PfBlockerNG

n3by

@Supermule:

It does not unless you use an unofficiel package repository :)

Hi,

can you please give us more details how to install PFBlockerNG in 2.1.5

thank you

doktornotor

Well, you don't. Simple.

wcrowder

Update to 2.2+ and it will work fine. If you haven't you need to. Keeping your software up to date is part of security. Skip 5 or 6 versions and the updates become more difficult.

BBcan177

pfBlockerNG had support for 2.1.x. but the current version only supports 2.2 and above. Sorry about that.

BBcan177

@ntct:

Hello BBcan177,

If pfblockerng integrate with mailreport in the future? For example, I add "botnet" alias and set action to deny outbound. When infiltrated computers traffic is outbound, and send mail trigger by mailreport(Report Logs).

But I can only use firewall log (raw) filter in report Logs,so i can't filter by botnet alias

Or I can use other methods?

Thanks!

Hi ntct,

You can try the following :

View the Firewall or pfBNG Alerts log and find the Rule Number associated with the Alias. If you don't see the rule number in the Firewall logs, you can edit the log settings to display the Rule column.

In mail reports, when you select "Filter Logs (Raw), enter the "filter" as - Example rule number 90 :

90,

This will search the log for those characters. Please note that any Firewall rule changes can alter the Rule Number.

Hope this helps.

stanthewizard

Hello

Issue
Fatal error: Call to undefined function subnetv6_expand() in /etc/inc/util.inc on line 714

Fix in this thread works

BBcan177

Hi stanthewizard,

Are you using the latest version of pfBNG? If not, please upgrade as that issue has been fixed.

stanthewizard

This is the latest updated this morning

BBcan177

Do you have any Virtual IPs? And are you using IPv6?

Could you post a screenshot of the VIP addresses and masks?

stanthewizard

192.168.0.1/24 (vhid 1) LAN carp LANVirIPv4
192.168.1.200/24 (vhid 2) WAN carp WANVirIPv4
fd28:8ccb:1874:a09e::1/64 (vhid 3) LAN carp LANVirIPv6

https://www.dropbox.com/s/pso662buzfjvfnw/carp%20ipv4.jpg?dl=0

https://www.dropbox.com/s/xqxk04u5133w0jo/carp%20ipv6.jpg?dl=0

::)

BBcan177

Hi stanthewizard,

I took a look at the code for the Alerts tab in Github and it does not contain my patch for this issue… I must have not added those changes to the previous Pull Request. I will get that fixed in the next PR.

You mentioned that you did a work around? If its still not working for you, let me know and I will get you a patch for it. (send me a PM if you can't wait for the next version) :)

stanthewizard

I can wait no issue

I'm using the workaround you gave me :P

PS: still the footer is out of line

azurata

In response to a pm I received about:
@azurata:

I was waiting the pfBlockerNG new version to do adblock using the unbound, but until it's released I add a VIRTUAL IP to the Lan interface, made a script to convert http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext to unbound advanced rules to redirect to the VIRTUAL IP and setup a nginx to listen to both 80 and 443 on the VIRTUAL IP and respond to all with "204 No Content". For my surprise is working better that I was expecting.

made a tutorial, Simple adblock using unbound and nginx

Topper727

Just did the update to 1.08 and got

[ There were error(s) loading the rules: /tmp/rules.debug:23: cannot load /var/db/aliastables/pfB_Africa_v4.txt: No such file or directory - The line in question reads [23]: table persist file /var/db/aliastables/pfB_Africa_v4.txt]

BBcan177

@Topper727:

Just did the update to 1.08 and got

Did you try a "Force Reload"

meruem

Is it possible to select which internal IP addresses pfBlockerNG gets applied to? I want to be able to say use a blocklist for a specific internal device and all other devices will not be blocked by the blocklist

BBcan177

Hi meruem,

You can define the alias using an "Alias" list action (ie "Alias Deny"). This will allow you to create manually defined firewall rules with your specific requirements.

meruem

@BBcan177:

Hi meruem,

You can define the alias using an "Alias" list action (ie "Alias Deny"). This will allow you to create manually defined firewall rules with your specific requirements.

I see that pfBlockerNG added the IPv4 alias (which contains the large blocklist) I created to the firewall rules (action: block). I'm not sure how to only apply that firewall rule to a specific internal ip address(s) though. I tried editing the rule added by pfBlockerNG, and set the destination to a single internal IP address, but the rule is still being applied to all internal devices on my network

BBcan177

When you create the Alias, Set the "List Action" to "Alias Deny"… This way it will not create any Auto Rules. You can then create a new manual Firewall rule with your custom settings and then associate the Alias in the Rule.

meruem

BBcan177,

That worked perfect, Thanks.

In addition to the WAN incoming blocking, I created a firewall rule for LAN outgoing blocking. Firewall => Rules => LAN => Block => My Internal IP's Alias (Source) => External IP's Blocklist Alias (Destination) to complete the "no contact whatsoever with the blocklist IP's" thing I was going for

Also, I had to go to Diagnostics => States => Reset States. Because I found out, through testing, any established states before firewall changes do not adhere to the new firewall rules until the state has been removed from pfsense (either naturally or manually). I recommend this step to anyone doing the same thing as me, to complete the process

This is powerful and flexible. Now my blocklist(s) are not globally encompassing my entire network, and I do not have to tightly couple blocklists with client side software programs