= $pfb['skipfeed']) { $log = " Max daily download failure attempts exceeded. Clear widget 'failed downloads' to reset.\n\n"; pfb_logger("{$log}", 1); unlink_if_exists("{$pfbfolder}/{$header}.fail"); return; } } // Attempt download, when a previous 'fail' file marker is found. if (file_exists("{$pfbfolder}/{$header}.fail")) { $log = "\t\t\tPrevious download failed.\tRe-attempt download\n"; pfb_logger("{$log}", 1); $pfb['update_cron'] = TRUE; unlink_if_exists("{$pfbfolder}/{$header}.txt"); return; } // Check if List file doesn't exist or Format is 'whois'. if (!file_exists("{$pfbfolder}/{$header}.txt") || $format == 'whois') { $log = "\t\t\t\t\t\t\tUpdate found\n"; pfb_logger("{$log}", 1); $pfb['update_cron'] = TRUE; return; } $host = @parse_url($list_url); $local_file = "{$pfborig}/{$header}.orig"; // Compare previously downloaded file timestamp with remote timestamp if (file_exists($local_file)) { if ($format == 'rsync') { $log = "\t\t\t\t( rsync )\t\tUpdate found\n"; pfb_logger("{$log}", 1); $pfb['update_cron'] = TRUE; unlink_if_exists("{$pfbfolder}/{$header}.txt"); return; } // Determine if URL is Remote or Local if (in_array($host['host'], array('127.0.0.1', $pfb['iplocal'], ''))) { clearstatcache(); $remote_tds = gmdate('D, d M Y H:i:s T', @filemtime($list_url)); } else { // Download URL headers and compare previously downloaded file with remote timestamp if (($ch = curl_init($list_url))) { curl_setopt_array($ch, $pfb['curl_defaults']); // Load curl default settings curl_setopt($ch, CURLOPT_NOBODY, true); // Exclude the body from the output curl_setopt($ch, CURLOPT_TIMEOUT, 60); // Allow downgrade of cURL settings if user configured if ($pflex == 'Flex') { curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); curl_setopt($ch, CURLOPT_SSL_CIPHER_LIST, 'TLSv1.2, TLSv1, SSLv3'); } // Try up to 3 times to download the file before giving up for ($retries = 1; $retries <= 3; $retries++) { if (curl_exec($ch)) { $remote_stamp_raw = curl_getinfo($ch, CURLINFO_FILETIME); break; // Break on success } sleep(3); } if ($remote_stamp_raw != -1) { $remote_tds = gmdate('D, d M Y H:i:s T', $remote_stamp_raw); } } else { $remote_stamp_raw = -1; } curl_close($ch); } // If remote timestamp not found, Attempt md5 comparison if ($remote_stamp_raw == -1) { // Collect md5 checksums $remote_md5 = @md5_file($list_url); $local_md5 = @md5_file($local_file); if ($remote_md5 != $local_md5) { $log = "\t\t\t\t( md5 changed )\t\tUpdate found\n"; pfb_logger("{$log}", 1); $pfb['update_cron'] = TRUE; unlink_if_exists("{$pfbfolder}/{$header}.txt"); return; } else { $log = "\t( No remote timestamp/md5 unchanged )\t\tUpdate not required\n"; pfb_logger("{$log}", 1); return; } } else { $log = " Remote timestamp: {$remote_tds}\n"; pfb_logger("{$log}", 1); clearstatcache(); $local_tds = gmdate('D, d M Y H:i:s T', @filemtime($local_file)); $log = " Local timestamp: {$local_tds}\t"; pfb_logger("{$log}", 1); if ("{$remote_tds}" != "{$local_tds}") { $pfb['cron_update'] = TRUE; } else { $log = "Update not required\n"; pfb_logger("{$log}", 1); $pfb['cron_update'] = FALSE; } } } else { $pfb['cron_update'] = TRUE; } if ($pfb['cron_update']) { // Trigger CRON process if updates are found. $pfb['update_cron'] = TRUE; $log = "Update found\n"; pfb_logger("{$log}", 1); unlink_if_exists("{$pfbfolder}/{$header}.txt"); } return; } // Download Extras - MaxMind/Alexa feeds via cURL function pfblockerng_download_extras($timeout=600) { global $pfb; $pfberror = FALSE; pfb_logger("\nDownload Process Starting [ NOW ]\n", 3); foreach ($pfb['extras'] as $feed) { $file_dwn = "{$feed['folder']}/{$feed['file_dwn']}"; if (!pfb_download($feed['url'], $file_dwn, FALSE, "{$feed['folder']}/{$feed['file']}", '', 3, '', $timeout)) { $log = "\nFailed to Download {$feed['file']}\n"; pfb_logger("{$log}", 3); // On install, if error found when