• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

PfBlockerNG

Scheduled Pinned Locked Moved pfBlockerNG
1.2k Posts 210 Posters 1.9m Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • P
    pdrass
    last edited by Nov 1, 2015, 2:47 PM

    Dougc420 I suspect you're making a "firewall rule" rather than an allow rule inside pfblockerNG's IPv4 list.

    I made a similar mistake.  In the config on pfblockerNG you can give it an order, if you select the default which is pfblocker > then firewall I think > then something else (there are 3 from memory) then this is the default behavior if you make a firewall rule.

    What you need to do is go into the pfblockerNG IPv4 list > make a new list > in that list at the bottom you can put your IP's / networks you want to allow.  Unfortunately if it's a country, you'll need to dig up the country list online (I think pfblockerNG uses maxmind).  Copy > paste all those networks into the list > enable it and make sure it says allow both inbound and outbound (both).

    Then it will work.  With the default config you can't simply make a firewall rule and expect it to work.

    I LOVE LOVE LOVE pfblockerNG, it's the best plugin for pfsense.  I want to buy a T-Shirt if there is one :-)

    1 Reply Last reply Reply Quote 0
    • P
      pdrass
      last edited by Nov 1, 2015, 2:51 PM

      @BBcan177:

      @pdrass:

      So…in the package maintainers view, how many entries would they recommend stopping at?  With that; how many separate lists can I make for example, are multiple smaller lists more efficient than 1 large one and then another large one?

      I have never really tested how many IPs can be saved into the Custom List, but I would assume you could put several thousand (or more) .. Not really recommended…

      What fragged has said is appropriate, use the URL Localfile option to read larger lists...

      But if your custom list is a few hundred, then thats fine...

      I want to block about 684 million IP's with the iphol.org block list.  So; there will be a few in there :P

      Looks like I might have to try it for giggles and see how it goes then report back!

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by Nov 1, 2015, 3:29 PM

        Dude. That 'Custom List' shit is saved in config.xml… Breaking that won't be much of a giggle. Make a backup before trying.

        1 Reply Last reply Reply Quote 0
        • P
          pdrass
          last edited by Nov 1, 2015, 5:09 PM

          I always backup, good suggestion.

          So this is what I found when updating and trying this out:

          "table-entries hard limit  2000000
          Table Usage Count        540340"

          So out of all my lists including the custom one I rolled form firehol because I took out the private IP's and the 0.0.0.0/8 I've got 540,340 entries in a table that can take 2 million!

          So the answer to how many you can pile in the pfblockerNG list seems to be 2 million entries.

          I managed to do some magic on my other server to curl down the firehol github list then edit out the afore mentioned private IP's.  I then shared it out on my wiki (that's protected to only let certain hosts look at it) and told it that it was a txt with a URL and boom…works like a charm, updates every 8 hours.

          1 Reply Last reply Reply Quote 0
          • N
            nug
            last edited by Nov 5, 2015, 1:28 AM

            Hey guys, just wondering if something is wrong or if this is supposed to happen.

            I'm using 5 of the aliases from BBcan's import script.  I'm denying incoming (3 selected ports) and all outgoing using floating rules.

            After a few days I have thousands of packets listed against a couple of the aliases and hundreds against the others.  However in my firewall logs I only have 7 events (all outgoing).

            All floating rules are set to log and the global logging setting in PFblocker is set to on as well.

            I realise I only want limited firewall events to be able to sift through easily but I would have thought there would be a few more?

            1 Reply Last reply Reply Quote 0
            • A
              Arglex1
              last edited by Nov 10, 2015, 4:53 PM

              @doktornotor:

              @doug.claxton:

              Hello guys, I am looking for some insight as to what the heck I am doing wrong here.
              I have rules.
              I have pfblockerNG.
              I need a rule above the block rules so I move it on top.

              Everything is fine until CRON runs then it moves my rule below the pfblockerNG rules.

              I would suggest to have a look at 'Rule Order' at the 'General' tab and think about it for a while…

              unfortunately, The rule order is not very helpful.  For example, I have a mail filter that I want to allow all inbound traffic.  On another vlan I have a web server that I want pfblocker to block all the inbound traffic to.  None of the "rule order" allow for that to happen.  I need to custom sort my rules.  If it reloads the order, It blocks inbound legit email.

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by Nov 10, 2015, 5:01 PM

                Yeah, so if you need to custom sort your rules, then use the aliases. The package unfortunately lacks artificial intelligence to recognize what custom order your need.

                1 Reply Last reply Reply Quote 0
                • S
                  shopro
                  last edited by Nov 11, 2015, 7:53 AM

                  Is there any ETA on the pfBlockerNg 2.0? Very interested in the possible ad blocking feature.

                  1 Reply Last reply Reply Quote 0
                  • D
                    doktornotor Banned
                    last edited by Nov 11, 2015, 8:02 AM

                    Well I think it's almost done.

                    1 Reply Last reply Reply Quote 0
                    • T
                      trinidadrancheria
                      last edited by Nov 11, 2015, 9:03 PM

                      @doktornotor:

                      Yeah, so if you need to custom sort your rules, then use the aliases. The package unfortunately lacks artificial intelligence to recognize what custom order your need.

                      +1 on this. Works Great!

                      1 Reply Last reply Reply Quote 0
                      • J
                        JasonJoel
                        last edited by Nov 15, 2015, 9:20 PM Nov 15, 2015, 6:02 PM

                        I'm also looking forward to 2.0… There is a definite need here.

