pfBlockerNG in pfSense - IP and DNS Blocking

pfBlockerNG is a pfSense package providing comprehensive network traffic filtering based on IP address and domain name reputation lists. The package combines two core functions: blocking IP addresses from threat lists (including GeoIP country-based filtering) and DNSBL (DNS Blackhole List) - intercepting DNS queries to malicious, advertising, and unwanted domains. Unlike IDS/IPS, which analyzes traffic content, pfBlockerNG operates at the IP address and DNS query level, providing a first layer of defense with minimal performance impact.

pfBlockerNG integrates with the pfSense firewall through automatic alias and rule creation that blocks or permits traffic based on regularly updated lists from external sources.

Installing pfBlockerNG

Installation is performed through the package manager:

1. Navigate to System > Package Manager > Available Packages
2. Search for pfBlockerNG-devel (the -devel version is recommended as the actively maintained release)
3. Click Install and confirm the installation
4. Wait for the installation to complete

After installation, configuration is accessible at Firewall > pfBlockerNG.

Warning:

The pfBlockerNG-devel version is the developer-recommended release for production environments despite its name. The base pfBlockerNG version is no longer actively maintained.

System Requirements

DNSBL requires Unbound DNS Resolver as the primary pfSense DNS service. DNSBL functionality is unavailable when using DNS Forwarder (dnsmasq).

Initial Configuration

After installation, perform the base configuration through the setup wizard.

General Parameters

Configuration is performed on the General tab (Firewall > pfBlockerNG > General).

Obtaining the MaxMind Key

To use GeoIP blocking, a free MaxMind license key is required:

1. Register an account at maxmind.com
2. Create a License Key in the account dashboard
3. Copy the key into the MaxMind License Key field in pfBlockerNG settings
4. Run an update through Update to download the GeoIP database

IP Address Blocking

IP address blocking provides traffic filtering based on reputation lists containing addresses of known threat sources - botnet servers, spam campaigns, vulnerability scanners, and other malicious resources.

Configuring IP Blocking

Configuration is performed on the IP tab (Firewall > pfBlockerNG > IP).

IPv4 and IPv6 Groups

Each list is assigned to a group with individual parameters:

Match Actions

For most threat lists, the Deny Both action is recommended for complete blocking of interaction with malicious addresses.

Popular IP List Sources

GeoIP Blocking

GeoIP filtering allows blocking or permitting traffic based on the geographic location of IP addresses. This feature is useful for restricting access from countries where legitimate traffic is not expected.

GeoIP configuration is performed on the IP tab under GeoIP:

1. Verify the MaxMind key is entered in general settings
2. Navigate to IP > GeoIP
3. Select continents or countries for blocking
4. Set the action (Deny Inbound, Deny Both, etc.)
5. Save and run an update

GeoIP Filtering Strategies

Warning:

GeoIP databases do not provide absolute location accuracy. Some IP addresses (VPN, CDN, cloud providers) may be associated with incorrect countries. Test GeoIP rules before deploying in production environments.

DNSBL - DNS Query Blocking

DNSBL (DNS Blackhole List) blocks access to unwanted domains by intercepting DNS queries. When a client requests resolution of a blocked domain, pfBlockerNG returns a dummy IP address (typically 10.10.10.1) instead of the actual server address. This prevents connections to malicious, advertising, and tracking resources at the DNS level.

How DNSBL Works

Client                 Unbound DNS              pfBlockerNG
   |                      |                         |
   |-- DNS query -------->|                         |
   |   malware.example.com|                         |
   |                      |-- Check DNSBL --------->|
   |                      |                         |
   |                      |<-- Domain blacklisted --|
   |                      |   return: 10.10.10.1    |
   |                      |                         |
   |<-- Response: --------|                         |
   |    10.10.10.1        |                         |
   |                      |                         |
   |-- Connection to 10.10.10.1 (pfBlockerNG virtual IP)
   |-- Receives block page or RST

Configuring DNSBL

Configuration is performed on the DNSBL tab (Firewall > pfBlockerNG > DNSBL).

Core Parameters

DNSBL Groups

Each blocklist is assigned to a group with the following settings:

Popular DNSBL Sources

Ad and Tracker Blocking

Malware Domain Blocking

Telemetry Blocking

DNSBL Block Page

When accessing a blocked domain, the user sees the pfBlockerNG block page displaying:

• The blocked domain
• The DNSBL group containing the domain
• Block time
• A button to whitelist the domain (when authorized)

Block page appearance is configured on the DNSBL > DNSBL Customization tab.

Whitelists

Whitelists allow excluding specific IP addresses or domains from blocking.

IP Address Whitelist

To exclude IP addresses from blocking, create a group with a Permit Inbound or Permit Outbound action on the IP tab. Addresses in permit groups take priority over blocking groups.

