# pfBlockerNG in pfSense - IP and DNS Blocking

> pfBlockerNG is the pfSense package for IP and DNS blocking. Install it, set up DNSBL and GeoIP, pick between pfBlockerNG and -devel, and disable it safely.

Source: https://opennix.org/en/docs/pfsense/packages/pfsense-pfblockerng/


pfBlockerNG is a pfSense package providing comprehensive network traffic filtering based on IP address and domain name reputation lists. The package combines two core functions: blocking IP addresses from threat lists (including GeoIP country-based filtering) and DNSBL (DNS Blackhole List) - intercepting DNS queries to malicious, advertising, and unwanted domains. Unlike IDS/IPS, which analyzes traffic content, pfBlockerNG operates at the IP address and DNS query level, providing a first layer of defense with minimal performance impact.

pfBlockerNG integrates with the pfSense firewall through automatic alias and rule creation that blocks or permits traffic based on regularly updated lists from external sources.

## Installing pfBlockerNG

Installation is performed through the package manager:

1. Navigate to **System > Package Manager > Available Packages**
2. Search for **pfBlockerNG** and install that package unless you specifically need a feature that is only in the development branch
3. Click **Install** and confirm the installation
4. Wait for the installation to complete

After installation, configuration is accessible at **Firewall > pfBlockerNG**.

> **Warning**:
>
> Never install both pfBlockerNG and pfBlockerNG-devel at the same time. They manage the same aliases, firewall rules, and Unbound configuration, and running them together produces conflicting rule sets.

## pfBlockerNG vs pfBlockerNG-devel

pfBlockerNG is the stable package and pfBlockerNG-devel is, in Netgate's own package list, "the development version of pfBlockerNG". The two share one codebase and one feature set; -devel receives changes first, so it carries new features earlier and regressions earlier as well. Install only one of them.

The distinction used to matter more than it does now. For several years the base package lagged far behind and -devel was the practical choice. That gap has closed: the pfSense Plus 23.01 release notes state that "the pfBlockerNG package has been updated to match pfBlockerNG-devel" and that after upgrading "it is safe to uninstall pfBlockerNG-devel (keeping settings) and install pfBlockerNG instead".

| | pfBlockerNG | pfBlockerNG-devel |
|---|---|---|
| **Role** | Stable release | Development branch |
| **Changes arrive** | After testing in -devel | First |
| **Use when** | Production, default choice | You need an unreleased feature or are testing a fix |
| **Netgate Plus 23.01+** | Recommended, matches -devel | Safe to replace with the base package |

Advice specific to pfSense CE: the CE release notes do not carry the 23.01 statement above, so check **System > Package Manager > Available Packages** on your own installation to see which versions your repository currently offers, and prefer the base package unless you have a concrete reason not to.

To switch from -devel to the base package, enable **Keep Settings** on the **General** tab first, uninstall pfBlockerNG-devel, then install pfBlockerNG. Settings survive the swap because both packages store configuration in the same section of `config.xml`.

### System Requirements

| Parameter | Minimum | Recommended |
|---|---|---|
| **RAM** | 1 GB | 2 GB or more |
| **Disk** | 5 GB free space | 10 GB |
| **DNS Resolver** | Unbound (required for DNSBL) | Unbound in Resolver mode |

DNSBL requires Unbound DNS Resolver as the primary pfSense DNS service. DNSBL functionality is unavailable when using DNS Forwarder (dnsmasq).

## Initial Configuration

After installation, perform the base configuration through the setup wizard.