downloading MaxMind Continent lists // Return error to install process to download archive from pfSense package repo if ($feed['install']) { $pfberror = TRUE; } } } pfb_logger("Download Process Ended [ NOW ]\n\n", 3); if ($pfberror) { return FALSE; } else { return TRUE; } } // Function to update Lists/Feeds as per Cron function pfblockerng_sync_cron() { global $config, $pfb, $pfbarr; // Call base hour converter $pfb_sch = pfb_cron_base_hour(); $hour = date('G'); $dow = date('N'); $pfb['update_cron'] = FALSE; $log = " CRON PROCESS START [ NOW ]\n"; pfb_logger("{$log}", 1); $list_type = array('pfblockernglistsv4' => '_v4', 'pfblockernglistsv6' => '_v6', 'pfblockerngdnsbl' => '_v4', 'pfblockerngdnsbleasylist' => '_v4'); foreach ($list_type as $ip_type => $vtype) { if (!empty($config['installedpackages'][$ip_type]['config'])) { foreach ($config['installedpackages'][$ip_type]['config'] as $list) { if (isset($list['row']) && $list['action'] != 'Disabled' && $list['cron'] != 'Never') { foreach ($list['row'] as $row) { if (!empty($row['url']) && $row['state'] != 'Disabled') { if ($vtype == '_v4') { $header = "{$row['header']}"; } else { $header = "{$row['header']}_v6"; } // Determine folder location for alias (return array $pfbarr) pfb_determine_list_detail($list['action'], '', '', ''); $pfbfolder = $pfbarr['folder']; $pfborig = $pfbarr['orig']; // Bypass update if state is defined as 'Hold' and list file exists if ($row['state'] == 'Hold' && file_exists("{$pfbfolder}/{$header}.txt")) { continue; } // Allow cURL SSL downgrade if user configured. $pflex = FALSE; if ($row['state'] == 'Flex') { $pflex = TRUE; } switch ($list['cron']) { case 'EveryDay': if ($hour == $pfb['24hour']) { pfb_update_check($header, $row['url'], $pfbfolder, $pfborig, $pflex, $row['format']); } break; case 'Weekly': if ($hour == $pfb['24hour'] && $dow == $list['dow']) { pfb_update_check($header, $row['url'], $pfbfolder, $pfborig, $pflex, $row['format']); } break; default: if ($pfb['interval'] == '1' || in_array($hour, $pfb_sch)) { pfb_update_check($header, $row['url'], $pfbfolder, $pfborig, $pflex, $row['format']); } break; } } } } } } } // If no lists require updates, check if Continents are configured and update accordingly. if (!$pfb['update_cron']) { foreach ($pfb['continents'] as $continent => $pfb_alias) { if (isset($config['installedpackages']['pfblockerng' . strtolower(str_replace(' ', '', $continent))]['config'])) { $continent_config = $config['installedpackages']['pfblockerng' . strtolower(str_replace(' ', '', $continent))]['config'][0]; if ($continent_config['action'] != 'Disabled') { $pfb['update_cron'] = TRUE; break; } } } } if ($pfb['update_cron']) { sync_package_pfblockerng('cron'); $pfb['update_cron'] = FALSE; } else { sync_package_pfblockerng('noupdates'); $log = "\n No Updates required.\n CRON PROCESS ENDED\n UPDATE PROCESS ENDED\n"; pfb_logger("{$log}", 1); } // Call log mgmt function // If Update GUI 'Manual view' is selected. Last output will be missed. So sleep for 5 secs. sleep(5); pfb_log_mgmt(); } // Function to process the downloaded MaxMind database and format into Continent txt files. function pfblockerng_uc_countries() { global $g, $pfb; $maxmind_cont = "{$pfb['geoipshare']}/country_continent.csv"; $maxmind_cc4 = "{$pfb['geoipshare']}/GeoIPCountryWhois.csv"; $maxmind_cc6 = "{$pfb['geoipshare']}/GeoIPv6.csv"; // Create folders if not exist $folder_array = array ("{$pfb['dbdir']}", "{$pfb['logdir']}", "{$pfb['ccdir']}"); foreach ($folder_array as $folder) { safe_mkdir ("{$folder}", 0755); } $now = date('m/d/y G:i:s', time()); $log = "Country code update Start [ NOW ]\n"; if (!$g['pfblockerng_install']) { print "Country code update Start [ $now ]\n"; } pfb_logger("{$log}", 3); if (!file_exists($maxmind_cont) || !file_exists($maxmind_cc4) || !file_exists($maxmind_cc6)) { $log = " [ MAXMIND UPDATE FAIL, CSV missing, using previous Country code database \n"; if (!