All right,
and now it's time to go ahead and take care of that third use case
that we're going to talk about in this course,
which is blocking malicious domains with pfSense.
And so this use case can be used to block so many
different types of domains and attacks even,
so we can block known malware‑hosting domains,
we can block known Tor sites, we can block BitTorrent sites,
and so on and so forth.
So,
dynamic blocklists really allow us to expand the capabilities of our
firewalls to be able to support some of our security practices.
And so with this one,
we're going to go ahead and install a package called pfblocker,
and we're going to do the devel version,
since this is the one that's maintained better than the original one,
and we'll go ahead and sit here and let this install for a minute.
All right, and now that pfblocker's installed,
let's go over to it and check it out real quick.
Now,
this is a really cool tool that we can use to help us dynamically block threats.
So, in the firewall section,
we're going to go to pfblocker, and the first thing we want
to do is just make sure it's enabled, which it is.
So we'll leave all these the default, and where I want
to go to next is the feed section.
Now this is where we get to choose some of the built‑in feeds that pfSense has.
As you can see,
I've already downloaded some of these for the PRI1 alias or the group,
and this is a lot of commonly used blocklists today,
So we have the Internet Storm Center from SANS, we have
Spamhaus, and Talos, and other abuse lists.
We can go through and add any of these other ones as well if we wanted to.
So, for example,
the Internet Storm Center SCANNERS one, we can go ahead and add that
and enable all of those block lists to download.
Now the action for this would be an alias deny. We can
configure this to update these blocklists dynamically every
hour, or once a day, or so on and so forth.
That way, we always have the most up to date rules,
if possible. So let's just save that, and then let's go up to Update and
make sure that that stuff downloads. Now we can force the update by just
clicking update right here, alternatively,
we could just wait and have it download whenever the
CRON job's supposed to download,
which currently I have it set to every hour for one of my aliases.
So, the process ended,
and we've downloaded all of our updates to the tables and the blocklists.
What's next is we have to go look at the firewall rules to
see if they're configured for this or not.
And so, let's go over to firewall and look at the rules, we're
going over to the LAN section since this is going to be a
blocklist for the LANs, and as you can see,
we have two rules that are added into here.
If we hover over those, we can see that all of these IP
addresses have been downloaded to the blocklist,
and the blocklists are listed up there.
And so let's just randomly pick one of these to test out on our test host,
let's say 1.179.220.36, and so let's go over to our host,
and first let's verify that we're on our internal Globomantics network,
which we should be, this is the 30.3 address.
We've just changed the network from that external partner network that
we were using in the previous demo to this one here.
Now let's go back over here and validate that IP
address that we're going to use, and it's the 1.179.220.36.
So let's try to navigate to that from here, and we can even try
to remove the HTTPS part of the protocol to see if that helps,
and I did not want to do that.
All right, and as you can see, it didn't pull up.
Now let's go check our firewall logs.
So what I want to do is go over to the pfblocker app again, or
package again, and I want to go to the reports to see if we've
been able to block anything.
And as you could see,
we have all of these alerts saying that we were blocked trying to get to a
known malicious site. So, that 1.179.220.36 was in the blocklist, we have the
rule that it was hit, the times that it was hit,
what the source address and port numbers were, and
which feed it came from as well.
We can also look at the IP block stats if we wanted to get a
historical listing of all of the blocks that we have from
these blocklists, and as you can see, we have quite a few from today already.
And we have the users or the hosts that have been trying
to get to those addresses and what the addresses were that
they were trying to get to.
So, what's really cool about this pfblocker application or
package is that you can add on this kind of dynamic blocklist
capability to your pfSense firewall.
And now,
if we had blocklists for both known and assumed malware
sites or anonymity networks, or C2 networks,
then we can have those automatically download to pfSense, and with
that one rule that was created as a result of it,
we can block all of the users that are behind that
firewall from accessing those sites.
So, that means your internal users won't be able to use BitTorrent, they won't
be able to connect to Tor networks, they won't be able to establish VPN
connections to try to circumvent your security controls.
Having this DNS blocker in here really allows us to mitigate certain attacks,
and this is part of that MITRE Shield the framework too, that
allows us to prevent network manipulation.