### General Parameters

Configuration is performed on the **General** tab (**Firewall > pfBlockerNG > General**).

| Parameter | Description | Recommendation |
|---|---|---|
| **Enable pfBlockerNG** | Activate the package | Enable |
| **Keep Settings** | Preserve settings during reinstallation | Enable |
| **CRON Settings** | List update schedule | Every hour or Every 6 hours |
| **Global Logging** | Event logging | Enable |
| **MaxMind License Key** | Key for downloading the GeoIP database | Required for GeoIP |

### Obtaining the MaxMind Key

To use GeoIP blocking, a free MaxMind license key is required:

1. Register an account at [maxmind.com](https://www.maxmind.com/en/geolite2/signup)
2. Create a License Key in the account dashboard
3. Copy the key into the **MaxMind License Key** field in pfBlockerNG settings
4. Run an update through **Update** to download the GeoIP database

## IP Address Blocking

IP address blocking provides traffic filtering based on reputation lists containing addresses of known threat sources - botnet servers, spam campaigns, vulnerability scanners, and other malicious resources.

### Configuring IP Blocking

Configuration is performed on the **IP** tab (**Firewall > pfBlockerNG > IP**).

#### IPv4 and IPv6 Groups

Each list is assigned to a group with individual parameters:

| Parameter | Description |
|---|---|
| **Alias Name** | Alias name (used in firewall rules) |
| **List Action** | Action on match |
| **Update Frequency** | List update frequency |
| **Source** | List URL and format |
| **Header/Label** | List description |

#### Match Actions

| Action | Description |
|---|---|
| **Deny Both** | Block traffic in both directions |
| **Deny Inbound** | Block only inbound traffic from listed addresses |
| **Deny Outbound** | Block only outbound traffic to listed addresses |
| **Permit Inbound** | Allow inbound traffic (whitelist) |
| **Permit Outbound** | Allow outbound traffic (whitelist) |
| **Alias Only** | Create alias without automatic rule |

For most threat lists, the **Deny Both** action is recommended for complete blocking of interaction with malicious addresses.

### Popular IP List Sources

| Source | Description | URL |
|---|---|---|
| **Spamhaus DROP** | Addresses hijacked for spam and attacks | https://www.spamhaus.org/drop/drop.txt |
| **Spamhaus EDROP** | Extended Spamhaus list | https://www.spamhaus.org/drop/edrop.txt |
| **DShield** | Top 20 attacking IPs over the last 24 hours | https://feeds.dshield.org/block.txt |
| **Feodo Tracker** | Banking trojan C2 server IP addresses | https://feodotracker.abuse.ch/downloads/ipblocklist.txt |
| **Emerging Threats** | Active threat IP addresses | https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt |
| **CINS Army** | Distributed attacker list | https://cinsscore.com/list/ci-badguys.txt |
| **Abuse.ch SSLBL** | Malicious SSL server IP addresses | https://sslbl.abuse.ch/blacklist/sslipblacklist.txt |

### GeoIP Blocking

GeoIP filtering allows blocking or permitting traffic based on the geographic location of IP addresses. This feature is useful for restricting access from countries where legitimate traffic is not expected.

GeoIP configuration is performed on the **IP** tab under **GeoIP**:

1. Verify the MaxMind key is entered in general settings
2. Navigate to **IP > GeoIP**
3. Select continents or countries for blocking
4. Set the action (**Deny Inbound**, **Deny Both**, etc.)
5. Save and run an update

#### GeoIP Filtering Strategies

| Strategy | Description | Application |
|---|---|---|
| **Block by country** | Deny traffic from selected countries | Servers with a region-specific audience |
| **Permit by country** | Allow traffic only from selected countries, block all others | Local services without international access |
| **Inbound only** | Block inbound connections from countries, outbound permitted | Standard protection without restricting outbound access |

> **Warning**:
>
> GeoIP databases do not provide absolute location accuracy. Some IP addresses (VPN, CDN, cloud providers) may be associated with incorrect countries. Test GeoIP rules before deploying in production environments.

## DNSBL - DNS Query Blocking

DNSBL (DNS Blackhole List) blocks access to unwanted domains by intercepting DNS queries. When a client requests resolution of a blocked domain, pfBlockerNG returns a dummy IP address (typically 10.10.10.1) instead of the actual server address. This prevents connections to malicious, advertising, and tracking resources at the DNS level.