$g['pfblockerng_install']) { print $log; } pfb_logger("{$log}", 3); return; } // Save Date/Time stamp to MaxMind version file $local_tds4 = @gmdate('D, d M Y H:i:s T', @filemtime($maxmind_cc4)); $local_tds6 = @gmdate('D, d M Y H:i:s T', @filemtime($maxmind_cc6)); $maxmind_ver = "MaxMind GeoLite Date/Time Stamps\n"; $maxmind_ver .= "Local_v4 \tLast-Modified: {$local_tds4}\n"; $maxmind_ver .= "Local_v6 \tLast-Modified: {$local_tds6}\n"; @file_put_contents("{$pfb['logdir']}/maxmind_ver", $maxmind_ver, LOCK_EX); // Collect ISO codes for each Continent $log = " Processing Continent Data\n"; if (!$g['pfblockerng_install']) { print $log; } pfb_logger("{$log}", 3); $cont_array = array(); if (($handle = fopen("{$maxmind_cont}", 'r')) !== FALSE) { while (($cc = fgetcsv($handle)) !== FALSE) { $cc_key = $cc[0]; $cont_key = $cc[1]; switch ($cont_key) { case 'AF': $cont_array[0]['continent'] = 'Africa'; $cont_array[0]['iso'] .= "{$cc_key},"; $cont_array[0]['file4'] = "{$pfb['ccdir']}/Africa_v4.txt"; $cont_array[0]['file6'] = "{$pfb['ccdir']}/Africa_v6.txt"; break; case 'AS': $cont_array[1]['continent'] = 'Asia'; $cont_array[1]['iso'] .= "{$cc_key},"; $cont_array[1]['file4'] = "{$pfb['ccdir']}/Asia_v4.txt"; $cont_array[1]['file6'] = "{$pfb['ccdir']}/Asia_v6.txt"; break; case 'EU': $cont_array[2]['continent'] = 'Europe'; $cont_array[2]['iso'] .= "{$cc_key},"; $cont_array[2]['file4'] = "{$pfb['ccdir']}/Europe_v4.txt"; $cont_array[2]['file6'] = "{$pfb['ccdir']}/Europe_v6.txt"; break; case 'NA': $cont_array[3]['continent'] = 'North America'; $cont_array[3]['iso'] .= "{$cc_key},"; $cont_array[3]['file4'] = "{$pfb['ccdir']}/North_America_v4.txt"; $cont_array[3]['file6'] = "{$pfb['ccdir']}/North_America_v6.txt"; break; case 'OC': $cont_array[4]['continent'] = 'Oceania'; $cont_array[4]['iso'] .= "{$cc_key},"; $cont_array[4]['file4'] = "{$pfb['ccdir']}/Oceania_v4.txt"; $cont_array[4]['file6'] = "{$pfb['ccdir']}/Oceania_v6.txt"; break; case 'SA': $cont_array[5]['continent'] = 'South America'; $cont_array[5]['iso'] .= "{$cc_key},"; $cont_array[5]['file4'] = "{$pfb['ccdir']}/South_America_v4.txt"; $cont_array[5]['file6'] = "{$pfb['ccdir']}/South_America_v6.txt"; break; } } } unset($cc); fclose($handle); // Add Maxmind Anonymous Proxy and Satellite Providers to array $cont_array[6]['continent'] = 'Proxy and Satellite'; $cont_array[6]['iso'] = 'A1,A2'; $cont_array[6]['file4'] = "{$pfb['ccdir']}/Proxy_Satellite_v4.txt"; $cont_array[6]['file6'] = "{$pfb['ccdir']}/Proxy_Satellite_v6.txt"; sort($cont_array); // Collect Country ISO data and sort to Continent arrays (IPv4 and IPv6) foreach (array('4', '6') as $type) { $log = " Processing ISO IPv{$type} Continent/Country Data\n"; if (!$g['pfblockerng_install']) { print $log; } pfb_logger("{$log}", 3); if ($type == '4') { $maxmind_cc = "{$pfb['geoipshare']}/GeoIPCountryWhois.csv"; } else { $maxmind_cc = "{$pfb['geoipshare']}/GeoIPv6.csv"; } $iptype = "ip{$type}"; $filetype = "file{$type}"; if (($handle = fopen("{$maxmind_cc}", 'r')) !== FALSE) { while (($cc = fgetcsv($handle)) !== FALSE) { $cc_key = $cc[4]; $country_key = $cc[5]; $a_cidr = implode(',', ip_range_to_subnet_array_temp($cc[0], $cc[1])); foreach ($cont_array as $key => $iso) { if (strpos($iso['iso'], $cc_key) !== FALSE) { $cont_array[$key][$cc_key][$iptype] .= "{$a_cidr},"; $cont_array[$key][$cc_key]['country'] = $country_key; continue; } } } } unset($cc); fclose($handle); // Build Continent files foreach ($cont_array as $key => $iso) { $header = $pfb_file = $iso_key = ''; $header .= '# Generated from MaxMind Inc. on: ' . date('m/d/y G:i:s', time()) . "\n"; $header .= "# Continent IPv{$type}: {$cont_array[$key]['continent']}\n"; $pfb_file = $cont_array[$key][$filetype]; $iso_key = array_keys($iso); foreach ($iso_key as $ikey) { if (strlen($ikey) == 2) { $header .