pfBlockerNG in pfSense - IP and DNS Blocking

pfBlockerNG is a pfSense package providing comprehensive network traffic filtering based on IP address and domain name reputation lists. The package combines two core functions: blocking IP addresses from threat lists (including GeoIP country-based filtering) and DNSBL (DNS Blackhole List) - intercepting DNS queries to malicious, advertising, and unwanted domains. Unlike IDS/IPS, which analyzes traffic content, pfBlockerNG operates at the IP address and DNS query level, providing a first layer of defense with minimal performance impact.

pfBlockerNG integrates with the pfSense firewall through automatic alias and rule creation that blocks or permits traffic based on regularly updated lists from external sources.

Installing pfBlockerNG

Installation is performed through the package manager:

1. Navigate to System > Package Manager > Available Packages
2. Search for pfBlockerNG and install that package unless you specifically need a feature that is only in the development branch
3. Click Install and confirm the installation
4. Wait for the installation to complete

After installation, configuration is accessible at Firewall > pfBlockerNG.

Warning:

Never install both pfBlockerNG and pfBlockerNG-devel at the same time. They manage the same aliases, firewall rules, and Unbound configuration, and running them together produces conflicting rule sets.

pfBlockerNG vs pfBlockerNG-devel

pfBlockerNG is the stable package and pfBlockerNG-devel is, in Netgate’s own package list, “the development version of pfBlockerNG”. The two share one codebase and one feature set; -devel receives changes first, so it carries new features earlier and regressions earlier as well. Install only one of them.

The distinction used to matter more than it does now. For several years the base package lagged far behind and -devel was the practical choice. That gap has closed: the pfSense Plus 23.01 release notes state that “the pfBlockerNG package has been updated to match pfBlockerNG-devel” and that after upgrading “it is safe to uninstall pfBlockerNG-devel (keeping settings) and install pfBlockerNG instead”.

Advice specific to pfSense CE: the CE release notes do not carry the 23.01 statement above, so check System > Package Manager > Available Packages on your own installation to see which versions your repository currently offers, and prefer the base package unless you have a concrete reason not to.

To switch from -devel to the base package, enable Keep Settings on the General tab first, uninstall pfBlockerNG-devel, then install pfBlockerNG. Settings survive the swap because both packages store configuration in the same section of config.xml.

System Requirements

DNSBL requires Unbound DNS Resolver as the primary pfSense DNS service. DNSBL functionality is unavailable when using DNS Forwarder (dnsmasq).

Initial Configuration

After installation, perform the base configuration through the setup wizard.

General Parameters

Configuration is performed on the General tab (Firewall > pfBlockerNG > General).

Obtaining the MaxMind Key

To use GeoIP blocking, a free MaxMind license key is required:

1. Register an account at maxmind.com
2. Create a License Key in the account dashboard
3. Copy the key into the MaxMind License Key field in pfBlockerNG settings
4. Run an update through Update to download the GeoIP database

IP Address Blocking

IP address blocking provides traffic filtering based on reputation lists containing addresses of known threat sources - botnet servers, spam campaigns, vulnerability scanners, and other malicious resources.

Configuring IP Blocking

Configuration is performed on the IP tab (Firewall > pfBlockerNG > IP).

IPv4 and IPv6 Groups

Each list is assigned to a group with individual parameters:

Match Actions

For most threat lists, the Deny Both action is recommended for complete blocking of interaction with malicious addresses.

Popular IP List Sources

GeoIP Blocking

GeoIP filtering allows blocking or permitting traffic based on the geographic location of IP addresses. This feature is useful for restricting access from countries where legitimate traffic is not expected.

GeoIP configuration is performed on the IP tab under GeoIP:

1. Verify the MaxMind key is entered in general settings
2. Navigate to IP > GeoIP
3. Select continents or countries for blocking
4. Set the action (Deny Inbound, Deny Both, etc.)
5. Save and run an update

GeoIP Filtering Strategies

Warning:

GeoIP databases do not provide absolute location accuracy. Some IP addresses (VPN, CDN, cloud providers) may be associated with incorrect countries. Test GeoIP rules before deploying in production environments.

DNSBL - DNS Query Blocking

DNSBL (DNS Blackhole List) blocks access to unwanted domains by intercepting DNS queries. When a client requests resolution of a blocked domain, pfBlockerNG returns a dummy IP address (typically 10.10.10.1) instead of the actual server address. This prevents connections to malicious, advertising, and tracking resources at the DNS level.

