Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfblockerng whitelisting

    Scheduled Pinned Locked Moved pfBlockerNG
    32 Posts 3 Posters 29.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      reason
      last edited by

      Using .fqdn, and looking at the dnsbl logs, does not show all domains being white listed. It shows some.  It seems like it is looking at the other lists, and only listing what domains/sub domains are listed in those lists.  But I could be wrong.

      The documentation says to use .domain.tld. so is that different than .fqdn?

      The + icon is only available for ssl connections, right? The ! Is only available on the alerts tab for denied alerts.  There is no plus to white list.

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by

        @reason:

        Using .fqdn, and looking at the dnsbl logs, does not show all domains being white listed. It shows some.  It seems like it is looking at the other lists, and only listing what domains/sub domains are listed in those lists.  But I could be wrong.

        The documentation says to use .domain.tld. so is that different than .fqdn?

        The + icon is only available for ssl connections, right? The ! Is only available on the alerts tab for denied alerts.  There is no plus to white list.

        Sorry about the FQDN things, I was not the right nomenclature. I updated my post. The TLD domains are in /usr/local/pkg/pfblockerng/dnsbl_tld as indicated by the info block icon under Enable TLD.

        Do you have Suppression enabled in the Firewall / pfBlockerNG / General tab?

        Maybe you could post a screenshot of your alerts tab.

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • RonpfSR
          RonpfS
          last edited by

          @Ramosel:

          It's not something I use all the time but I KNOW there used to be links on one of the pfBlockerNG screens to get you to an external lookup for finding AS numbers.  Has that moved?  Been dropped?  I can't find it anywhere…..

          When editing a table under Firewall / pfBlockerNG / Edit / IPV4 tab, click on the blue infoblock icon to the right of List Settings.

          2.4.5-RELEASE-p1 (amd64)
          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

          1 Reply Last reply Reply Quote 0
          • R
            reason
            last edited by

            @RonpfS:

            @Ramosel:

            It's not something I use all the time but I KNOW there used to be links on one of the pfBlockerNG screens to get you to an external lookup for finding AS numbers.  Has that moved?  Been dropped?  I can't find it anywhere…..

            When editing a table under Firewall / pfBlockerNG / Edit / IPV4 tab, click on the blue infoblock icon to the right of List Settings.

            No. I do not have Suppression enabled.

            Do you want a screenshot of the column of alerts that are being denied?

            1 Reply Last reply Reply Quote 0
            • RonpfSR
              RonpfS
              last edited by

              @reason:

              No. I do not have Suppression enabled.

              Do you want a screenshot of the column of alerts that are being denied?

              You quoted the wrong post in your reply  :-[

              Without Suppression enabled, you will not be able to Suppress IPV4 alerts nor to Whitelist DNSBL alerts.
              If you want to know what the icons means, click on the last [img]http://i.imgur.com/Yxodhwt.jpg at the bottom of the Alerts tab.

              If you need help whitelisting, then post a screenshot of the DNSBL alerts tab, not just the column.

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • R
                reason
                last edited by

                @RonpfS:

                @reason:

                No. I do not have Suppression enabled.

                Do you want a screenshot of the column of alerts that are being denied?

                You quoted the wrong post in your reply  :-[

                Without Suppression enabled, you will not be able to Suppress IPV4 alerts nor to Whitelist DNSBL alerts.
                If you want to know what the icons means, click on the last [img]http://i.imgur.com/Yxodhwt.jpg at the bottom of the Alerts tab.

                If you need help whitelisting, then post a screenshot of the DNSBL alerts tab, not just the column.

                Sorry about that :( I clicked the REPLY at the bottom of the message instead of at the top.

                I have enabled Suppression.

                I am noticing that certain items being listed under DENY have I's and +'s while some only have I's.

                I is for information while the +'s are to whitelist.

                I was able to click + next to newegg but some of the others do not allow me to do this.

                Am I meant to enter these other domains under the Custom Domain Whitelist?

                1 Reply Last reply Reply Quote 0
                • RonpfSR
                  RonpfS
                  last edited by

                  @reason:

                  Sorry about that :( I clicked the REPLY at the bottom of the message instead of at the top.

                  You can modify your post  ;)

                  @reason:

                  I have enabled Suppression.

                  I am noticing that certain items being listed under DENY have I's and +'s while some only have I's.

                  I is for information while the +'s are to whitelist.

                  I was able to click + next to newegg but some of the others do not allow me to do this.

                  Am I meant to enter these other domains under the Custom Domain Whitelist?

                  This isn't easy to debug without seeing a screen shot of your Alerts tab.

                  There is a Screen capture tool under Windows / Accessories, or use Alt-PrtScr and crop the picture.

                  If the List is "no match", that means that DNSBL doesn't find it in your tables (maybe the domain is no longer blocked or the list was removed at some point, etc) so it won't allow you to Whitelist it.