### How DNSBL Works

```text
Client                 Unbound DNS              pfBlockerNG
   |                      |                         |
   |-- DNS query -------->|                         |
   |   malware.example.com|                         |
   |                      |-- Check DNSBL --------->|
   |                      |                         |
   |                      |<-- Domain blacklisted --|
   |                      |   return: 10.10.10.1    |
   |                      |                         |
   |<-- Response: --------|                         |
   |    10.10.10.1        |                         |
   |                      |                         |
   |-- Connection to 10.10.10.1 (pfBlockerNG virtual IP)
   |-- Receives block page or RST
```

### Configuring DNSBL

Configuration is performed on the **DNSBL** tab (**Firewall > pfBlockerNG > DNSBL**).

#### Core Parameters

| Parameter | Description | Recommendation |
|---|---|---|
| **Enable DNSBL** | Activate DNS filtering | Enable |
| **DNSBL Virtual IP** | Virtual IP for blocked domains | 10.10.10.1 (default) |
| **DNSBL Listening Port** | Block page web server port | 8081 (default) |
| **DNSBL SSL Listening Port** | HTTPS port for block page | 8443 |
| **DNSBL Whitelist** | Domains excluded from blocking | As needed |
| **TLD Exclusion** | Top-level domain exclusions | As needed |

#### DNSBL Groups

Each blocklist is assigned to a group with the following settings:

| Parameter | Description |
|---|---|
| **Group Name** | List group name |
| **DNSBL Sources** | Domain list URLs |
| **List Action** | Action: Unbound (recommended) |
| **Update Frequency** | Update frequency |
| **Header/Label** | Source description |

### Popular DNSBL Sources

#### Ad and Tracker Blocking

| Source | Description |
|---|---|
| **EasyList** | Primary ad blocking list (Adblock Plus) |
| **EasyPrivacy** | Tracking script and pixel blocking |
| **AdGuard DNS** | Ad filters from AdGuard |
| **Peter Lowe's Ad List** | Compact list of ad and tracking domains |
| **Steven Black's Hosts** | Consolidated malware and ad domain list |

#### Malware Domain Blocking

| Source | Description |
|---|---|
| **Abuse.ch URLhaus** | Domains distributing malware |
| **Malware Domain List** | Malware-associated domains |
| **Phishing Army** | Phishing domains |
| **SANS ISC Suspicious** | Suspicious domains from SANS Internet Storm Center |
| **Disconnect Malware** | Malware domains from Disconnect |

#### Telemetry Blocking

| Source | Description |
|---|---|
| **Windows Telemetry** | Microsoft Windows telemetry domains |
| **Smart TV Tracking** | Smart TV tracking domains |

### DNSBL Block Page

When accessing a blocked domain, the user sees the pfBlockerNG block page displaying:

- The blocked domain
- The DNSBL group containing the domain
- Block time
- A button to whitelist the domain (when authorized)

Block page appearance is configured on the **DNSBL > DNSBL Customization** tab.

## Whitelists

Whitelists allow excluding specific IP addresses or domains from blocking.

### IP Address Whitelist

To exclude IP addresses from blocking, create a group with a **Permit Inbound** or **Permit Outbound** action on the **IP** tab. Addresses in permit groups take priority over blocking groups.

### DNSBL Whitelist

Domain whitelists are configured in several locations:

| Method | Location | Description |
|---|---|---|
| **DNSBL Whitelist** | DNSBL > DNSBL Configuration | Global domain whitelist |
| **Custom Whitelist** | DNSBL > DNSBL Groups | Whitelist for a specific group |
| **TLD Whitelist** | DNSBL > DNSBL TLD | Top-level domain exclusions |
| **Wildcard Whitelist** | DNSBL > DNSBL Whitelist | Supports masks `*.domain.com` |

#### Whitelist Entry Format

```text
# Exact domain match
example.com

# Domain and all subdomains
.example.com

# Comment with description
example.com # Corporate portal
```

### Whitelist Recommendations

During initial pfBlockerNG deployment:

1. Enable DNSBL with a minimal set of lists
2. Monitor the block log for several days
3. Add domains required by business applications to the whitelist
4. Gradually expand the number of active lists

Typical domains for whitelisting:

- Corporate service domains (Microsoft 365, Google Workspace)
- CDN providers (Akamai, CloudFront, Cloudflare)
- Operating system update services
- Payment systems and banking services

## Custom Lists

pfBlockerNG supports creating custom IP address and domain lists to tailor filtering to specific requirements.

