PfBlockerNG

BBcan177 · Sep 16, 2015, 4:12 AM

Unfortunately BGP has blocked access to "non-humans".

In the interim, I have posted some of these [ Domain -> IPs ] lists. I will try to keep them updated as time permits.

Please use the "html" format:

Facebook
https://gist.githubusercontent.com/BBcan177/fb389885e4fb39508bcc/raw
Twitter
https://gist.githubusercontent.com/BBcan177/0caa6ae9badee2206660/raw
Spotify
https://gist.githubusercontent.com/BBcan177/58ae5e02838cea68de25/raw
Netflix
https://gist.githubusercontent.com/BBcan177/419897fb723a24323f1f/raw
Dropbox
https://gist.githubusercontent.com/BBcan177/3ddcf1ef916f70b9bc26/raw

Also posted are two feeds which I have collected from recent Security Blogs etc:
MS_1
https://gist.githubusercontent.com/BBcan177/bf29d47ea04391cb3eb0/raw
MS_3
https://gist.githubusercontent.com/BBcan177/4a8bf37c131be4803cb2/raw

heliop100 · Sep 30, 2015, 10:19 PM

Hi

First very thanks to BBcan177 for the package.

These IP list are a strange world

The list: http://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=p2p&archiveformat=gz

are blocking that: http://www.reputationauthority.org/toptens.php

Cheers.

BBcan177 · Sep 30, 2015, 10:55 PM

@heliop100:

Hi

First very thanks to BBcan177 for the package.

These IP list are a strange world

The list: http://list.iblocklist.com/?list=llvtlsjyoyiczbkjsxpf&fileformat=p2p&archiveformat=gz

are blocking that: http://www.reputationauthority.org/toptens.php

Cheers.

I am not a big fan of IBlock lists… They tend to have a lot of False positives... You can always send them a FP report.

heliop100 · Oct 1, 2015, 11:09 PM

Hi,

Are there some way to backup/restore pfbloquerNG settings (or IPV4/IPV6 lists) from one pfsense to another?

I use "pfBlockerNG_import.php" and made some changes, on a lab box. Will be nice to export that to the production one.

Thanks.

doktornotor · Oct 2, 2015, 2:54 AM

You mean, like… the invisible Sync tab?

brandur · Oct 2, 2015, 11:53 AM

Hi
I'm new around here(with pfSense and pfBlockerNG), so please be gentle ;)
First of all. What a great package. You did a awesome job.

Back to my question. I was wondering if there are any plans to support this AmazonAWS json IP list https://ip-ranges.amazonaws.com/ip-ranges.json ?

Some extra info: http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
Thank you.

heliop100 · Oct 2, 2015, 1:22 PM

@doktornotor:

You mean, like… the invisible Sync tab?

Hi,

My lab are at home one WAN one LAN, production at work, two WANs one LAN.
May I sync anyway?

Thanks.

heliop100 · Oct 2, 2015, 1:50 PM

May I copy the from xml backup file from one box to another?

Thanks.

BBcan177 · Oct 2, 2015, 1:50 PM

@brandur:

I was wondering if there are any plans to support this AmazonAWS json IP list https://ip-ranges.amazonaws.com/ip-ranges.json ?

Some extra info: http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

You can scrape the IPs from that URL or any other URL using the "html" format. However, it won't be able to distinguish the different Amazon subsets. So it will pool them all together which you could use to "Permit, Match or Block/Reject"

BBcan177 · Oct 2, 2015, 1:57 PM

@heliop100:

My lab are at home one WAN one LAN, production at work, two WANs one LAN.
May I sync anyway?

You can sync any pfSense Boxes whether remote or local.

And yes you can copy / paste with the config.xml but please ensure you backup as you can crash it with an improperly formatted file.

If you do modify a config.xml from the shell, you can delete the cache file to get those changes to take effect

rm /tmp/config.cache

Fesoj · Oct 5, 2015, 3:50 PM

I have a comprehension question. Is pfBlockerNG supposed to block any traffic? I added a single IP to my IPv4 list and I can still access the web site with this particular IP. Maybe I should say that Squid is also running.

