PfBlockerNG

cyberbot

@cyberbot:

@f34rinc:

Did that fix your problem Jamerson?

no still waiting for some answers,
whenever i activate the pfBlockerNG the internet stops working.

We need to see rules.debug or a screenshot of the rules created to give you any information.

what rules are referring to ? Firewall rules or the pfblocker NG rules ?

f34rinc

what rules are referring to ? Firewall rules or the pfblocker NG rules ?

Can you post both?

virusbcn

I'm sorry by the "stupid question" but….

If i have a DNS and SMTP server (to work my mail and domains) can i use pfblockerng to block all Africa and Asia ??? (i don't have any mail/relation with us)

You will continue to run the dns? or i have problems ???

f34rinc

virusbcn - Yes you can block individual countries or entire continents. Default deny inbound rule is blocks all traffic, if you don't want to block everything you can specify which ports you would like to block (53,25,587,995) and allow everything else.

cjbujold

Upgraded to 2.2.4 and in the log I see the following error. Any ideas on how to fix? These are files I had created previously and they have been working fine for several months. I see no change in the IDE screen, the list is shown properly.

Thanks

[ pfB_shodan shodan ] Download FAIL
[ pfB_shodan shodan ] Local File Failure

[ pfB_BadIPV6 BadIP6_v6 ] Download FAIL
[ pfB_BadIPV6 BadIP6_v6 ] Local File Failure

BBcan177

Hi cjbujold,

Which folder did you place the localfile into? Are you sure that it still exists after the re-install? You can view the various folders in the pfBNG log browser tab.

cjbujold

The issue seems to be with IP6 the IP4 are working properly but when I create an IPv6 table the first one gets created but the second or third list does not. The folder use is /var/db/aliastables

Thnaks

waht

I am having issues with squid + pfBlockerNG

I have squid + squidguard running with shalalist as a black list

I added an IP for a website that I use to a custom pfBlockerNG alias.

Put that alias in the floating rules, blocking to and from the IP's.

The single IP I can still get to when put into my web browser….....however, if I open a command prompt and try to ping it, it is blocked.

How can I get squid to play nice with my block list?

doktornotor

Dude. Squid issues do not go on this thread.

waht

Right…..so are you saying my squid is misconfigured?

Cause I was under the impression I did not set my firewall rules correctly if there was no blocking going on......

BBcan177

@cjbujold:

The issue seems to be with IP6 the IP4 are working properly but when I create an IPv6 table the first one gets created but the second or third list does not. The folder use is /var/db/aliastables

Thnaks

Hi cjbujold, I have tested adding multiple IPv6 lists to a single alias, and also tested adding multiple IPv6 Aliases and can't reproduce your issue.

Can you post a screenshot of the issue? Your localfile shouldn't be saved to /var/db/aliastables, that is the final folder location that pfSense uses to load the tables. You should save your localfile in ie: /var/db/pfblockerng for example.

Thanks!

Jamerson

sorry if this questions has been asked before cant seem to find it in this thread.
can I block adult websites with the pfBlockerNG ? because the proxy servers / filter doesn't seems to works since 2.2

thank you

tonymorella

Has anyone else looked at Critical Shiack's Free Threat Intel Marketplace and thought how it could be used in pfsense?? They already have 104 feeds, and doing normalization on them. The dash board allows you to create collections from the differnet feeds which could in theroy be used with pfBlockerNG, seems like a good match.

https://intel.criticalstack.com/

Edit: Just set this up on a test system and used the command line client to export the final file which combined sources from 10 different lists, example of the output.


#fields	indicator	indicator_type	meta.source	meta.do_notice
62.210.72.158	Intel::ADDR	from http://rules.emergingthreats.net/blockrules/emerging-botcc.rules via intel.criticalstack.com	F
62.245.45.132	Intel::ADDR	from http://rules.emergingthreats.net/open/suricata/rules/compromised.rules via intel.criticalstack.com	F

Next step of getting it into a format pfBlockerNG can import is simple, so we can make this work. But a plugin that hooks directly into criticalstack.com via an API would be a powerful tool, could then be uses in any package via aliases.

Thoughts?
Tony

BBcan177

I've looked at C.S. before, but I don't really see any current benefit to integrate it into pfBNG.

All of the feeds are free and can be used directly in pfBNG 'as is'. This allows greater control over the feeds and on the frequency of the updates to the Source Feeds. The de-duplication (normalization) in CS is done on a "Class" basis, versus as a whole with pfBNG. Not to mention that pfBNG can take into consideration Country/Continent blocking and further de-duplicate redundant IPs that are already being blocking by a Country/Continent blocklist. I also assume that de-duplication in CS is not done on a CIDR basis as in pfBNG and instead is de-duplicated on a 1:1 basis.

It should also be noted that CS formats the Feeds to be used primarily with BRO. There are also limitations/efficiency issues with large lists as is noted on the CS site. Also having CS process these free Feeds, add extra text per line, and then have pfBNG strip away the extra text to get the IP/Domain is a bit redundant when the Free Feed can be downloaded directly with pfBNG. Some of the Domain based Feeds also mix some IPs which pfBNG can process into an IP Blocklist automatically.

pfBNG can also make use of "Reputation" to further analyse the maliciousness of an IP range.

pfBNG v2.0 (expected to post a Pull Request in the next few weeks), will have DNSBL Domain name blocking via Unbound DNS.