                  2.4.5-RELEASE-p1 (amd64)
                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                  1 Reply Last reply Reply Quote 0
                  • R
                    reason
                    last edited by

                    @RonpfS:

                    @reason:

                    Sorry about that :( I clicked the REPLY at the bottom of the message instead of at the top.

                    You can modify your post  ;)

                    @reason:

                    I have enabled Suppression.

                    I am noticing that certain items being listed under DENY have I's and +'s while some only have I's.

                    I is for information while the +'s are to whitelist.

                    I was able to click + next to newegg but some of the others do not allow me to do this.

                    Am I meant to enter these other domains under the Custom Domain Whitelist?

                    This isn't easy to debug without seeing a screen shot of your Alerts tab.

                    There is a Screen capture tool under Windows / Accessories, or use Alt-PrtScr and crop the picture.

                    If the List is "no match", that means that DNSBL doesn't find it in your tables (maybe the domain is no longer blocked or the list was removed at some point, etc) so it won't allow you to Whitelist it.

                    Here is a screenshot.

                    Let me know if this includes the info you are looking for.

                    https://drive.google.com/open?id=0B_lE49yIpBbnSmkxQ2gyS2ZyX28

                    1 Reply Last reply Reply Quote 0
                    • RonpfSR
                      RonpfS
                      last edited by

                      @reason:

                      Here is a screenshot.

                      Let me know if this includes the info you are looking for.

                      I see no picture.

                      2.4.5-RELEASE-p1 (amd64)
                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                      1 Reply Last reply Reply Quote 0
                      • R
                        reason
                        last edited by

                        @RonpfS:

                        @reason:

                        Here is a screenshot.

                        Let me know if this includes the info you are looking for.

                        I see no picture.

                        Try it now. I used the IMG tags and it did not work.

                        But here it is again: https://drive.google.com/open?id=0B_lE49yIpBbnSmkxQ2gyS2ZyX28

                        1 Reply Last reply Reply Quote 0
                        • RonpfSR
                          RonpfS
                          last edited by

                          @reason:

                          @RonpfS:

                          @reason:

                          Here is a screenshot.

                          Let me know if this includes the info you are looking for.

                          I see no picture.

                          Try it now. I used the IMG tags and it did not work.

                          But here it is again: https://drive.google.com/open?id=0B_lE49yIpBbnSmkxQ2gyS2ZyX28

                          You can post images with the + Attachments and other options

                          Did you ran a Force Reload after enabling suppression ?

                          Your screen shot is missing the last column that display the range involved in the block.
                          Also take time to read the in the General Tab under Suppression.

                          2.4.5-RELEASE-p1 (amd64)
                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                          1 Reply Last reply Reply Quote 0
                          • R
                            reason
                            last edited by

                            @RonpfS:

                            @reason:

                            @RonpfS:

                            @reason:

                            Here is a screenshot.

                            Let me know if this includes the info you are looking for.

                            I see no picture.

                            Try it now. I used the IMG tags and it did not work.

                            But here it is again: https://drive.google.com/open?id=0B_lE49yIpBbnSmkxQ2gyS2ZyX28

                            You can post images with the + Attachments and other options

                            Did you ran a Force Reload after enabling suppression ?

                            Your screen shot is missing the last column that display the range involved in the block.
                            Also take time to read the in the General Tab under Suppression.

                            Here is an updated with with more pertinent information.

                            pfblocker.PNG
                            pfblocker.PNG_thumb

                            1 Reply Last reply Reply Quote 0
                            • RonpfSR
                              RonpfS
                              last edited by

                              Well as they are not /24 or /32 block ranges, you will have to whitelist the IPs

                              @Suppression:

                              Alerts can be suppressed using the '+' icon in the Alerts tab and IPs added to the 'pfBlockerNGSuppress' alias. A blocked IP in a CIDR other than /32 or /24 will need a 'Whitelist alias' w/ list action: 'Permit Outbound' Firewall rule

                              If you are using Iblocklist.com URL, maybe you should read iBlocklist.com is either dead or a scam?

                              2.4.5-RELEASE-p1 (amd64)
                              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                              1 Reply Last reply Reply Quote 0
                              • R
                                reason
                                last edited by

                                @RonpfS:

                                Well as they are not /24 or /32 block ranges, you will have to whitelist the IPs

                                @Suppression:

                                Alerts can be suppressed using the '+' icon in the Alerts tab and IPs added to the 'pfBlockerNGSuppress' alias. A blocked IP in a CIDR other than /32 or /24 will need a 'Whitelist alias' w/ list action: 'Permit Outbound' Firewall rule

                                And where do I white list the IP's? I have white listed the domains but that does not seem to be working.

                                newegg, facebook and amazonses are in that screen shot and those items are not being delivered.

                                1 Reply Last reply Reply Quote 0
                                • RonpfSR
                                  RonpfS
                                  last edited by

                                  @reason:

                                  And where do I white list the IP's? I have white listed the domains but that does not seem to be working.