= "# Country: {$iso[$ikey]['country']}\n"; $header .= "# ISO Code: {$ikey}\n"; $header .= '# Total Networks: ' . substr_count($iso[$ikey][$iptype], ',') . "\n"; $header .= str_replace(',', "\n", $iso[$ikey][$iptype]); $iso[$ikey][$iptype] = ''; } } @file_put_contents($pfb_file, $header, LOCK_EX); } } } // Function to process Continent txt files and create Country ISO files and to Generate GUI XML files. function pfblockerng_get_countries() { global $g, $pfb; $files = array ( 'Africa' => "{$pfb['ccdir']}/Africa_v4.txt", 'Asia' => "{$pfb['ccdir']}/Asia_v4.txt", 'Europe' => "{$pfb['ccdir']}/Europe_v4.txt", 'North America' => "{$pfb['ccdir']}/North_America_v4.txt", 'Oceania' => "{$pfb['ccdir']}/Oceania_v4.txt", 'South America' => "{$pfb['ccdir']}/South_America_v4.txt", 'Proxy and Satellite' => "{$pfb['ccdir']}/Proxy_Satellite_v4.txt" ); // Collect data to generate new continent XML files. $log = " Building pfBlockerNG XML Files \n"; if (!$g['pfblockerng_install']) { print $log; } pfb_logger("{$log}", 3); foreach ($files as $cont => $file) { // Process the following for IPv4 and IPv6 foreach (array('4', '6') as $type) { $log = " IPv{$type} {$cont}\n"; if (!$g['pfblockerng_install']) { print $log; } pfb_logger("{$log}", 3); if ($type == '6') { $file = str_replace('v4', 'v6', $file); } $convert = explode("\n", file_get_contents($file)); $cont_name = str_replace(' ', '', $cont); $cont_name_lower = strtolower($cont_name); $active = array("$cont" => ''); $lastkey = count($convert) - 1; $pfb['complete'] = FALSE; $keycount = 1; $total = 0; $xml_data = ''; foreach ($convert as $line) { if (substr($line, 0, 1) == '#') { if ($pfb['complete']) { ${'coptions' . $type}[] = "{$country}-{$isocode} ({$total}){$isocode}"; // Only collect IPv4 for Reputation Tab if ($type == '4') { $roptions4[] = "{$country}-{$isocode} ({$total}){$isocode}"; } // Save ISO data @file_put_contents("{$pfb['ccdir']}/{$isocode}_v{$type}.txt", $xml_data, LOCK_EX); // Clear variables and restart Continent collection process unset($total, $xml_data); $pfb['complete'] = FALSE; } // Don't collect Countries with null data if (strpos($line, 'Total Networks: 0') !== FALSE) { continue; } if (strpos($line, 'Country: ') !== FALSE) { $country = str_replace('# Country: ', '', $line); } if (strpos($line, 'ISO Code: ') !== FALSE) { $isocode = str_replace('# ISO Code: ', '', $line); } } elseif (substr($line, 0, 1) != '#') { $total++; if (!empty($line)) { $xml_data .= "{$line}\n"; } $pfb['complete'] = TRUE; } // Save last EOF ISO IP data if ($keycount == $lastkey) { // Don't collect Countries with null data if (strpos($line, 'Total Networks: 0') !== FALSE) { continue; } ${'coptions' . $type}[] = "{$country}-{$isocode} ({$total}){$isocode}"; if ($type == '4') { $roptions4[] = "{$country}-{$isocode} ({$total}){$isocode}"; } @file_put_contents("{$pfb['ccdir']}/{$isocode}_v{$type}.txt", $xml_data, LOCK_EX); unset($total, $xml_data); } $keycount++; } unset ($ips, $convert); // Sort IP Countries alphabetically and build XML data for Continents tab if (!empty(${'coptions' . $type})) { sort(${'coptions' . $type}, SORT_STRING); ${'ftotal' . $type} = count(${'coptions' . $type}); $count = 1; ${'options' . $type} = ''; foreach (${'coptions' . $type} as $option) { if ($count == 1) { ${'options' . $type} .= "\t{$option}\n"; $count++; continue; } if (${'ftotal' . $type} == $count) { ${'options' . $type} .= "\t\t\t\t{$option}"; } else { ${'options' . $type} .= "\t\t\t\t{$option}\n"; } $count++; } } unset(${'coptions' . $type}); } $xml = << Describe your package here Describe your package requirements here Currently there are no FAQ items provided. pfblockerng{$cont_name_lower} 1.0 /usr/local/pkg/pfblockerng/pfblockerng.inc pfBlockerNG: Save {$cont} settings pfBlockerNG: {$cont_name} Configure pfBlockerNG

