pfBlockerNG

pfBlocker-NG introduces an Enhanced Alias Table Feature to pfSense. This Allows, assigning many IP address URL lists to a single alias and then choose a rule action. Blocking countries and IP ranges, DNS lists is easy with pfBlocker.

To Install go to Package Manager and search and install pfBlocker-NG. This will take some time to install

Before going further go to ntopng settings and disable it otherwise your pfSense will get stuck due to low memory

Once pfBlocker-NG is installed, goto Firewall > pfBlockerNG for settings.

On pfBlockerNG settings, General Page, tick Enable and Save.

Next go to Update tab and click Run, this will update default lists.

To block IP blocks based on country go to GeoIP tab and select country/s and their List Action accordingly and Save.

To block a custom IP block, goto IPv4 or IPv6 and click +Add

• Give an Alias
• Discription
• URL to a IP subnets list or go to Custom List and enter manually.
• List Action, whether to block or not, whether it is inbound or outbound, etc.
• If it is a URL list, give a update frequency

Block traffic based on DNS

Modern traffic filtering becomes uneasy due to encryption methods, therefore the easiest way in filtering them is to block the DNS. But there should be some requirements for that,

• All devices in the network should resolve DNS from pfsense. You have to block accessing public DNS resolvers by your clients. eg: write a block rule on DNS ports for outgoing traffic from your LAN.
• Need to maintain an updated DNS list of unwanted domains.

To accomplish the second point above we will associate some publicly available community maintained dns block lists based on content category.

You can find some of these links from

• ​https://github.com/pi-hole/pi-hole/wiki/Customising-sources-for-ad-lists
• ​https://github.com/StevenBlack/hosts
• ​https://firebog.net/

on pfBlockerNG, go to DNSBL tab and tick enable DNSBL

When blocking is enabled all matched domains will be redirected to a IP address known as DNSBL Virtual IP and it will reply with a plain pixel. Therefore, you have to configure an IP address that is not used in your LAN segment. For the lab purposes change DNSBL Virtual IP to 192.168.254.254 as we do not use that IP in our network.

Then Define a List action from DNSBL IP Firewall Rule Settings, ideally, Deny Outbound and click save.

Next, Go to DNSBL Feeds

Click Add.

• DNS GROUP Name: PRON_Sites
• Description: BLock Porn sites
• DNSBL:
  • Format: Auto
  • State: ON
  • Source: ​https://raw.githubusercontent.com/chadmayfield/my-pihole-blocklists/master/lists/pi_blocklist_porn_all.list
  • Header: list1 and click Add
• on the second line use url: ​https://raw.githubusercontent.com/chadmayfield/pihole-blocklists/master/lists/pi_blocklist_porn_top1m.list with Header: List2 and Add
• List Action: Unbound
• Update Frequency: Once a day
• Save

Now go to Update and run it. Wait till you see UPDATE PROCESS ENDED

Then go to your GUI vm and do nslookup 121sexcam.com which is a blocked domain. You may also try this on web browser as well.

You can also try defining custom feed lists as well.