PfBlocker

stephenw10

Have a look here

https://forum.pfsense.org/index.php?topic=42543.msg439552#msg439552

dstroot

Aha - thanks! I found an older version of the work here: https://github.com/BBcan177/pf-IPrep

Hope this is progressing well! I'd love to just install and configure a package rather all the manual steps… ;D

wcrowder

:) ;D :-*…. > :-X

@dstroot:

Aha - thanks! I found an older version of the work here: https://github.com/BBcan177/pf-IPrep

Hope this is progressing well! I'd love to just install and configure a package rather all the manual steps… ;D

BBcan177

@dstroot:

Hope this is progressing well! I'd love to just install and configure a package rather all the manual steps… ;D

Where is the fun in that! ? Lol..

The version you refered to is my shell script. If you want to step into the wild side and try my pfBlockerNG package shoot me a PM.

samline

I am trying to upload a local .txt IP blocklist to pfBlocker. What is the correct file address location to use?

C:\Users\my user\Desktop\ipblocklist.txt (example) does not work.

Thanks.

stephenw10

'Local file' means local to the pfSense box. Upload the file and then fill in the path. If you use the file upload facility in Diagnostics in the webgui it will be in /tmp.

Steve

ashes00

@LinuxTracker:

@LinuxTracker:

Came across a new list of malware IPs

http://labs.alienvault.com/labs/index.php/projects/open-source-ip-reputation-portal/download-ip-reputation-database/

Looks like either the gzip ver or the plain ver - of the Generic Format - would load fine in pfBlocker.

Haven't tried it yet - will give it a go tonight and post back how it loads.

Here's my report back on the AlienVault IP Reputation list.
I had it block matching http/https outbound - and block matching * inbound.

The list is big, over 300k IPs.

The text version is 17MB and it added nearly a minute to my filter reload time (3Ghz PentiumD, 4GB).

I tried the gzip version and found it much smaller and faster. I had no noticeable difference in filter reload times.

After running the list for a most of a week, I had 2 false positives. That's not bad.

One was a big web host that AlienVault listed over a year ago (for serious malware distribution).
The IP was cleaned immediately so AlienVault must not delist IPs automatically.
The other false positive was a Tor directory server.

Conclusion:
Given the big database (and no auto-delisting) I'd say AlienVault has a really low false positive rate.
My opinion is that it's worth trying - providing you log any hits on it.

LinuxTracker - Sorry to bring up this 2 year old post, but I was wondering how things were going with the AlienVault IP Reputation Database (Generic), and its use as a pfBlocker list source. I see the generic list is near 114K IPs as of 11/17/14. I am interested in using this in pfBlocker. Where you able to just add in the .gz url, and it work automatically like other pfBlocker lists, or did you have to massage the data? Any other information you might have on this is greatly appreciated. Have a great day.

Ash,

Supermule

I suggest you get intouch with BBcan17 and talk to him about pfblockerNG as a replacement.

I run it here in test mode and besides some small issues, then it works like a charm!

Wolf666

@Supermule:

I suggest you get intouch with BBcan17 and talk to him about pfblockerNG as a replacement.

I run it here in test mode and besides some small issues, then it works like a charm!

it is!

Been testing pfblockerNG and it's a real step forward.

jdillard

There is now a pfBlockerNG package that replaces pfBlocker, so I am locking this thread.