again or on a "Force Reload".
-
@Music:
Just a quick FYI if anyone needs to know how to pull IP lists from BGP ASN. One option is to use bgp.he.net and create an Alias match rules under IPv4 or IPv6
http://bgp.he.net/search?search%5Bsearch%5D=facebook&comAnother option is a script, ugly I know :)
whois -h whois.radb.net -- -i origin -T route AS$(whois -h v4.whois.cymru.com " -v $(host www.facebook.com | grep "has address" | awk '{print $4}')" | grep -v AS | awk '{print $1}') | grep route: | awk '{print $2}'It gets the IP for the host, finds the ASN then looks up the routes for the ASN, can pipe it to a text file and create and Alias from it.
Say you want to find all the hosts for a domain that does not have an ASN. Still trying to figure this one out, it's a quick start:
nmap -R -sL 64.98.161.0/24 | grep ting.comIs there any way of doing this in pfBlockerNG?
Thanks
TonyPfblockerng 2.0 will have dnsbl so you can just add www.facebook.com and facebook.com to a list. Or you can block those domains via dns resolver if its only a few.
Not trying to block, want to allow any host for a domain :) I have been beta testing 2.0, at the moment have not seen any way to do via the GUI
Thanks
TonyI found what I was looking for :) https://hackertarget.com/find-dns-host-records/ using the api can create a list of all the hosts for a domain and get a formated lists!
http://api.hackertarget.com/hostsearch/?q=ting.comFound two more useful tools for dns enumeration:
-
https://github.com/TheRook/subbrute
-
https://github.com/darkoperator/dnsrecon
-
-
I am currently blocking Asia and have hired a developer in India. How can I exclude his subnet and still have the rest of India blocked.
I have India( CTRL + CLICK to unselect countries) at the moment so he has access. -
@scott@hosiermail.com:
I am currently blocking Asia and have hired a developer in India. How can I exclude his subnet and still have the rest of India blocked.
I have India( CTRL + CLICK to unselect countries) at the moment so he has access.Just create a new floating rule and add his subnet as the source for incoming traffic for your WAN interface.
Tony
-
HI,
I have found that if I'm using RAMDisk, After a pfSense start/restart, the pfBlockerNG Alerts page list 'No match' on all alerts until I manually do a force update. I thought the lists should be all loaded after a root/start. Obviously it didn't when using RAMDisk. No issue when not using RAM Disk. This is annoying. Am I missing something?
-
HI,
I have found that if I'm using RAMDisk, After a pfSense start/restart, the pfBlockerNG Alerts page list 'No match' on all alerts until I manually do a force update. I thought the lists should be all loaded after a root/start. Obviously it didn't when using RAMDisk. No issue when not using RAM Disk. This is annoying. Am I missing something?
Well this is the issue with RamDisk installations… On a reboot the /var folder is wiped out… That would include any other packages that store data there...
I have added a workaround to copy the final "/var/db/aliastables/pfB_*" files… and restore those after a reboot so that the tables and firewall rules don't have any issues...
However, the rest of the files are gone, and the only way to recover is with a "Force Reload" or wait for the next Cron task to execute. The issue with a RamDisk is always size, so Its not appropriate to try and archive all the files and restore them... Not to mention that any time Cron ran, or you used a "Force" command, it would archive the files and take some time (I assume) depending on how many Lists you use... Whats the benefit to use a Ramdisk anyways?
-
HI,
I have found that if I'm using RAMDisk, After a pfSense start/restart, the pfBlockerNG Alerts page list 'No match' on all alerts until I manually do a force update. I thought the lists should be all loaded after a root/start. Obviously it didn't when using RAMDisk. No issue when not using RAM Disk. This is annoying. Am I missing something?
Well this is the issue with RamDisk installations… On a reboot the /var folder is wiped out… That would include any other packages that store data there...
I have added a workaround to copy the final "/var/db/aliastables/pfB_*" files… and restore those after a reboot so that the tables and firewall rules don't have any issues...
However, the rest of the files are gone, and the only way to recover is with a "Force Reload" or wait for the next Cron task to execute. The issue with a RamDisk is always size, so Its not appropriate to try and archive all the files and restore them... Not to mention that any time Cron ran, or you used a "Force" command, it would archive the files and take some time (I assume) depending on how many Lists you use... Whats the benefit to use a Ramdisk anyways?
Thanks for the clarification. My pfSense box is using SSD, and 16GB RAM, lots of memory, so I thought why not use RAM Disk.
-
Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .Or is the only way to solve this, to create floating rules ?
-
If you need a particular sorting, then use one of the Alias actions and create the rules manually, instead of using Block/Reject.
-
@The:
Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .Or is the only way to solve this, to create floating rules ?
Did you try to change the "Rule Order" in the General Tab? Otherwise for more complicated setups, you will need to use "Alias" type rules as Dok indicated.
-
@The:
Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .Or is the only way to solve this, to create floating rules ?
Just to be sure what i'am trying to reach:
This is the standard setting:
I changed this otherwise G-mail / e-mail wont arrive on the Zimbra server i run:
after for example 1 hour everything is the same as the standard setting en e-mail stop's arriving .
What to do ?
Create some floating rules (as i read in the Wiki)
create some alias as you replied ? -
@The:
Could somebody help me, i'am using a few firewall rules and set them in the wat they work correctely.
After for example 1 hour everything is set again to the default alphabeticly
Whats wrong /or what i'am doing wrong .Or is the only way to solve this, to create floating rules ?
Did you try to change the "Rule Order" in the General Tab? Otherwise for more complicated setups, you will need to use "Alias" type rules as Dok indicated.
I change this rules order using: firewall -> rules
-
Why the hell are you blocking the entire world? Please, read this thread on the implicit "default deny" rule on WAN and general sane usage notes.
-
@The:
What to do ?
Create some floating rules (as i read in the Wiki)
create some alias as you replied ?In v1.10 I added some additional text to the TOP20 tab to help with this issue. (See Note:)
Instead of blocking the world, you can change all of the "Deny" rule(s) to be a single "Permit Inbound" Rule…
For example: It seems like you want to allow South America only to hit your Zimbra mail server, follow the instructions below: ( BTW: Big fan of Zimbra!! )
-
Remove all of your existing Country Blocking Rules.
-
Remove all of your existing "Pass" Firewall rules for Zimbra.
You could also just disable these pass rules and keep them there as a backup, if pfBNG is disabled for any reason. -
Goto "South America" Country Tab.
-
Select the IPv4/6 Countries that you want to allow access.
-
List Action: "Permit Inbound"
-
In "Advanced Inbound Firewall Rule Settings":
-
Enable the Custom Port checkbox
Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_Ports" (Change the alias name to what ever you wish), and enter all of the Mail ports in the alias.
-
Enable Custom Destination checkbox
Click the link "Click here to add/edit Aliases" and add a new pfSense Alias called "Mail_IPs"
(Change the alias name to what ever you wish), and enter all of the Mail Destination IPs (ie: the 192.x.x.x address from your screenshot above) -
Custom Protocol: Select "TCP/UDP" (Or as required)
-
Hope that helps!
-
-
Why the hell are you blocking the entire world? Please, read this thread on the implicit "default deny" rule on WAN and general sane usage notes.
Just to be sure ;-)
I followed soms YouTube configuration instructions that told me to configure it this wat
Yesterday i start reading this topic, stopped at page 20, but at this moment there's nothing about the default een rule :( or maybe i was to tired to find it ?