Of the 104 Lists currently available in CS, most of those are listed in the Script that I have provided in this Thread previously. Some of the Sources (BBC, hpHosts for example) have listed all of their feeds individually (some Feeds provide a combined Feed URL) which exaggerates the number of Feeds available. Most of the Domain based Feeds provided in CS are also being beta tested in the DEV version of pfBNG by several beta testers. I have written a Domain parser for the 'Original' Source Feeds and to use the CS Domain based feeds, I would have to re-write the code to allow for the change in format.

I also prefer to deal with the 'Original' provider of Feeds instead of using a 'middleman' approach. If anything, CS can be used as a listing of Feeds that are freely available, and these can be used directly in pfBNG without the need to have the Feeds processed by CS.

Next steps for pfBNG will be to implement an improved method to add Source Feed URLs, instead of manually adding these one by one. I am considering some scenarios for upcoming releases.

TMiland

@BBcan177:

@marcus556:

Yes, I've got it all worked out now very good work sir on this package.

As far as the AdBlock on iblock, you are right it isn't the greatest. I have a question since your doing most of the design it seems, when 2.0 expected for one and two are the list going to be limited to only IP lists or could we say use the AdBlock plus list aka easylist?

Yes I am the Developer of the package .. I haven't put much development into it for the past couple weeks, since v1.0 was released.. Maybe another month or so… I want to make sure that its stable and all the tires kicked every which way by the beta testers that helped me with v1.0 :)

You can see some more Features in this link:
https://forum.pfsense.org/index.php?topic=78356.msg477682#msg477682

I have all of the features in the link working and will be working on Easylist next...

Hi, are there any progress with the easylist integration? :)

Regards.

abujammy

I just had a huuuuuge issue with pfBlocker and I think I'm missing a few things and I was hoping someone could help me out.

Firstly, how do you completely wipe out all cached lists and force pfBlocker to redownload everything? I was getting a super weird error in the update logs about not being able to match a cidr, then it wouldn't update, then the dashboard widget showed "pf Error" where it usually shows how many firewall rules are attached to an alias list.

I didn't do anything weird. All I did was update some lists. Then all hell broke loose. It was even reverting my firewall configuration to a previous state. It was a complete clusterfuck and I've been trying to fix it for the last 3 hours.

Any help would be appreciated. Thanks!

abujammy

Oh yeah, and where does pfBlocker keep the cached versions of the lists on disk? I was looking for them in hopes that I could delete them and have it redownload all of them.

BBcan177

@abujammy:

Oh yeah, and where does pfBlocker keep the cached versions of the lists on disk? I was looking for them in hopes that I could delete them and have it redownload all of them.

Goto the "General tab", unclick "keep settings", then unclick "Enable"… Click "Save"... all previous files are wiped. Reverse the above to re-enable...

tonymorella

@BBcan177:

I've looked at C.S. before, but I don't really see any current benefit to integrate it into pfBNG.

All of the feeds are free and can be used directly in pfBNG 'as is'. This allows greater control over the feeds and on the frequency of the updates to the Source Feeds. The de-duplication (normalization) in CS is done on a "Class" basis, versus as a whole with pfBNG. Not to mention that pfBNG can take into consideration Country/Continent blocking and further de-duplicate redundant IPs that are already being blocking by a Country/Continent blocklist. I also assume that de-duplication in CS is not done on a CIDR basis as in pfBNG and instead is de-duplicated on a 1:1 basis.

It should also be noted that CS formats the Feeds to be used primarily with BRO. There are also limitations/efficiency issues with large lists as is noted on the CS site. Also having CS process these free Feeds, add extra text per line, and then have pfBNG strip away the extra text to get the IP/Domain is a bit redundant when the Free Feed can be downloaded directly with pfBNG. Some of the Domain based Feeds also mix some IPs which pfBNG can process into an IP Blocklist automatically.

pfBNG can also make use of "Reputation" to further analyse the maliciousness of an IP range.

pfBNG v2.0 (expected to post a Pull Request in the next few weeks), will have DNSBL Domain name blocking via Unbound DNS.

Of the 104 Lists currently available in CS, most of those are listed in the Script that I have provided in this Thread previously. Some of the Sources (BBC, hpHosts for example) have listed all of their feeds individually (some Feeds provide a combined Feed URL) which exaggerates the number of Feeds available. Most of the Domain based Feeds provided in CS are also being beta tested in the DEV version of pfBNG by several beta testers. I have written a Domain parser for the 'Original' Source Feeds and to use the CS Domain based feeds, I would have to re-write the code to allow for the change in format.

I also prefer to deal with the 'Original' provider of Feeds instead of using a 'middleman' approach. If anything, CS can be used as a listing of Feeds that are freely available, and these can be used directly in pfBNG without the need to have the Feeds processed by CS.

Next steps for pfBNG will be to implement an improved method to add Source Feed URLs, instead of manually adding these one by one. I am considering some scenarios for upcoming releases.

Thanks for the great feedback! Missed the script post, maybe put that on the first post??

Tony

cyberbot

I am using pfblockerng and blocking all country which I don't do business with .
Europe is not blocked . This weekend I am away to Germany " which is not blocked "
Right now I am on the hotel but the connection to the server behind pfsense is blocked .
Why it's blocking Germany IP even i don't block Germany country on pfblockerng?
IP where I am connecting from is
62.143.80.249

Is this ip on a different categories ?