A pfBlocker guide has frequently been requested as an addition to my baseline configuration guide. I’ve been working on a guide for some time now but with the constant evolution of pfBlocker and pfSense its never quite been ready for release. I’ve decided to break the guide into two sections to allow me to get some information published. The first part will focus on the more stable IP blocking functionality of pfBlocker. A second part to be published later, will focus on pfBlockers DNS blocking capabilities that are still undergoing more significant development.

Please feel free to email with feedback. I’m interested in hearing about other use cases you have found for pfBlocker too.

Last revised 20 April 2020.

This guide aims to demonstrate how to use pfBlockerNG to manage ingress and egress from a SOHO network through the use of blocklists, it’s built as an extension of my pfSense baseline setup guide detailed here.

pfBlockerNG is a pfSense package created by BBCan177 based upon the previous work of Marcello Coutinho and Tom Schaefer. The intent was to extend pfSense’s core firewall functionality with the ability to further control and manage inbound and outbound access through the firewall with the use of IP and DNS control lists. You can support BBCan177 and the ongoing development work directly though his Patreon page here.

IP Blocking pfBlockerNG provides the ability to curate firewall rules based on both IPv4 and IPv6 address spaces. These rules can be used to control both ingress and egress traffic on single or multiple interfaces.

DNS Blocking pfBlockerNG also has the ability to control access to the DNS Resolver to prevent access to malicious sites. Domain blocking can be used for advert, tracking and malicious domain filtering.

pfBlocker is highly versatile and powerful tool and there are many ways to implement it. My preference is to use pfBlocker to manage aliases and then use those aliases in manually crafted firewall rules ensuring both scope and ordering is correct for my intended purpose. I find this offers a level of precision not available when using the automatically generated rules.

Inbound traffic filtering pfSense by default blocks all inbound traffic so unless there are open ports on your firewall, there is zero additional protection offered in applying any rules to inbound traffic. I have a number of ports open exposing a VPN end point and several self-hosted services so make use of both custom IP lists and GeoIP restrictions to limit access.

Outbound traffic filtering I use outbound blocking on my primary use subnets (VL20_VPN & VL30_VPN) to prevent users from inadvertently accessing malicious sites. Coupled with logging this is a useful way to spot possible compromised devices.

Policy based routing I use several custom aliases that are used in policy based routing firewall rules to direct traffic out of specific gateways or gateway groups.

Malicious DNS Blocking and advert limiting I apply DNS blocking to the subnets served by the DNS Resolver to prevent access to tracking and/or malicious locations. I apply pretty limited filtering to avoid the potential of introducing false positives.

Before we get to installation and configuration, its worth understanding how pfBlocker takes raw blocklists and turns them into a final blocklist which is loaded into the firewall and/or DNS Resolver. Its actually a fairly complex process so this is a simplified representation.

Those key stages are described in some more detail below.

DNS Blocklist Processing Optimised DNS Resolver blocklists are generated from domain names gathered from various blacklist sources or manually entered.

GeoIP processing Geolocation is the identification or estimation of the real-world geographic location of an IP address. pfBlockerNG makes use of lists provided and maintained by MaxMind.

De-duplication Attempts to reduce list size by detecting and removing duplicate entries.

Suppression Removes any deny list entries that match those specified in the Suppression list which can be populated manually or from the pfBlockerNG alerts tab. RFC1918 and loopback addresses are also filtered when enabled.

CIDR aggregation Attempts to reduce overall list size by two methods. Removing superfluous prefixes because they are already included in another prefix, for example, 203.97.2.0/24 would be removed if 203.97.0.0/17 was also present. Combining adjacent prefixes under a single, shorter-length prefix. For example, 203.97.2.0/24 and 203.97.3.0/24 can be combined into the single prefix 203.97.2.0/23. CIDR aggregation is processor intensive, if you are running on a low powered device you may need to disable this feature.

Reputation A set of more aggressive aggregation techniques which if used carelessly could introduce additional false positives to your lists. For example, if processing a subnet with pMax[50] that has 50 positive matches, the whole subnet will be blacklisted possibly including some addresses which were not included in the original blocklist.