### Custom IP Lists

On the **IP** tab, click **Add** and complete:

1. **Alias Name** - list name
2. **List Action** - action (Deny/Permit)
3. **Source** - select **Custom** and enter IP addresses or subnets, one per line
4. Save and run **Force Update**

### Custom DNSBL Lists

On the **DNSBL** tab, click **Add** and complete:

1. **Group Name** - group name
2. **DNSBL Source** - select **Custom** and enter domains, one per line
3. **List Action** - Unbound
4. Save and run **Force Update**

## Logging and Monitoring

### pfBlockerNG Logs

Logs are accessible through **Firewall > pfBlockerNG > Logs**:

| Log | Contents |
|---|---|
| **DNSBL** | Blocked DNS queries showing client and domain |
| **IP Block** | Blocked IP addresses showing source list |
| **GeoIP** | Blocked connections by geographic origin |
| **Error** | List update errors and package issues |

### Statistics

The **Reports** tab provides pfBlockerNG operational statistics:

- Blocked request counts by category
- Top blocked domains and IP addresses
- Top clients by blocked request count
- Activity graphs over time

### Dashboard Widget

pfBlockerNG adds a widget to the pfSense dashboard with summary blocking statistics for the current period.

## Firewall Integration

pfBlockerNG automatically creates aliases in the pfSense firewall for each active IP blocking group. These aliases are visible at **Firewall > Aliases** and can be used in custom rules.

### Automatic Rules

When selecting the **Deny Both/Inbound/Outbound** action, pfBlockerNG automatically creates firewall rules on the **Floating Rules** tab. These rules are processed before user-defined rules on interfaces.

### Manual Alias Usage

When selecting the **Alias Only** action, only an alias is created without an automatic rule. This alias can be used in custom rules on any interface for more granular control.

## Troubleshooting

### DNS Filtering Not Working

1. Verify DNSBL is enabled on the **DNSBL** tab
2. Confirm DNS Resolver (Unbound) is the primary pfSense DNS service (**Services > DNS Resolver**)
3. Verify clients use pfSense as their DNS server
4. Confirm Python is installed (required for DNSBL in pfBlockerNG-devel)
5. Run a forced update: **Firewall > pfBlockerNG > Update > Force**
6. Check the error log: **Firewall > pfBlockerNG > Logs > Error**

### DNSBL False Positives

1. Identify the blocked domain in the **DNSBL** log
2. Add the domain to the whitelist through **DNSBL Whitelist** or the block page
3. For widespread false positives, disable the problematic list
4. Use `nslookup` or `dig` to verify domain resolution through pfSense

### High Memory Usage

1. Check active list entry counts: **Firewall > pfBlockerNG > Logs > Summary**
2. Reduce the number of active IP lists
3. Increase the firewall table size: **System > Advanced > Firewall & NAT > Firewall Maximum Table Entries**
4. When using GeoIP, verify only necessary databases are loaded
5. Consider increasing RAM

### List Update Errors

1. Verify DNS availability: **Diagnostics > DNS Lookup**
2. Check routing: **Diagnostics > Ping** to the list source address
3. Confirm outbound HTTPS traffic (port 443) is not blocked
4. Verify the source URL has not changed (sources periodically change addresses)
5. Check the list format - some sources change formats without notice

### Package Not Working After pfSense Upgrade

1. Remove and reinstall pfBlockerNG through **System > Package Manager**
2. Re-run the configuration wizard
3. Execute **Force Update** to download all lists
4. Verify package version compatibility with the current pfSense version