Firewall

pkg_edit.php?xml=pfblockerng_{$cont_name_lower}.xml General /pkg_edit.php?xml=pfblockerng.xml Update /pfblockerng/pfblockerng_update.php Alerts /pfblockerng/pfblockerng_alerts.php Reputation /pkg_edit.php?xml=/pfblockerng/pfblockerng_reputation.xml IPv4 /pkg.php?xml=/pfblockerng/pfblockerng_v4lists.xml IPv6 /pkg.php?xml=/pfblockerng/pfblockerng_v6lists.xml DNSBL /pkg_edit.php?xml=/pfblockerng/pfblockerng_dnsbl.xml Country /pkg_edit.php?xml=/pfblockerng/pfblockerng_top20.xml Top 20 /pkg_edit.php?xml=/pfblockerng/pfblockerng_top20.xml 2 {$active['top']} Africa /pkg_edit.php?xml=/pfblockerng/pfblockerng_Africa.xml 2 {$active['Africa']} Asia /pkg_edit.php?xml=/pfblockerng/pfblockerng_Asia.xml 2 {$active['Asia']} Europe /pkg_edit.php?xml=/pfblockerng/pfblockerng_Europe.xml 2 {$active['Europe']} North America /pkg_edit.php?xml=/pfblockerng/pfblockerng_NorthAmerica.xml 2 {$active['North America']} Oceania /pkg_edit.php?xml=/pfblockerng/pfblockerng_Oceania.xml 2 {$active['Oceania']} South America /pkg_edit.php?xml=/pfblockerng/pfblockerng_SouthAmerica.xml 2 {$active['South America']} Proxy and Satellite /pkg_edit.php?xml=/pfblockerng/pfblockerng_ProxyandSatellite.xml 2 {$active['Proxy and Satellite']} Logs /pfblockerng/pfblockerng_log.php Sync /pkg_edit.php?xml=/pfblockerng/pfblockerng_sync.xml listtopic LINKS Firewall Alias  Firewall Rules Firewall Logs]]> info countries4 Countries
Use CTRL + CLICK to select/unselect countries]]> select ${'options4'} ${'ftotal4'} EOF; // Adjust combinefields variable if IPv6 is empty. if (!empty (${'options6'})) { $xml .= <<
IPv4 Countries]]> begin EOF; } else { $xml .= <<IPv4 Countries]]> EOF; } // Skip IPv6 when Null data found if (!empty (${'options6'})) { $xml .= << countries6 IPv6 Countries]]> select ${'options6'} ${'ftotal6'} end EOF; } $xml .= << List Action Default: Disabled

Select the Action for Firewall Rules on lists you have selected.

'Disabled' Rules: Disables selection and does nothing to selected Alias.

'Deny' Rules:
'Deny' rules create high priority 'block' or 'reject' rules on the stated interfaces. They don't change the 'pass' rules on other interfaces. Typical uses of 'Deny' rules are:

• Deny Both - blocks all traffic in both directions, if the source or destination IP is in the block list
• Deny Inbound/Deny Outbound - blocks all traffic in one direction unless it is part of a session started by traffic sent in the other direction. Does not affect traffic in the other direction.
• One way 'Deny' rules can be used to selectively block unsolicited incoming (new session) packets in one direction, while still allowing deliberate outgoing sessions to be created in the other direction.

'Permit' Rules:
'Permit' rules create high priority 'pass' rules on the stated interfaces. They are the opposite of Deny rules, and don't create any 'blocking' effect anywhere. They have priority over all Deny rules. Typical uses of 'Permit' rules are:

• To ensure that traffic to/from the listed IPs will always be allowed in the stated directions. They override almost all other Firewall rules on the stated interfaces.
• To act as a whitelist for Deny rule exceptions, for example if a large IP range or pre-created blocklist blocks a few IPs that should be accessible.

'Match' Rules:
'Match' or 'Log' only the traffic on the stated interfaces. This does not Block or Reject. It just Logs the traffic.

• Match Both - Matches all traffic in both directions, if the source or destination IP is in the list.
• Match Inbound/Match Outbound - Matches all traffic in one direction only.

'Alias' Rules:
'Alias' rules create an alias for the list (and do nothing else). This enables a pfBlockerNG list to be used by name, in any firewall rule or pfSense function, as desired.

• Options  - Alias Deny,  Alias Permit,  Alias Match,  Alias Native


• 'Alias Deny' can use De-Duplication and Reputation Processes if configured.


• 'Alias Permit' and 'Alias Match' will be saved in the Same folder as the other Permit/Match Auto-Rules


• 'Alias Native' lists are kept in their Native format without any modifications.

Note:

When manually creating 'Alias' type firewall rules; Do not add (pfB_) to the start of the rule description, use (pfb_) (Lowercase prefix). Manually created 'Alias' rules with 'pfB_' in the description will be auto-removed by package when 'Auto' rules are defined.