                        1. SquidGuard kills my Squid3 for some reason (<-- Edit, I actually got this working, which is nice).
                        2. DansGuardian is broken/repricated
                        3. E2Guardian is problematic, even when manually installed

                        However, my pfBlockerNG works perfectly... Just want more. :)

                        Jason Bottjen

                        1 Reply Last reply Reply Quote 0
                        • B
                          BBcan177 Moderator
                          last edited by Nov 15, 2015, 10:52 PM

                          Here is an update on pfBlockerNG v2.0 w/DNSBL

                          https://forum.pfsense.org/index.php?topic=102470.0

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • T
                            tonymorella
                            last edited by Nov 21, 2015, 2:18 AM

                            @Arglex1:

                            @doktornotor:

                            @doug.claxton:

                            Hello guys, I am looking for some insight as to what the heck I am doing wrong here.
                            I have rules.
                            I have pfblockerNG.
                            I need a rule above the block rules so I move it on top.

                            Everything is fine until CRON runs then it moves my rule below the pfblockerNG rules.

                            I would suggest to have a look at 'Rule Order' at the 'General' tab and think about it for a while…

                            unfortunately, The rule order is not very helpful.  For example, I have a mail filter that I want to allow all inbound traffic.  On another vlan I have a web server that I want pfblocker to block all the inbound traffic to.  None of the "rule order" allow for that to happen.  I need to custom sort my rules.  If it reloads the order, It blocks inbound legit email.

                            Change pfb rules to aliases and you can put them in any order you want

                            1 Reply Last reply Reply Quote 0
                            • C
                              csircc
                              last edited by Nov 24, 2015, 8:16 AM

                              Hello, everyone i have one problem. i have installed pfblockerNG and setup  IPv4 Alias/List Configuration to create  IPv4 Lists (example source: http://list.iblocklist.com/?list=xshktygkujudfnjfioro&fileformat=p2p&archiveformat=gz).But this rule block the important website (like Hotmail or other website). i don't want to delete this list. i have any other method?(like whitelist but i don't know how to do).

                              1 Reply Last reply Reply Quote 0
                              • H
                                Hugovsky
                                last edited by Nov 24, 2015, 1:29 PM

                                pfBlockerNG is now version 2. You should go here: https://forum.pfsense.org/index.php?topic=102470.0

                                1 Reply Last reply Reply Quote 0
                                • SoloamS
                                  Soloam
                                  last edited by Nov 26, 2015, 11:41 AM

                                  Somtimes the reporting of the Alerts misses the list matching! I had this problem today.

                                  List 1 - Alias_Deny (De-Duplication enabled)
                                  List 2 - Alias_Native

                                  Interface 1
                                  Block List 1

                                  The IP1 is in both lists, because Alias_Native does not passes by the De-Duplication process.

                                  I had a hit on Interface 1 of IP1 and in the alert tab appeared the information that the hit is from List 2 (that does not even appears on the Interface)

                                  Thank You all

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    rantech
                                    last edited by Dec 6, 2015, 6:25 AM

                                    Apologies as I'm new at this and I've read this full thread but am still not quite clear on the following …

                                    I have created Deny Outbound rules on my interfaces (auto-rules) with no problems.  Now I want to create rules to restrict inbound access to open ports. I understand I can do this a couple of ways (1) block country access to an alias containing the open ports, or (2) I could create a "permit inbound" rule with whitelisted countries to specific ports and destination IPs (and drop the normal PFsense NAT rules which currently allow anyone to access open ports).

                                    However, I can't quite figure out how to physically implement either of these options.  When I try to create the permit inbound rule (for example, with selected countries in North America), it creates the inbound rule but my prior deny outbound rule disappears. It seems that when I change my selections in pfB and save, it overwrites and replaces any prior rules created.  I figure it must be something simple I'm doing wrong but I don't know what and can't seem to be able to create multiple different rules based on the same country list (with perhaps different selected countries from that list, for each of the rules)?

                                    The only way I can almost do what I want is if I create all my rules as "Deny Both" and then in the advanced inbound rules, I list the alias for the open ports and the protocol(s).  This has two problems though: I think I'm better to permit a small number of countries in rather than block a huge number of countries; and, I want fewer countries allowed in than I want to be able to go to on the outbound (I visit websites countries that have no need to access open ports). Doing it this way, the same country list is used both outbound and inbound.

                                    Thanks

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      BBcan177 Moderator
                                      last edited by Dec 6, 2015, 7:12 PM

                                      @rantech:

                                      However, I can't quite figure out how to physically implement either of these options.

                                      Hi rantech,

                                      If you want to customize the rules, create a new Alias and in the "Source" field, add each of the Countries that you want to include in the Alias. Then manually create rules in the Firewall that references this Alias.

                                      Please see the following links:
                                      https://forum.pfsense.org/index.php?topic=102071.0
                                      https://forum.pfsense.org/index.php?topic=86212.msg548324#msg548324
                                      https://forum.pfsense.org/index.php?topic=86212.msg553921#msg553921

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        rantech
                                        last edited by Dec 7, 2015, 5:06 AM

                                        Is it possible to create two different alias from the same country list, one for inbound and a different one for outbound? Both that are logged and updated by pfB?

                                        I think I would create the first alias and change the name and then create the second alias ?

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          BBcan177 Moderator
                                          last edited by Dec 7, 2015, 5:11 AM

                                          Just create one pfBNG alias 'Alias Native' type and add the Countries. You can create as many rules based on this one alias.

                                          "Experience is something you don't get until just after you need it."

                                          Website: http://pfBlockerNG.com
                                          Twitter: @BBcan177  #pfBlockerNG
                                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received