                                  newegg, facebook and amazonses are in that screen shot and those items are not being delivered.

                                  Don't mix IP and Domain name, they have different mode of operation. You query a name server with the Domain name (FQDN) of a host to obtain it's IP.

                                  IPV4 and IPV6 are used with Firewall rules to control access.

                                  DNSBL operate on the Name service to give the VIP instead of the "real" IP of a host.

                                  Again, the answer is already given in the infobox ('Whitelist alias'). Take time to read or use Google translate to bring it to your native language.

                                  2.4.5-RELEASE-p1 (amd64)
                                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    reason
                                    last edited by

                                    @RonpfS:

                                    @reason:

                                    And where do I white list the IP's? I have white listed the domains but that does not seem to be working.

                                    newegg, facebook and amazonses are in that screen shot and those items are not being delivered.

                                    Don't mix IP and Domain name, they have different mode of operation. You query a name server with the Domain name (FQDN) of a host to obtain it's IP.

                                    IPV4 and IPV6 are used with Firewall rules to control access.

                                    DNSBL operate on the Name service to give the VIP instead of the "real" IP of a host.

                                    Again, the answer is already given in the infobox ('Whitelist alias'). Take time to read or use Google translate to bring it to your native language.

                                    So use the IPV4. Create an Alias List. Enter the IP's I want to whitelist on the new IP list?

                                    Where do the IP's get added to the firewall for whilelisting?

                                    Or is it automatically integrated?

                                    I am American and speak English. I just don't speak Firewall Networking so well :)

                                    I want to use pfBlocker but if this is too difficult for me to grasp.

                                    I am also looking at upgrading my zimbra and using spam assassin instead.

                                    But I think I am half way there with pfSense and pfBlocker.

                                    I'm just not getting something.

                                    Also, what "Infobox"?

                                    1 Reply Last reply Reply Quote 0
                                    • RonpfSR
                                      RonpfS
                                      last edited by

                                      The infobox under Suppression ???

                                      1 ) You might use a pfBlockerNG IPV4 table, put the IPs you want to whitelist in the IPv4 Custom list. pfBlockerNG will generate FW rules.

                                      2 ) Use a pfBlockerNG IPV4 table, specify a local file containing the IPs to whitelist.  pfBlockerNG will generate FW rules.

                                      3 ) You could create and Alias with the IPs you want to whitelist and create FW rules to permit access.

                                      For beginners, start with 1) then switch to 3) using similar FW rules as pfBlockerNG created in 1) if you prefer to manage a Firewall Alias.

                                      2.4.5-RELEASE-p1 (amd64)
                                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        reason
                                        last edited by

                                        @RonpfS:

                                        The infobox under Suppression ???

                                        Ah, Infobox is the "I" in a circle. Gotcha. Box and Circle… go figure  :P

                                        1 ) You might use a pfBlockerNG IPV4 table, put the IPs you want to whitelist in the IPv4 Custom list. pfBlockerNG will generate FW rules.

                                        2 ) Use a pfBlockerNG IPV4 table, specify a local file containing the IPs to whitelist.  pfBlockerNG will generate FW rules.

                                        Why would I use a file as opposed to the Custom List in the gui?

                                        3 ) You could create and Alias with the IPs you want to whitelist and create FW rules to permit access.

                                        For beginners, start with 1) then switch to 3) using similar FW rules as pfBlockerNG created in 1) if you prefer to manage a Firewall Alias.

                                        Right now, I would rather not manage a firewall alias. If pfSense/pfBlocker can create and manage, I am fine with that.

                                        Is there a link with how to configure an IPv4 Custom Address whitelist?

                                        1 Reply Last reply Reply Quote 0
                                        • RonpfSR
                                          RonpfS
                                          last edited by

                                          Probably the same link you used to create your Deny Tables, change Deny Both for Allow Outbound (or Allow Both depending on your need).

                                          To input IPs, click on the IPv4 Custom list "+" icon.

                                          Also take time to read again my last posts as I refined the answers while we are speaking.

                                          2.4.5-RELEASE-p1 (amd64)
                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            reason
                                            last edited by

                                            @RonpfS:

                                            Probably the same link you used to create your Deny Tables, change Deny Both for Allow Outbound (or Allow Both depending on your need).

                                            To input IPs, click on the IPv4 Custom list "+" icon.

                                            Also take time to read again my last posts as I refined the answers as we speak.

                                            I meant i'm looking for a tutorial link on how to create these IPv4 Custom IP White lists. This was not included in the initial pfblocker tutorial that I followed (below).

                                            Also, I did not create any Deny Tables. I simply followed the tutorial below. And now integrating this threads information into that setup.

                                            I followed the tutorial below for setting up pfBlocker:
                                            https://forum.pfsense.org/index.php?topic=102470.msg572943#msg572943

                                            Any help or links or information you can relay would be greatly appreciated.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.