PfBlocker IP Count

[BBcan177]

I'm using about 22 Lists in pfBlocker and noticed the following statistics.

Total Number of lines in all lists
  cat /usr/local/pkg/pfblocker_aliases/*.txt | wc -l
634,438

Total Number of Duplicates
  cat /usr/local/pkg/pfblocker_aliases/*.txt | sort | uniq -d | wc -l
96,487

Total number of addresses if I convert all /32 into /24 CIDR  (This still leave all other /16, /19 etc intact)
  cat /usr/local/pkg/pfblocker_aliases/.txt | sed -r 's//32//' | sed 's/.[0-9]$/.0/24/' | sort | uniq | wc -l
160,536

I would think that /24 would be better to block than /32?

And reducing the list to 25% would make a noticeable memory usage difference and possibly performance increase?
I also read that when pfBlocker if reloading that it will not block until it has fully reloaded, so if you are reloading lists each hour, there are potential security gaps each hour.

[doktornotor]

Yeah, feel free to do the legwork of concatenating, deduplicating and converting them, like - every time any of the lists updates. Or, maybe simply stop using pointless overlapping blocklists.

[BBcan177]

I already moved four of the large Blacklists to a cron job running a bash script, mapped pfBlocker to a local .txt file which does that process as you so eloquently described.

Shrunk the list by 50% already.

I use a remote syslog (ELSA) and it would be nice to have the pfSense syslogs incorporate the Rule that Blocked/Rejected/Passed the event. I heard this might be fixed in 2.2?

Also having a "hit count" would help this process.

I have spent alot of time on the Blacklists. Different locations get hit with different attacks. Various lists help to protect different aspects of the network.

If I had more PHP knowledge I would attempt to write some code to add some more functionality to pfBlocker.

• Convert /32 to /24 as an option per list
• Deduping based on Primary lists taking precedence
• Hit Count
• Log showing completion of list updates
• Previous IP count, post update IP count
• .csv and other file format download options (I Fixed that temporarily with a bash Script)