Blocking Misc IP
-
I would like to setup a rule that would allow me to enter Misc IP to be blocked.
ie: I don't want to block all the United States, just Misc IP's that are attempting to hack my Mail server
how can that be done -
Create an alias (HACKERS) with the ip addresses of the server(s) that you want to block.
The place a BLOCK rule on the WAN interface with Source HACKERS and destination Any. You might as well make the protocol and ports any as well.
Does this https://forum.pfsense.org/index.php?topic=126866.msg701462#msg701462 help any? I'm still working on it, but my hope is to make it easier for new users (and myself) to figure out these rules. It is much easier with a visual representation.
Hope that helps.
-
Do you know all of the IP addresses that you want to block?
If not then setting up suricata or snort on your mail servers interface is probably what you need.
-
Creating a custom list of one-off IP addresses is going to leave you with a list of millions of changing IP addresses.
-
such a endeavor is playing wack-a-mole.. completely pointless.. If you want block bad countries that you will never get email from ok.. But trying to block an IP after the fact after you see them in your logs is a battle you can never win.
If you want to block countries – grab their netblocks and put them into your own aliases or just use the pfblocker aliases it has out of the box for countries..
But if you want to really play wack-a-mole.. Create a rule on the top of your wan interface for block. With dest of your wan address and or the smtp port. And for the source use an alias and start adding your IPs you want block to the alias..