Reputation Max will search for repeat offenders in an individual blocklist. Once the Max setting is reached, the whole subnet will be blocked.

Reputation pMax will search for repeat offenders in all blocklists, without using country Code Exclusion. Once the pMax setting is reached, the whole subnet will be blocked.

Reputation dMax will search for repeat offenders in all blocklists using country code exclusion. Once the dMax setting is reached, the whole subnet will be blocked.

Sample Processing Results To provide some perspective into the efficiency of these methods, I’ve shared some of my test results on the ‘PRI1’ list below. Hopefully this is useful helping to establish the right balance between performance and accuracy.

Navigate to System > Package Manager > Available Packages. Scroll down click ‘ Install’ next to pfBlockerNG-devel. The ‘devel’ version is more actively developed and has several significant features implemented beyond the regular version, some of which this guide will take advantage of. The ‘devel’ version has historically been well tested prior to distribution. As always, please test prior to putting into your production use.

Click Confirm. The installation progress will be displayed in the Package Installation box, verify there are no issues reported.

To ensure there are enough entries to store the various tables created by pfBlocker increase the maximum number of table entries pfSense can accommodate. You may need to increase this number higher depending on your final configuration.

Navigate to System > Advanced > Firewall & NAT.

Click Save, reboot if prompted.

Navigate to Firewall > pfBlockerNG > General. Skip the Wizard and you will see the General configuration tab. Apply the following settings.

General Settings

Log Settings

Click Save

I prefer to use a non-zero offset for the minutes past the hour for the cron job to avoid overloading servers providing blocklists by distributing the access times away from the default configuration.

Even if the firewall is not configured with open internet facing a ports, one possible attack vector is from local users inadvertently initiating connections to malicious servers. To reduce the chance of this, I recommend blocking access to known sources of Ransomware, malware, botnets and Command & Control (C&C) servers. pfBlocker provides regularly updated blocklists through the bundled PRI1 feed. In this section I’ll cover how to enable the PRI1 group and create the firewall rule to prevent outbound traffic accessing any addresses contained within that group.

Navigate to Firewall > pfBlockerNG > IP

IP Settings

MaxMind GeoIP configuration

To make use of GeoIP functionality you must first register for a free MaxMind user account. Navigate to MaxMind and create an account using the 3.1.1 or newer registration option.

IPv4 Suppression

IP Interface/Rules Configuration

Although it is possible for pfBlockerNG to automatically create firewall rules, we will later create specific rules into our interfaces.

Click Save

Navigate to Firewall > pfBlockerNG > IP and select Reputation.

Individual List Reputation

Collective List Reputation

Country Code Settings

Click Save

pfBlockerNG offers a collection of predefined blocklists broken down into the following categories.

The PRI1 through PRI6 lists are high quality, frequently updated, and contain minimal false positives. The same process we use here on PRI1 can be applied to enable other groups too but be mindful that there is a memory and processing impact with each list enabled and it is possible to overload your hardware.

Navigate to Firewall > pfBlockerNG > Feeds.

To add the complete PRI1 group, click the under alias/group heading next to PRI1. The at the right of the screen enables you to add individual lists.

Note: Pulsedive requires a free API key which can be obtained by visiting Pulsedive.

Click Save IPv4 Settings

Navigate to Firewall > pfBlockerNG > Update

Setting the following options:

Click ‘ Run’

This will start producing a log file in the window below as the update proceeds.

By preventing a user accessing malicious content behind these addresses, we prevent opening a connection through our stateful firewall which could allow malicious content back in. The alias that pfBlocker created for us in the previous step is now available for use in our firewall rules.

Navigate to Firewall > Rules > VL20_VPN

As rules match in top to bottom priority, we will add the block rule at the top above the permit rules.

Click Add

Click [Save] and Apply.

The interface should look like this when complete, note the new reject rule highlighted at the top of the list.

At this point trying to access any of the addresses contained in the PRI1 blocklist from this subnet should result in access being denied. Assuming logging is enabled the Alerts tab will display the attempted access.