]]> action select DisabledDisabled Deny InboundDeny_Inbound Deny OutboundDeny_Outbound Deny BothDeny_Both Permit InboundPermit_Inbound Permit OutboundPermit_Outbound Permit BothPermit_Both Match InboundMatch_Inbound Match OutboundMatch_Outbound Match BothMatch_Both Alias DenyAlias_Deny Alias PermitAlias_Permit Alias MatchAlias_Match Alias NativeAlias_Native Enable Logging aliaslog Enable
Select - Logging to Status: System Logs: FIREWALL ( Log )
This can be overriden by the 'Global Logging' Option in the General Tab.]]> select Enableenabled Disabledisabled Advanced Inbound Firewall Rule Settings listtopic info Note:  In general, Auto-Rules are created as follows:

Inbound  - 'any' port, 'any' protocol, 'any' destination and 'any' gateway

Configuring the Adv. Inbound Rule settings, will allow for more customization of the Inbound Auto-Rules.]]> Invert Source autoaddrnot_in Invert - Option to invert the sense of the match. ie - Not (!) Source Address(es)]]> checkbox Enable Custom Port autoports_in checkbox aliasports_in begin Define Alias aliasports_in Click Here to add/edit Aliases Do not manually enter port numbers.
Do not use 'pfB_' in the Port Alias name.]]> 21 aliases port end Enable Custom Destination autoaddr_in checkbox aliasaddr_in,autonot_in begin aliasaddr_in Click Here to add/edit Aliases Do not manually enter Addresses(es).
Do not use 'pfB_' in the 'IP Network Type' Alias name.]]> 21 aliases network Invert autonot_in Invert - Option to invert the sense of the match.
ie - Not (!) Destination Address(es)]]> checkbox end Custom Protocol autoproto_in Default: any
Select the Protocol used for Inbound Firewall Rule(s).
Do not use 'any' with Adv. Inbound Rules as it will bypass these settings!]]> select any TCPtcp UDPudp TCP/UDPtcp/udp 4 Custom Gateway agateway_in 1 select_source name name default default Advanced Outbound Firewall Rule Settings listtopic info Note:  In general, Auto-Rules are created as follows:

Outbound  - 'any' port, 'any' protocol, 'any' destination and 'any' gateway

Configuring the Adv. Outbound Rule settings, will allow for more customization of the Outbound Auto-Rules.]]> Invert Destination autoaddrnot_out Invert - Option to invert the sense of the match. ie - Not (!) Destination Address(es)]]> checkbox Enable Custom Port autoports_out checkbox aliasports_out begin Define Alias aliasports_out Click Here to add/edit Aliases Do not manually enter port numbers.
Do not use 'pfB_' in the Port Alias name.]]> 21 aliases port end Enable Custom Source autoaddr_out checkbox aliasaddr_out,autonot_out begin aliasaddr_out Click Here to add/edit Aliases Do not manually enter Addresses(es).
Do not use 'pfB_' in the 'IP Network Type' Alias name.]]> 21 aliases network Invert autonot_out Invert - Option to invert the sense of the match.
ie - Not (!) Destination Address(es)]]> checkbox end Custom Protocol autoproto_out Default: any
Select the Protocol used for Outbound Firewall Rule(s).
Do not use 'any' with Adv. Outbound Rules as it will bypass these settings!]]> select any TCPtcp UDPudp TCP/UDPtcp/udp 4 Custom Gateway agateway_out 1 select_source name name default default Click to SAVE Settings and/or Rule Edits.   Changes are Applied via CRON or 'Force Update']]> listtopic pfblockerng_validate_input(\$_POST, \$input_errors); global \$pfb; \$pfb['save'] = TRUE; sync_package_pfblockerng(); EOF; // Update each Continent XML file. @file_put_contents('/usr/local/pkg/pfblockerng/pfblockerng_'.$cont_name.'.xml', $xml,LOCK_EX); // Unset Arrays unset (${'options4'}, ${'options6'}, $xml); } // End foreach 'Six Continents and Proxy/Satellite' update XML process // Sort Countries IPv4 alphabetically and build XML data for Reputation tab (IPv6 not used by ET IQRisk) sort($roptions4, SORT_STRING); $eoa = count($roptions4); $etoptions = ''; $count = 1; foreach ($roptions4 as $option4) { if ($count == 1) { $et_options .= "\t{$option4}\n"; $count++; continue; } if ($eoa == $count) { $et_options .= "\t\t\t\t{$option4}"; } else { $et_options .= "\t\t\t\t{$option4}\n"; } $count++; } // Update pfBlockerNG_Reputation.xml file with Country Code changes $xmlrep = << Describe your package here Describe your package requirements here Currently there are no FAQ items provided. pfblockerngreputation 1.0 /usr/local/pkg/pfblockerng/pfblockerng.inc pfBlockerNG: Save Reputation Settings pfBlockerNG Configure pfblockerNG