DNSBL Whitelist

Domain whitelists are configured in several locations:

Whitelist Entry Format

# Exact domain match
example.com

# Domain and all subdomains
.example.com

# Comment with description
example.com # Corporate portal

Whitelist Recommendations

During initial pfBlockerNG deployment:

1. Enable DNSBL with a minimal set of lists
2. Monitor the block log for several days
3. Add domains required by business applications to the whitelist
4. Gradually expand the number of active lists

Typical domains for whitelisting:

• Corporate service domains (Microsoft 365, Google Workspace)
• CDN providers (Akamai, CloudFront, Cloudflare)
• Operating system update services
• Payment systems and banking services

Custom Lists

pfBlockerNG supports creating custom IP address and domain lists to tailor filtering to specific requirements.

Custom IP Lists

On the IP tab, click Add and complete:

1. Alias Name - list name
2. List Action - action (Deny/Permit)
3. Source - select Custom and enter IP addresses or subnets, one per line
4. Save and run Force Update

Custom DNSBL Lists

On the DNSBL tab, click Add and complete:

1. Group Name - group name
2. DNSBL Source - select Custom and enter domains, one per line
3. List Action - Unbound
4. Save and run Force Update

Logging and Monitoring

pfBlockerNG Logs

Logs are accessible through Firewall > pfBlockerNG > Logs:

Statistics

The Reports tab provides pfBlockerNG operational statistics:

• Blocked request counts by category
• Top blocked domains and IP addresses
• Top clients by blocked request count
• Activity graphs over time

Dashboard Widget

pfBlockerNG adds a widget to the pfSense dashboard with summary blocking statistics for the current period.

Firewall Integration

pfBlockerNG automatically creates aliases in the pfSense firewall for each active IP blocking group. These aliases are visible at Firewall > Aliases and can be used in custom rules.

Automatic Rules

When selecting the Deny Both/Inbound/Outbound action, pfBlockerNG automatically creates firewall rules on the Floating Rules tab. These rules are processed before user-defined rules on interfaces.

Manual Alias Usage

When selecting the Alias Only action, only an alias is created without an automatic rule. This alias can be used in custom rules on any interface for more granular control.

Troubleshooting

DNS Filtering Not Working

1. Verify DNSBL is enabled on the DNSBL tab
2. Confirm DNS Resolver (Unbound) is the primary pfSense DNS service (Services > DNS Resolver)
3. Verify clients use pfSense as their DNS server
4. Confirm Python is installed (required for DNSBL in pfBlockerNG-devel)
5. Run a forced update: Firewall > pfBlockerNG > Update > Force
6. Check the error log: Firewall > pfBlockerNG > Logs > Error

DNSBL False Positives

1. Identify the blocked domain in the DNSBL log
2. Add the domain to the whitelist through DNSBL Whitelist or the block page
3. For widespread false positives, disable the problematic list
4. Use nslookup or dig to verify domain resolution through pfSense

High Memory Usage

1. Check active list entry counts: Firewall > pfBlockerNG > Logs > Summary
2. Reduce the number of active IP lists
3. Increase the firewall table size: System > Advanced > Firewall & NAT > Firewall Maximum Table Entries
4. When using GeoIP, verify only necessary databases are loaded
5. Consider increasing RAM

List Update Errors

1. Verify DNS availability: Diagnostics > DNS Lookup
2. Check routing: Diagnostics > Ping to the list source address
3. Confirm outbound HTTPS traffic (port 443) is not blocked
4. Verify the source URL has not changed (sources periodically change addresses)
5. Check the list format - some sources change formats without notice

Package Not Working After pfSense Upgrade

1. Remove and reinstall pfBlockerNG through System > Package Manager
2. Re-run the configuration wizard
3. Execute Force Update to download all lists
4. Verify package version compatibility with the current pfSense version

Deployment Recommendations

Phased Implementation

1. Phase 1: Install pfBlockerNG with a minimal set of IP lists (Spamhaus DROP, DShield)
2. Phase 2: Enable DNSBL with primary malware domain lists
3. Phase 3: Add ad and tracker lists
4. Phase 4: Configure GeoIP filtering
5. Phase 5: Add custom lists based on log analysis

Post-Deployment Monitoring

After each implementation phase:

• Monitor block logs for at least 48 hours
• Verify business-critical application functionality
• Build the whitelist based on user reports
• Monitor resource consumption (RAM, CPU, table sizes)

Related Sections

• Package Management - installing and updating pfSense packages
• DNS in pfSense - configuring DNS Resolver (Unbound) required for DNSBL
• Firewall Rules - interaction between firewall rules and pfBlockerNG aliases
• Firewall Aliases - using pfBlockerNG aliases in custom rules