Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfBlocker

    Scheduled Pinned Locked Moved pfSense Packages
    896 Posts 143 Posters 1.4m Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Have a look here

      https://forum.pfsense.org/index.php?topic=42543.msg439552#msg439552

      1 Reply Last reply Reply Quote 0
      • D
        dstroot
        last edited by

        Aha - thanks!  I found an older version of the work here: https://github.com/BBcan177/pf-IPrep

        Hope this is progressing well!  I'd love to just install and configure a package rather all the manual steps…  ;D

        1 Reply Last reply Reply Quote 0
        • W
          wcrowder
          last edited by

          :)  ;D  :-*…. > :-X

          @dstroot:

          Aha - thanks!  I found an older version of the work here: https://github.com/BBcan177/pf-IPrep

          Hope this is progressing well!  I'd love to just install and configure a package rather all the manual steps…  ;D

          1 Reply Last reply Reply Quote 0
          • BBcan177B
            BBcan177 Moderator
            last edited by

            @dstroot:

            Hope this is progressing well!  I'd love to just install and configure a package rather all the manual steps…  ;D

            Where is the fun in that! ? Lol..

            The version you refered to is my shell script. If you want to step into the wild side and try my pfBlockerNG package shoot me a PM.

            "Experience is something you don't get until just after you need it."

            Website: http://pfBlockerNG.com
            Twitter: @BBcan177  #pfBlockerNG
            Reddit: https://www.reddit.com/r/pfBlockerNG/new/

            1 Reply Last reply Reply Quote 0
            • S
              samline
              last edited by

              I am trying to upload a local .txt IP blocklist to pfBlocker. What is the correct file address location to use?

              C:\Users\my user\Desktop\ipblocklist.txt  (example) does not work.

              Thanks.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                'Local file' means local to the pfSense box. Upload the file and then fill in the path. If you use the file upload facility in Diagnostics in the webgui it will be in /tmp.

                Steve

                1 Reply Last reply Reply Quote 0
                • A
                  ashes00
                  last edited by

                  @LinuxTracker:

                  @LinuxTracker:

                  Came across a new list of malware IPs

                  http://labs.alienvault.com/labs/index.php/projects/open-source-ip-reputation-portal/download-ip-reputation-database/

                  Looks like either the gzip ver or the plain ver - of the Generic Format - would load fine in pfBlocker.

                  Haven't tried it yet - will give it a go tonight and post back how it loads.

                  Here's my report back on the AlienVault IP Reputation list.
                  I had it block matching http/https outbound - and block matching * inbound.

                  The list is big, over 300k IPs.

                  The text version is 17MB and it added nearly a minute to my filter reload time (3Ghz PentiumD, 4GB).

                  I tried the gzip version and found it much smaller and faster.  I had no noticeable difference in filter reload times.

                  After running the list for a most of a week, I had 2 false positives.  That's not bad.

                  One was a big web host that AlienVault listed over a year ago (for serious malware distribution).
                  The IP was cleaned immediately so AlienVault must not delist IPs automatically.
                  The other false positive was a Tor directory server.

                  Conclusion:
                  Given the big database (and no auto-delisting) I'd say AlienVault has a really low false positive rate.
                  My opinion is that it's worth trying - providing you log any hits on it.

                  LinuxTracker - Sorry to bring up this 2 year old post, but I was wondering how things were going with the AlienVault IP Reputation Database (Generic), and its use as a pfBlocker list source.  I see the generic list is near 114K IPs as of 11/17/14.  I am interested in using this in pfBlocker.  Where you able to just add in the .gz url, and it work automatically like other pfBlocker lists, or did you have to massage the data?  Any other information you might have on this is greatly appreciated.  Have a great day.

                  Ash,

                  1 Reply Last reply Reply Quote 0
                  • S
                    Supermule Banned
                    last edited by

                    I suggest you get intouch with BBcan17 and talk to him about pfblockerNG as a replacement.

                    I run it here in test mode and besides some small issues, then it works like a charm!

                    1 Reply Last reply Reply Quote 0
                    • W
                      Wolf666
                      last edited by

                      @Supermule:

                      I suggest you get intouch with BBcan17 and talk to him about pfblockerNG as a replacement.

                      I run it here in test mode and besides some small issues, then it works like a charm!

                      it is!

                      Been testing pfblockerNG and it's a real step forward.

                      Modem Draytek Vigor 130
                      pfSense 2.4 Supermicro A1SRi-2558 - 8GB ECC RAM - Intel S3500 SSD 80GB - M350 Case
                      Switch Cisco SG350-10
                      AP Netgear R7000 (Stock FW)
                      HTPC Intel NUC5i3RYH
                      NAS Synology DS1515+
                      NAS Synology DS213+

                      1 Reply Last reply Reply Quote 0
                      • jdillardJ
                        jdillard
                        last edited by

                        There is now a pfBlockerNG package that replaces pfBlocker, so I am locking this thread.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.