Firewall

pkg_edit.php?xml=pfblockerng.xml General /pkg_edit.php?xml=pfblockerng.xml Update /pfblockerng/pfblockerng_update.php Alerts /pfblockerng/pfblockerng_alerts.php Reputation /pkg_edit.php?xml=/pfblockerng/pfblockerng_reputation.xml IPv4 /pkg.php?xml=/pfblockerng/pfblockerng_v4lists.xml IPv6 /pkg.php?xml=/pfblockerng/pfblockerng_v6lists.xml DNSBL /pkg_edit.php?xml=/pfblockerng/pfblockerng_dnsbl.xml Country /pkg_edit.php?xml=/pfblockerng/pfblockerng_top20.xml Logs /pfblockerng/pfblockerng_log.php Sync /pkg_edit.php?xml=/pfblockerng/pfblockerng_sync.xml IPv4 Reputation Preface listtopic LINKS Firewall Alias  Firewall Rules Firewall Logs]]> info Why Reputation Matters:]]> info Reputation', each Blocklist will be analyzed for Repeat Offenders in each IP Range.

Example:  x.x.x.1, x.x.x.2, x.x.x.3, x.x.x.4, x.x.x.5
No. of Repeat Offending IPs [  5  ], in a Blocklist within the same IP Range.

With 'Reputation enabled, these 5 IPs will be removed and a single x.x.x.0/24 Block is used.
This will completely Block/Reject this particular range from your Firewall.

Selecting Blocklists from various Threat Sources will help to highlight Repeat Offending IP Ranges,
Its Important to select a Broad Range of Blocklists that cover different types of Malicious Activity.

You *may* experience some False Positives. Add any False Positive IPs manually to the
pfBlockerNGSuppress Alias or use the "+" suppression Icon in the Alerts TAB

To help mitigate False Positives 'Countries' can be 'Excluded' from this Process. (Refer to Country Code Settings)

Enabling De-Duplication is highly recommended before utilizing 'Reputation' processes.]]> Reputation Settings: listtopic Individual List Reputation

]]> info enable_rep checkbox Each Individual Blocklist]]> Max ] Setting]]> p24_max_var 5
Maximum number of Repeat Offenders allowed in a Single IP Range]]> select 55 1010 1515 2020 2525 5050 Collective List Reputation

]]> info info [ pMax ] and [ dMax ]
Can be used to Further analyze for Repeat Offenders.

Analyzing All Blocklists as a Whole:

[ pMax ] will analyze for Repeat Offenders in each IP Range but will not use the Country Exclusion.
Default is 50 IPs in any Range. Having 50 Repeat Offenders IPs in any Range will Block the entire Range.

[ dMax ] will analyze for Repeat Offenders in each IP Range. Country Exclusions will be applied.
Default is 5 IPs in any Range.

Note: MAX performs on individual Blocklists, while pMAX / dMAX perform on all Lists together.
]]> Enable pMAX enable_pdup checkbox Without Country Code Exclusion]]> pMax ] Setting]]> p24_pmax_var 50
Maximum number of Repeat Offenders]]> select 5050 2525 2020 1515 1010 55 Enable dMAX enable_dedup checkbox Using Country Code Exclusion]]> dMax ] Setting]]> p24_dmax_var 5
Maximum number of Repeat Offenders]]> select 55 1010 1515 2020 2525 5050 Country Code Settings (max/dMax) listtopic info ignore Repeat Offenders in select Countries. The Original Blocklisted IPs remain intact. All other Repeat Offending Country Ranges will be processed.

Define Repeat Offending Ranges [ Action ] Available settings are:

Ignore: Repeat Offenders that are in the 'ccwhite' category will be 'Ignored' (Default)

Block: Repeat Offenders are set to Block the entire Repeat Offending Range(s)

Match: Repeat Offenders are added to a 'Match' List which can be used in a Floating Match Rule
Selecting 'Match' will consume more processing time, so only select this option if you enable Rules for it.

'ccwhite' are Countries that are Selected to be excluded from the Repeat Offenders Search.
'ccblack' are all other Countries that are not selected.

To use 'Match' Lists, Create a new 'Alias' and select one of the Action 'Match' Formats and
enter the 'Localfile' as:

/var/db/pfblockerng/match/matchdedup.txt

]]> ccwhite Action: ccwhite Ignore
Select the 'Action' format for ccwhite]]> select Ignoreignore Matchmatch ccblack Action: ccblack Block
Select the 'Action' format for ccblack]]> select Blockblock Matchmatch IPv4
Country Exclusion

Geolite Data by:
MaxMind Inc. (ISO 3166)]]> ccexclude Exclude from the Reputation Process.
Use CTRL + CLICK to select/unselect countries]]> select {$et_options} 20 Proofpoint ET IQRISK IPv4 Reputation listtopic Subscription Pro. Blocklist info Proofpoint ET IQRisk is a Subscription Professional Reputation List.