To verify our blocking rule is working, hover over the pfB_PRI1_v4 alias name in the firewall rule, this will display a pop-up detailing the aliases contents. Open a browser and try and access one of the IP address, for example http://1.1.166.43.

Your browser should display an error page as it has been unable to contact the server.

Navigate to the Firewall > pfBlockerNG > Reports and you should see the blocked access displayed. The log entry details the time, source, destination and originating feed. In the case of false positives, you can click on the symbol to whitelist access.

Its also worth enabling the dashboard widget to display performance data on how many matches are being tracked against your blocklists.

I use pfBlockerNG to maintain a number of custom lists that are used in various firewall rules to enable policy based routing rules, i.e directing traffic out of specific WAN/OpenVPN interfaces. This mechanism is useful for for sites that don’t respond well to access from VPNs such as financial institutions, media service providers etc.

In this example we’ll create a IPv4 alias called WAN_EGRESS which includes both a domain name (ifconfig.co) and an AS number (representing Netgate’s IP range). You will use the ifconfig.co domain to verify functionality once complete. This specific alias provides little value and is purely intended as a foundation for you to build your own specific needs upon.

Navigate to Firewall > pfBlockerNG > IP > IPv4

Click ‘ Add’

IPv4 Source Definitions

Click ‘ Add’ to add another row

Settings

Click ‘ Save IPv4 Settings’

Invoke an update of IP lists by navigating to Firewall > pfBlockerNG > Update and set the following options:

Click ‘ Run’

In the log display you will see a new line corresponding to our WAN_EGRESS alias called pfB_WAN_EGRESS_v4 reporting the number of IP address contained within that alias.

To review the contents of this alias list, Navigate to Firewall > pfBlockerNG > Logs and set the following options

In the log windows you will see the lists data.

THis guide will adapt a rule on the VL20_VPN subnet we created in the pfSense baseline guide to direct traffic matching the WAN_EGRESS alias out of the default WAN gateway. This can be used as a illustrative foundation to create rules on other interfaces if required.

Navigate to Firewall > Rules > VL20_VPN

Click the pencil next to the rule containing the SELECTIVE_ROUTING alias and reconfigure this rule as follows.

Make sure the rule ordering is correct and the revised rule is above the rule which allows traffic to exit the VPN interface/group. The interface should look like this when complete, note the new policy routing rule highlighted.

You can hover over the pfB_WAN_EGRESS_v4 alias to see the IP addresses included.

Connect to your VL20_VPN subnet, open your browser, navigate to https://ifconfig.co. If your rule is working correctly you will see your ISP WAN IP address and not an AirVPN address.

If you do not have any ports exposed to the internet, this section will be unnecessary to implement. By default, all inbound ports are default blocked by pfSense. If you do expose an internal proxy, or service, this will be helpful limiting access to that service reducing the chance of unauthorized access. Please consider the implications of opening ports to the internet and only do so when you are confident in your ability to safely protect your network.

I use an alias that includes some geo-located based IP ranges to reduce exposure of self-hosted services to North American IP addresses which is where I typically access them from. If I’m travelling outside North America, I whitelist additional ranges in advance. I also add some other common sources of access to this alias, for example, places of employment,friends and family, and/or mobile carriers.

Navigate to Firewall > pfBlockerNG > IP > GeoIP

Verify all sources are marked as Action = Disabled.

Click ‘ Add’

IPv4 Source Definitions

Settings

Click ‘ Save IPv4 Settings ‘

Update the alias by invoking a manual update of IP lists.

Navigate to Firewall > pfBlockerNG > Update, set the following options:

Click ‘ Run’

In the log display you you will see a new row in the alias table counts corresponding to our WAN_INGRESS list.

This alias can now used in our firewall rules.

We will create a rule on the WAN subnet to permit traffic matching the WAN_INGRESS alias in to our network via port 443.

Navigate to Firewall > Rules > WAN

Select ‘ Add’

Your WAN interface should look this this after clicking Save

MaxMind GeoLite2 grepcidr 2.0 aggregate

pfBlockerNG is under active development by BBCan177. Please submit new lists for consideration of inclusion in the curated feeds section by emailing BBCan177.

20 April 2020 Initial guide published