Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Deny all except a country

    Scheduled Pinned Locked Moved pfBlockerNG
    24 Posts 9 Posters 5.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      Pretty sure you can create your own in pfblocker.. Have to take a look, I don't personally use it... I only fire it up when need to help someone out with something. Give me a few minutes and take a look see.

      edit: Yeah you can create your own using the geoip info.

      specificalias.png

      Or you could take one of the built in lists, and edit it to only have the country or countries you desire.. Just pick the continent one that has the country you want, and only put in there the country or countries you want.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      T 2 Replies Last reply Reply Quote 0
      • S
        SteveITS Galactic Empire
        last edited by

        @johnpoz may have the "devel" version of pfBlockerNG? Mine looks different. Anyway, I found the country lists are all stored on disk so you can just reference them using the correct country code:
        9719f94c-d07c-4c9b-94c6-930fdcea2411-image.png
        So just create an alias for that country code on the pfBlockerNG IPv4 page.

        Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
        When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
        Upvote 👍 helpful posts!

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by

          why would you not be running the devel version? ;)

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • KOMK
            KOM
            last edited by

            Probably because he wants something stable. Most people expect -devel to mean it's under active ongoing development with bugs and other unforeseen, unwanted behaviour to be expected from new software. They don't realize that in the wold of FreeBSD/pfSense/Unix, -devel means it's been tested for the past n+ years, has no outstanding bugs, but the maintainer doesn't want to be yelled at if you find some weird corner case. In other words, don't trust it until it's well-trusted 😆

            1 Reply Last reply Reply Quote 0
            • T
              terainfo @johnpoz
              last edited by

              @johnpoz tks John for your help, sorry my english... i speak portuguese and the way to create and understand phrases and texts are diferent Lol.. I will try and feedback.. tks . Ps: i use last devel version.

              1 Reply Last reply Reply Quote 0
              • T
                terainfo @johnpoz
                last edited by

                @johnpoz Hi, unfortunately doesnt work.. i create an ipv4 entry with brazil inside but in source firewall doenst appers.. only continents
                cap3.PNG cap2.PNG cap1.PNG

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Not sure what your attempting to do there - your not creating an alias.. So no its not going to show up when you try and create a firewall rule - outside of pfblocker

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  T 1 Reply Last reply Reply Quote 0
                  • T
                    terainfo @johnpoz
                    last edited by

                    @johnpoz
                    I'm totally confused

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      Create the alias in pfblocker

                      alias.png

                      Run an update - you will see it create the alias

                      ===[  IPv4 Process  ]=================================================
                      
                      [ US_v4 ]			 Downloading update .. completed ..
                      
                      
                      ===[  Aliastables / Rules  ]==========================================
                      
                      No changes to Firewall rules, skipping Filter Reload
                      
                       Updating: pfB_US_v4
                      1 table created.74833 addresses added.
                      
                       UPDATE PROCESS ENDED [ 08/26/19 19:42:59 ]
                      

                      You will then see it normal pfsense aliases, be able to view what it in it.. And then use it rules
                      firewallalias.png

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      T C 2 Replies Last reply Reply Quote 2
                      • T
                        terainfo @johnpoz
                        last edited by

                        @johnpoz Thank you sou much!!! is clear now!!! have a nice week..

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          It is a very powerful tool that is for sure.. And I love what he has done with the ability to create such aliases - I'm just not a big fan of auto firewall rules of any sort.. So when I have used it, I stick with what I believe is its strongest feature - and that is how easy it is to manipulate the geoip lists into very easy to use aliases..

                          Have fun!

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          T 1 Reply Last reply Reply Quote 0
                          • T
                            terainfo @johnpoz
                            last edited by

                            @johnpoz said in Deny all except a country:

                            It is a very powerful tool that is for sure.. And I love what he has done with the ability to create such aliases - I'm just not a big fan of auto firewall rules of any sort.. So when I have used it, I stick with what I believe is its strongest feature - and that is how easy it is to manipulate the geoip lists into very easy to use aliases..
                            Have fun!

                            It's true, my contact is recent with the tool .. I already loved pfesense, now even more ... thanks once again

                            1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator
                              last edited by johnpoz

                              Keep in mind these lists of IPs are not going to be 100% accurate.. For one IP ranges move from country to country - more often then you would think.. And with the shortage of new IPv4 space - movement happens more often then back in the early days.

                              We just transferred some of our public space to the EU for example.. The blocks of addresses moved from arin to ripe.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              I 1 Reply Last reply Reply Quote 0
                              • I
                                incognito @johnpoz
                                last edited by

                                @johnpoz Hi,
                                Thank you for the above help with creating the alias for certain countries in pfblockerNG.
                                Just 2 questions;
                                To complete the setup. I then go to my pfsense firewall rules and go to WAN. There I edit the open ports I have and under source I just choose alias and chose this list created in pfblocker.
                                Then no more blockrules is needed under the WAN port right? It just allows from the selected countries in the alias and to the specified port of the open service, then blocks the rest automatically if I got it right?

                                I also wanna block some outbound trafic so I just go to the geoblock lists in pfblocker and select all countries I wanna block then hit "deny outbound" ?
                                This will create bunch of entries in my firewall rules each on a single line obv. Is there a way toc reate like a "block outbound to these countries" alias here as well?

                                Last question; what does the "rep" mean after some countrylists?

                                Thanks!

                                S 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  I personally do not let pfblocker create any rules... I just use the aliases created, but you can do whatever makes you feel secure. Im just not an auto create rules sort of guy ;)

                                  Post up the rules you did on both wan and lan and be happy to validate/discuss how they will do what you want or not, etc.

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    SteveITS Galactic Empire @incognito
                                    last edited by

                                    @incognito You can make an alias that covers multiple countries per my post above. Just keep adding lines and country codes.

                                    re: "rep" I have been assuming "reputation" but don't recall how I got to that.

                                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                    Upvote 👍 helpful posts!

                                    BBcan177B 1 Reply Last reply Reply Quote 0
                                    • BBcan177B
                                      BBcan177 Moderator @SteveITS
                                      last edited by

                                      @teamits
                                      rep == represented
                                      https://dev.maxmind.com/geoip/geoip2/whats-new-in-geoip2/

                                      "Experience is something you don't get until just after you need it."

                                      Website: http://pfBlockerNG.com
                                      Twitter: @BBcan177  #pfBlockerNG
                                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        castillo92 @johnpoz
                                        last edited by

                                        @johnpoz said in Deny all except a country:

                                        will then see it normal pfse

                                        Thanks you very much, it is very clear and there are not post that explain it as well

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.