Firewall rules question

[telserv]

I'm just finishing recovering from a firewall hardware failure. That failure caused me to re-read the pfBlockerNG information, which is when I found that rather than block many countries, I should be allowing a few countries. Makes sense.

My objective is to allow some ports from some countries. So how do I configure the rules? Allow countries rules (from pfBlockerNG) and then allow specific port rules below that? Or would that unblock every query from the allowed countries and never get down the rules list, to which ports I want to use?

pfSense 2.7.2 and pfBlockerNG_devel 3.2.0_17

[johnpoz]

@telserv here is how I do it.. For example for my plex

I have some family living in Belgium currently, then some lists of stuff that checks if plex is online, and if not I get an alert. Then allowing US, where the rest of my users are located.

I then use this alias I created in my port forward. So only the IPs in this alias are allowed to my plex.

The plex service that checks if your plex is available remotely sometimes uses IP that are not in the US.. that s3-eu-west list is a list they put out. Same with the other check tools hetrix, status cake and uptimerobot - they check from IPs that are outside the US sometimes.. So I need to allow those specific IPs that are outside my country of the US if I want them to work correctly.

If all your different port forwards are going to allow the same list of IPs you could get away with just the 1 alias and just use the same alias in your port forwards for your different ports.

[ahking19]

@johnpoz correct me if I'm wrong but you use "Alias Native" in pfBlocker to create your country alias lists right? Rather than allowing pfBlocker to automatically create the firewall rules.

@telserv you will also need to create a MaxMind account to download the GeoIP data. There is a link on the pfBlocker GeoIP page.

On the pfBlocker IP setup page you will need to input your MaxMind account info.

[johnpoz]

@ahking19 correct, not a fan of auto rules.. I create my own aliases in pfblocker, and then use them in my rules how I want to use them.

[telserv]

@johnpoz Thank you for the detailed and quick reply! I'm still looking at it to ensure I understand.
@ahking19 I did understand your message, and I created the firewall rules myself, as opposed to auto. Thank you.