PfSense reload pfctl rules

[dre2007]

Afternoon,

I am trying to find out how I can apply my changes to the firewall which I made via SSH.
I made an update to one of my firewall rules and need to apply it now.

I read about the command pfctl -f /etc/pf.conf however this file (pf.conf) doesn't seem to exist in the /etc directory on my pfsense server if I do a ls -l in the /etc directory.

Anyone knows how I can find out which filterrules file is currently loaded so I can change the /etc/pf.conf to the correct path?

Many thanks in advance.

André

[stephenw10]

The generated ruleset is in /tmp/tules.debug:
https://www.netgate.com/docs/pfsense/firewall/firewall-rule-troubleshooting.html#ruleset-loading

But, how did you make the change to the rules from SSH?
I suspect you may lose those changes.

A better option might be to use the easyrule command:
https://www.netgate.com/docs/pfsense/firewall/adding-rules-with-easyrule.html

Steve

[dre2007]

Hi Stephenw10,

Thank you very much for your reply.
will dig into that.

Pehaps I should be more clear, sorry for that.
My purpose is to do the following;
-monitor eventlogs for external logins ( hack attempts ) on a rd gateway server
-Once an IP is hit for more then 10 times in 1 minute automatically setup a putty session and send keystroke with the IP to add the IP to my firewall alias which blocks the bad guy

I was thinking about pfctl -t hackrule and then add the IP.
Once I do a pfctl -t hackrule -T show I noticed the IP but it was not yet loaded and active hence my question in this forum.

Perhaps not the most professional way but I am just wondering how I can apply the new IP in the alias in the fw rule so it is active straight away.
Which command do I need to execute to reload the firewall so the IP is included?

The command "pfctl -f /tmp/rules.debug" didn't do the trick unfortunately.
If I do a pfctl -t hacklog -T show it shows the IP I added.
Once I run pfctl -f /tmp/rules.debug it disappears like I never added it :-(

[stephenw10]

Yes, as you found you can't manually change the ruleset as it will be overwritten by the generated rules the next time there is a filter-reload.

A better option here would be to use a URL alias. When you use that in a firewall rule it will pull in the list from an external source. That way you can maintain that list with a script wherever it exists. You would need to trigger a filter reload to update it though.
https://www.netgate.com/docs/pfsense/firewall/aliases.html#url-alias

You might also do that using the pfBlocker package where you can schedule updates for aliases easily.

Steve

[dre2007]

Thumbs up :-)

Thanks you are helping me out here.
Don't have the time to logon and verify yet but looks prommising.
If I understand correctly, I can host a txt file with several IP / CIDR ranges which it pulls from the internet and uploads itself.
However, how to I trigger the filter reload with, for example, a cron job?
That is my biggest struggle till now.

Thanks again

[stephenw10]

If you use the pfBlocker package you can set the update interval against the custom list.

If you need to trigger the update immediately via a script I believe you can use:
/etc/rc.update_urltables now

Steve

[dre2007]

@stephenw10
I had good hope with your command but it doesn't do the trick.
It doesn't give me an error but once I verify in PfSense if the IP alias has been updated with the new added IP it isn't there.
Could it be that the command should be like /etc/rc.update_iptables now since I am using IP addresses?

Ps.: I tried /etc/rc.update_alias_url_data now but that also doesn't do the trick :-( it is not being updated in the GUI when I check the aliasses so I assume it doesn't update the configuration after adding an IP in the alias

[stephenw10]

When I run that command I see this in the system logs (reversed):

Jul 8 12:30:23 	php-cgi 		rc.update_urltables: /etc/rc.update_urltables: pfB_Spamhaus does not need updating.
Jul 8 12:30:23 	php-cgi 		rc.update_urltables: /etc/rc.update_urltables: pfB_NAmerica_v4 does not need updating.
Jul 8 12:30:23 	php-cgi 		rc.update_urltables: /etc/rc.update_urltables: Starting URL table alias updates
Jul 8 12:30:00 	php-cgi 		rc.update_urltables: /etc/rc.update_urltables: Starting up. 

Those are url aliases added by pfBlocker that point to lists of IPs.
Do you not see that logged for your custom alias?

Steve