BBcan177 · Oct 5, 2015, 4:10 PM

@Fesoj:

I have a comprehension question. Is pfBlockerNG supposed to block any traffic? I added a single IP to my IPv4 list and I can still access the web site with this particular IP. Maybe I should say that Squid is also running.

Well its kind of what the name of the package implies :)
So to answer your question, yes the package can create firewall rules to "Block/Reject/Permit/Match"…

Need more info on how you have configured it to help you further.

heliop100 · Oct 5, 2015, 4:50 PM

I'm using Alienvault List and blocking outside traffic to Russia, China and North Korea.

Access to www.tcpiputils.com (148.251.153.34 - Germany (DE) - not listed on AlienVault) are blocked, but not on alerts or firewall logs.

If I reset states, it opens for a few seconds and blocks again, disabling pfBlockerNG resolve that issue.

Any idea?

Thanks.

BBcan177 · Oct 5, 2015, 4:59 PM

@heliop100:

I'm using Allienvault List and blocking outside traffic to Russia, China and North Korea.

Access to www.tcpiputils.com (148.251.153.34 - Germany (DE) - not listed on AllienVault) are blocked, but not on alerts or firewall logs.

If I reset states, it opens for a few seconds and blocks again, disabling pfBlockerNG resolve that issue.

Any idea?

Thanks.

Alienvault doesn't have that IP listed.. But run this command below to see if any other list has that included…

grep -h "^148.251." /var/db/pfblockerng/deny/ | grep '/'*

Alienvault.txt:148.251.195.0/24
Alienvault.txt:148.251.88.0/24

edit: added the -h flag to skip the filename/path

heliop100 · Oct 5, 2015, 5:14 PM

Hi, thanks for your quick answer,

The command gets the same of yours:

grep -h "^148.251." /var/db/pfblockerng/deny/* | grep '/'
148.251.195.0/24
148.251.88.0/24

BBcan177 · Oct 5, 2015, 5:17 PM

@heliop100:

Hi, thanks for your quick answer,

The command gets the same of yours:

grep -h "^148.251." /var/db/pfblockerng/deny/* | grep '/'
148.251.195.0/24
148.251.88.0/24

Run the following commands to report all IPs listed in the 148.0.0.0 range…

cd /var/db/pfblockerng/deny
grep "^148\." * | grep '/'

heliop100 · Oct 6, 2015, 4:38 PM

Hi

grep "^148." * | grep '/'

Alienvault.txt:148.251.195.0/24
Alienvault.txt:148.251.88.0/24

(But I have disable/enable pfBlockerNG with keep settings cleared, and now are not blocking tcpiputils anymore)

Thanks.

BBcan177 · Oct 6, 2015, 6:31 PM

@heliop100:

Hi

grep "^148." * | grep '/'

Alienvault.txt:148.251.195.0/24
Alienvault.txt:148.251.88.0/24

(But I have disable/enable pfBlockerNG with keep settings cleared, and now are not blocking tcpiputils anymore)

Thanks.

pfBNG will only block what you configure it to block…

What does this command report:

host -t A tcpiputils.com

Maybe tcpiputils.com resolves to a different address for you?

All blocked IPs should be reported in the Alerts Tab.

You can also try:
Instead of completely disabling pfBNG, goto the LAN interface and toggle the Icon at the left for each pfBNG Rule one at a time to see which Rule is causing the block for you. Then go from there.

heliop100 · Oct 6, 2015, 6:38 PM

Hi,

$ host -t A tcpiputils.com
tcpiputils.com has address 148.251.153.34

Will try your suggestion:

Instead of completely disabling pfBNG, goto the LAN interface and toggle the Icon at the left for each pfBNG Rule one at a time to see which Rule is causing the block for you. Then go from there.

Thanks.

BBcan177 · Oct 6, 2015, 6:43 PM

As a note, Germany is listed in the TOP20 List… Did you by any chance select all of the TOP20 to block? If so... This is why its blocked...

You can also create a pfBNG alias "Permit Outbound" and add the IPs that you want to bypass the Blocking rules to the "Custom list" at the bottom... Then set the Rules order to have this permit Rule above the Block/Reject rules...