The URL must include the name 'iprepdata.txt' for the filename.
ET IQRisk Blocklist must be entered in the Lists Tab using the following example:

https://rules.emergingthreatspro.com/XXXXXXXXXXXXXXXX/reputation/iprepdata.txt.gz

Select the ET IQRisk' format. The URL should use the .gz File Type.
Enter your "ETPRO" code in URL. Further information can be found @ Proofpoint IQRisk

To use 'Match' Lists, Create a new 'Alias' and select one of the Action 'Match' Formats and
enter the 'Localfile' as:

/var/db/pfblockerng/match/ETMatch.txt

ET IQRisk Individual Match Lists can be found in the following folder:

/var/db/pfblockerng/ET

]]> ET IQRisk Header Name et_header input This will be used to improve the Alerts TAB reporting for ET IPRep.]]> ET IQRISK BLOCK LISTS etblock Use CTRL + CLICK to select/unselect Categories

Any Changes will take effect at the Next Scheduled CRON Task]]> select ET CNCET_Cnc ET BOTET_Bot ET SPAMET_Spam ET DROPET_Drop ET Spyware CNCET_Spywarecnc ET Online GamingET_Onlinegaming ET DrivebySRCET_Drivebysrc ET Chat ServerET_Chatserver ET TOR NodeET_Tornode ET CompromisedET_Compromised ET P2PET_P2P ET ProxyET_Proxy ET IP CheckET_Ipcheck ET UtilityET_Utility ET DOSET_DDos ET ScannerET_Scanner ET BruteET_Brute ET Fake AVET_Fakeav ET DYN DNSET_Dyndns ET UndersireableET_Undesireable ET Abuse TLDET_Abusedtld ET SelfSigned SSLET_Selfsignedssl ET BlackholeET_Blackhole ET RASET_RAS ET P2P CNCET_P2Pcnc ET Shared HostingET_Sharedhosting ET ParkingET_Parking ET VPNET_VPN ET EXE SourceET_Exesource ET Mobile CNCET_Mobilecnc ET Mobile SpywareET_Mobilespyware ET Skype NodeET_Skypenode ET BitcoinET_Bitcoin ET DOS AttackET_DDosattack UnknownET_Unknown 35 ET IQRISK Match LISTS etmatch Use CTRL + CLICK to select/unselect Categories

Any Changes will take effect at the Next Scheduled CRON Task]]> select ET CNCET_Cnc ET BOTET_Bot ET SPAMET_Spam ET DROPET_Drop ET Spyware CNCET_Spywarecnc ET Online GamingET_Onlinegaming ET DrivebySRCET_Drivebysrc ET Chat ServerET_Chatserver ET TOR NodeET_Tornode ET CompromisedET_Compromised ET P2PET_P2P ET ProxyET_Proxy ET IP CheckET_Ipcheck ET UtilityET_Utility ET DOSET_DDos ET ScannerET_Scanner ET BruteET_Brute ET Fake AVET_Fakeav ET DYN DNSET_Dyndns ET UndersireableET_Undesireable ET Abuse TLDET_Abusedtld ET SelfSigned SSLET_Selfsignedssl ET BlackholeET_Blackhole ET RASET_RAS ET P2P CNCET_P2Pcnc ET Shared HostingET_Sharedhosting ET ParkingET_Parking ET VPNET_VPN ET EXE SourceET_Exesource ET Mobile CNCET_Mobilecnc ET Mobile SpywareET_Mobilespyware ET Skype NodeET_Skypenode ET BitcoinET_Bitcoin ET DOS AttackET_DDosattack UnknownET_Unknown 35 Update ET Categories et_update Disable
Select - Enable ET Update if Category Changes are Made.
You can perform a 'Force Update' to enable these changes.
Cron will also resync this list at the next Scheduled Update.]]> select Disabledisabled Enableenabled Click to SAVE Settings and/or Rule Edits.   Changes are Applied via CRON or 'Force Update']]> listtopic pfblockerng_validate_input(\$_POST, \$input_errors); global \$pfb; \$pfb['save'] = TRUE; sync_package_pfblockerng(); EOF; $log = " Saving pfBlockerNG Reputation TAB\n"; if (!$g['pfblockerng_install']) { print $log; } pfb_logger("{$log}", 3); // Save pfBlockerng_reputation.xml file @file_put_contents('/usr/local/pkg/pfblockerng/pfblockerng_reputation.xml', $xmlrep, LOCK_EX); $now = date('m/d/y G.i:s', time()); $log = "Country Code Update Ended - [ NOW ]\n\n"; if (!$g['pfblockerng_install']) { print "Country Code Update Ended - [ $now ]\n\n"; } pfb_logger("{$log}", 3); // Unset arrays unset ($roptions4, $et_options, $xmlrep); } ?>