## Deployment Recommendations

### Phased Implementation

1. **Phase 1**: Install pfBlockerNG with a minimal set of IP lists (Spamhaus DROP, DShield)
2. **Phase 2**: Enable DNSBL with primary malware domain lists
3. **Phase 3**: Add ad and tracker lists
4. **Phase 4**: Configure GeoIP filtering
5. **Phase 5**: Add custom lists based on log analysis

### Post-Deployment Monitoring

After each implementation phase:

- Monitor block logs for at least 48 hours
- Verify business-critical application functionality
- Build the whitelist based on user reports
- Monitor resource consumption (RAM, CPU, table sizes)

## Disabling and Removing pfBlockerNG

To disable pfBlockerNG without uninstalling it, open **Firewall > pfBlockerNG > General**, clear the **Enable pfBlockerNG** checkbox, and click **Save**. The package stops enforcing lists, removes its firewall rules and aliases, and stops answering DNSBL queries, while keeping every list, whitelist, and setting intact for when you re-enable it.

Disable it this way first when diagnosing a connectivity problem. It isolates pfBlockerNG as the cause in one step and is fully reversible, which matters because a blocked list entry and a broken firewall rule look identical from a client machine.

To remove the package entirely:

1. Enable **Keep Settings** on the **General** tab if you intend to reinstall later
2. Navigate to **System > Package Manager > Installed Packages**
3. Remove **pfBlockerNG** (or **pfBlockerNG-devel**)
4. Confirm that **Firewall > Aliases** no longer lists pfBlockerNG-generated aliases and that **Services > DNS Resolver** has no leftover DNSBL entries in its custom options

If DNS resolution behaves oddly after removal, restart the DNS Resolver service: DNSBL operates through the Unbound Python module, and the resolver needs a restart to drop it.

## pfBlockerNG Alternatives

There is no direct substitute for pfBlockerNG inside pfSense: no other package in the official repository combines IP reputation lists, GeoIP filtering, and DNS blocking in one place. The realistic alternatives either cover part of that scope or move the function off the firewall entirely.

**Inside pfSense:**

- **Suricata** or **Snort** - IDS/IPS packages that inspect traffic content rather than IP and DNS reputation. They complement pfBlockerNG rather than replace it, and they cost considerably more CPU and memory.
- **DNS Resolver blocklists** - Unbound accepts host overrides and custom options, so a small blocklist can be maintained by hand without any package. This scales poorly past a few hundred entries and offers no list updates, reporting, or GeoIP.

**Outside pfSense:**

- **Pi-hole** or **AdGuard Home** - dedicated DNS sinkholes running on a separate host. They match or exceed pfBlockerNG's DNSBL function and provide better reporting, but they do not filter by IP address or country, and they add a device to the failure path of every DNS query on the network.
- **Zenarmor** - a third-party commercial pfSense package with a free tier, offering application-layer filtering. It is not part of the official pfSense package repository, so it is installed and supported outside the Netgate package channel.

A note on what not to choose: Squid, SquidGuard, and Lightsquid are sometimes suggested for content filtering on pfSense. Netgate has deprecated all three in both pfSense Plus and pfSense CE because of unfixed upstream security vulnerabilities, strongly recommends uninstalling them, and states that they will stop functioning in future major releases.

## Related Sections

- [Package Management](/docs/pfsense/packages/pfsense-package-management/) - installing and updating pfSense packages
- [Suricata IDS/IPS](/docs/pfsense/packages/pfsense-suricata/) - traffic content inspection alongside pfBlockerNG reputation filtering
- [DNS in pfSense](/docs/pfsense/services/pfsense-dns/) - configuring DNS Resolver (Unbound) required for DNSBL
- [Firewall Rules](/docs/pfsense/firewall/pfsense-firewall-rules/) - interaction between firewall rules and pfBlockerNG aliases
- [Firewall Aliases](/docs/pfsense/firewall/pfsense-firewall-aliases/) - using pfBlockerNG aliases in custom rules