How DNSBL Works

Client                 Unbound DNS              pfBlockerNG
   |                      |                         |
   |-- DNS query -------->|                         |
   |   malware.example.com|                         |
   |                      |-- Check DNSBL --------->|
   |                      |                         |
   |                      |<-- Domain blacklisted --|
   |                      |   return: 10.10.10.1    |
   |                      |                         |
   |<-- Response: --------|                         |
   |    10.10.10.1        |                         |
   |                      |                         |
   |-- Connection to 10.10.10.1 (pfBlockerNG virtual IP)
   |-- Receives block page or RST

Configuring DNSBL

Configuration is performed on the DNSBL tab (Firewall > pfBlockerNG > DNSBL).

Core Parameters

DNSBL Groups

Each blocklist is assigned to a group with the following settings:

Popular DNSBL Sources

Ad and Tracker Blocking

Malware Domain Blocking

Telemetry Blocking

DNSBL Block Page

When accessing a blocked domain, the user sees the pfBlockerNG block page displaying:

• The blocked domain
• The DNSBL group containing the domain
• Block time
• A button to whitelist the domain (when authorized)

Block page appearance is configured on the DNSBL > DNSBL Customization tab.

Whitelists

Whitelists allow excluding specific IP addresses or domains from blocking.

IP Address Whitelist

To exclude IP addresses from blocking, create a group with a Permit Inbound or Permit Outbound action on the IP tab. Addresses in permit groups take priority over blocking groups.

DNSBL Whitelist

Domain whitelists are configured in several locations:

Whitelist Entry Format

# Exact domain match
example.com

# Domain and all subdomains
.example.com

# Comment with description
example.com # Corporate portal

Whitelist Recommendations

During initial pfBlockerNG deployment:

1. Enable DNSBL with a minimal set of lists
2. Monitor the block log for several days
3. Add domains required by business applications to the whitelist
4. Gradually expand the number of active lists

Typical domains for whitelisting:

• Corporate service domains (Microsoft 365, Google Workspace)
• CDN providers (Akamai, CloudFront, Cloudflare)
• Operating system update services
• Payment systems and banking services

Custom Lists

pfBlockerNG supports creating custom IP address and domain lists to tailor filtering to specific requirements.

Custom IP Lists

On the IP tab, click Add and complete:

1. Alias Name - list name
2. List Action - action (Deny/Permit)
3. Source - select Custom and enter IP addresses or subnets, one per line
4. Save and run Force Update

Custom DNSBL Lists

On the DNSBL tab, click Add and complete:

1. Group Name - group name
2. DNSBL Source - select Custom and enter domains, one per line
3. List Action - Unbound
4. Save and run Force Update

Logging and Monitoring

pfBlockerNG Logs

Logs are accessible through Firewall > pfBlockerNG > Logs:

Statistics

The Reports tab provides pfBlockerNG operational statistics:

• Blocked request counts by category
• Top blocked domains and IP addresses
• Top clients by blocked request count
• Activity graphs over time

Dashboard Widget

pfBlockerNG adds a widget to the pfSense dashboard with summary blocking statistics for the current period.

Firewall Integration

pfBlockerNG automatically creates aliases in the pfSense firewall for each active IP blocking group. These aliases are visible at Firewall > Aliases and can be used in custom rules.

Automatic Rules

When selecting the Deny Both/Inbound/Outbound action, pfBlockerNG automatically creates firewall rules on the Floating Rules tab. These rules are processed before user-defined rules on interfaces.

Manual Alias Usage

When selecting the Alias Only action, only an alias is created without an automatic rule. This alias can be used in custom rules on any interface for more granular control.

Troubleshooting

DNS Filtering Not Working

1. Verify DNSBL is enabled on the DNSBL tab
2. Confirm DNS Resolver (Unbound) is the primary pfSense DNS service (Services > DNS Resolver)
3. Verify clients use pfSense as their DNS server
4. Confirm Python is installed (required for DNSBL in pfBlockerNG-devel)
5. Run a forced update: Firewall > pfBlockerNG > Update > Force
6. Check the error log: Firewall > pfBlockerNG > Logs > Error

DNSBL False Positives

1. Identify the blocked domain in the DNSBL log
2. Add the domain to the whitelist through DNSBL Whitelist or the block page
3. For widespread false positives, disable the problematic list
4. Use nslookup or dig to verify domain resolution through pfSense

