IP Block List - Do I need pfBlockerNG to block IP Addresses?

[carrzkiss]

Hello.
PFSense 2.8.1-RELEASE

I have a rule that blocks all IP addresses from a specific list. This list is dynamic and continually grows as hackers attempt to compromise any of our websites.

I have a Firewall Rule set up that uses the list.
However, I just read that it needs to have pfBlockerNG for it to block the IP Addresses properly.

I installed pfBlockerNG and do not see where I am supposed to add the IP Block List.

One last thing.
In the IP Block list section, it has this.

Hint: Enter as many URLs as desired. After saving, the URLs will be downloaded and the items imported into the alias. Use only with small sets of IP addresses (less than 3000).

I have just checked the list, and it contains 3,127 unique IP addresses.

Do I need to split the list to a 3000 list limit?

If that is what needs to be done. How do I add additional lists?
Do I add each new list, separated with a comma?

Thanks.
Wayne

[SteveITS]

@carrzkiss if you have a list you can download via web you can use a URL table alias
https://docs.netgate.com/pfsense/en/latest/firewall/aliases-types.html#alias-types-url
Then just use in a rule.

pfBlocker can set up custom feeds but it’s unnecessary. It has a large list of feeds though which may need their own processing.

[Gertjan]

@carrzkiss said in IP Block List - Do I need pfBlockerNG to block IP Addresses?:

I installed pfBlockerNG and do not see where I am supposed to add the IP Block List.

Go here :

Give it a name.
A description.
Click on the first blue round I marked image for help with the 'name' and description.
Click on the second blue round I marked image for help. This one tells you you can use a local file, on the pfSense file system, your own file with IPs.

Take a look at the rest of the settings. You can select how and where this list should be used.

[Uglybrian]

If you choose to use steveITS way, note you need to change the URL type to (table).

An example.

[johnpoz]

I use pfblocker for alias management.. While I do have some other just native aliases. I use pfblocker functionality to manage more complex lists.

Example - here is my scan deny alias, which contains some asn's and lists from different locations that scan for open ports like shodan, etc..

And use another list for stuff that need to allow, that might be blocked by list like scan deny - this list contains country based IP lists, and other lists provided by services like plex and monitoring to know if service is up, etc. Which I use to alert me if something goes down.

I don't really use any of the other features of pfblocker - but I do love its easy management of just native aliases.

You can also easy add just 1 off networks/ips etc.. to your alias you create in the bottom custom section

When bored or whatever I take a look at my firewall log - and notice something scanning but not in my scan deny list, I will look up the details and normally block the whole netblock, etc.