High Memory Usage

1. Check active list entry counts: Firewall > pfBlockerNG > Logs > Summary
2. Reduce the number of active IP lists
3. Increase the firewall table size: System > Advanced > Firewall & NAT > Firewall Maximum Table Entries
4. When using GeoIP, verify only necessary databases are loaded
5. Consider increasing RAM

List Update Errors

1. Verify DNS availability: Diagnostics > DNS Lookup
2. Check routing: Diagnostics > Ping to the list source address
3. Confirm outbound HTTPS traffic (port 443) is not blocked
4. Verify the source URL has not changed (sources periodically change addresses)
5. Check the list format - some sources change formats without notice

Package Not Working After pfSense Upgrade

1. Remove and reinstall pfBlockerNG through System > Package Manager
2. Re-run the configuration wizard
3. Execute Force Update to download all lists
4. Verify package version compatibility with the current pfSense version

Deployment Recommendations

Phased Implementation

1. Phase 1: Install pfBlockerNG with a minimal set of IP lists (Spamhaus DROP, DShield)
2. Phase 2: Enable DNSBL with primary malware domain lists
3. Phase 3: Add ad and tracker lists
4. Phase 4: Configure GeoIP filtering
5. Phase 5: Add custom lists based on log analysis

Post-Deployment Monitoring

After each implementation phase:

• Monitor block logs for at least 48 hours
• Verify business-critical application functionality
• Build the whitelist based on user reports
• Monitor resource consumption (RAM, CPU, table sizes)

Disabling and Removing pfBlockerNG

To disable pfBlockerNG without uninstalling it, open Firewall > pfBlockerNG > General, clear the Enable pfBlockerNG checkbox, and click Save. The package stops enforcing lists, removes its firewall rules and aliases, and stops answering DNSBL queries, while keeping every list, whitelist, and setting intact for when you re-enable it.

Disable it this way first when diagnosing a connectivity problem. It isolates pfBlockerNG as the cause in one step and is fully reversible, which matters because a blocked list entry and a broken firewall rule look identical from a client machine.

To remove the package entirely:

1. Enable Keep Settings on the General tab if you intend to reinstall later
2. Navigate to System > Package Manager > Installed Packages
3. Remove pfBlockerNG (or pfBlockerNG-devel)
4. Confirm that Firewall > Aliases no longer lists pfBlockerNG-generated aliases and that Services > DNS Resolver has no leftover DNSBL entries in its custom options

If DNS resolution behaves oddly after removal, restart the DNS Resolver service: DNSBL operates through the Unbound Python module, and the resolver needs a restart to drop it.

pfBlockerNG Alternatives

There is no direct substitute for pfBlockerNG inside pfSense: no other package in the official repository combines IP reputation lists, GeoIP filtering, and DNS blocking in one place. The realistic alternatives either cover part of that scope or move the function off the firewall entirely.

Inside pfSense:

• Suricata or Snort - IDS/IPS packages that inspect traffic content rather than IP and DNS reputation. They complement pfBlockerNG rather than replace it, and they cost considerably more CPU and memory.
• DNS Resolver blocklists - Unbound accepts host overrides and custom options, so a small blocklist can be maintained by hand without any package. This scales poorly past a few hundred entries and offers no list updates, reporting, or GeoIP.

Outside pfSense:

• Pi-hole or AdGuard Home - dedicated DNS sinkholes running on a separate host. They match or exceed pfBlockerNG’s DNSBL function and provide better reporting, but they do not filter by IP address or country, and they add a device to the failure path of every DNS query on the network.
• Zenarmor - a third-party commercial pfSense package with a free tier, offering application-layer filtering. It is not part of the official pfSense package repository, so it is installed and supported outside the Netgate package channel.

A note on what not to choose: Squid, SquidGuard, and Lightsquid are sometimes suggested for content filtering on pfSense. Netgate has deprecated all three in both pfSense Plus and pfSense CE because of unfixed upstream security vulnerabilities, strongly recommends uninstalling them, and states that they will stop functioning in future major releases.

Related Sections

• Package Management - installing and updating pfSense packages
• Suricata IDS/IPS - traffic content inspection alongside pfBlockerNG reputation filtering
• DNS in pfSense - configuring DNS Resolver (Unbound) required for DNSBL
• Firewall Rules - interaction between firewall rules and pfBlockerNG aliases
• Firewall Aliases - using pfBlockerNG aliases in custom rules