Block Malicious Traffic with OPNsense and IP Blocklists

[@dino.hurricane978]

Great explanation, tutorial and energy! Thank you.

[@roblatour3511]

Thanks very informative; to date I have been using the unbound service in opnsense to identify and manage blocklists - this looks like a good alternative - any insights on which might be more efficient?

[@levivanstedum6392]

That actually seems like a better approach as long as you are using your router for DNS resolving. Thanks for the tip, I wasn’t aware of that option in the unbound tab

[@Jorvs]

can you use the website links list he shows in the video? to block those in the link list using unbound in opnsense?

[@Kilzu1]

@@Jorvs Yes you can, custom lists for unbound can be added in advanced settings (click "advanced mode" option in unbound blocklist section, and you'll be able to add any URL containing blocklists to it)

[@Kilzu1]

@@Jorvs oh forgot to mention that unbound doesn't support IP addresses in plain text format. You have to use DNS lists (lists like there are for BIND). Now just be mindful what you add and what you don't, lists like these can contain things like steam and other services, which will prevent them from working. Afterall this kind of filters are used mostly on school, library and enterprise networks

[@faisaltaufiqAbdi]

which one is better? , to put opnsense before mikrotik or to put opnsense after mikrotik, the purpose is to protect Local Area Network and server, thanks before

[@wizdude]

Your second example using Proofpoint to block from the LAN outbound has the wrong direction. It should be LAN direction “IN” because you want to block a host on your local LAN speaking “IN” to the LAN interface on the firewall. If you choose “OUT” then you are saying the items in the blocklist live on your local network. Alternatively you could also do this rule on the WAN interface as direction “OUT” which would work as well. My preference would be to put it on the LAN interface as you have indicated.

[@ecotts]

Is it OUT on the LAN or in? Surely if the WAN is protected on the IN your devices on your LAN are effectively protected from incoming bad IPs, if however you've got a virus, malware, IOT device or something that's managed to make its way on to a device on your LAN device via a USB stick or something trying to call home, surely you would want the LAN rule to be protected going outbound to the WAN to break connection and stop it no? Plus if its outbound on the LAN rule wouldn't it be easier to identify the exact device which is trying to dial OUT?

[@kyleg3433]

@@ecotts I believe Opnsense firewall treats "IN" as anything going to the firewall to another network (E.g. WAN or another Local VLAN). Thus what Wiz dude was saying is correct, use IN on the Lan side as well. Opnsense is also apparently more efficient processing "IN" rules. This is something about processing double packets on the OUT rule.

[@Kilzu1]

​@@kyleg3433 For LAN, you need to block IN traffic in most cases. You would have to use out, if you want to for example block uploading files cloud but still be able to download them and/or just browse cloud shares or video streams etc.

[@daanmageddon]

Good remark, opnsense is a bit strange in its terminology sometimes. Coming from openwrt, things like block and reject are ambiguous, i think the netfilter/iptables terminology is more clear: you either DROP the packet or you REJECT it. Opnsense had to call it block and reject instead (why stick with reject but make the other option "block"?). Your remark on the "source interface" is another example, looking at openwrt again; no interfaces but rather zones (logical collections of interfaces). interfaces are optional. When talking about openwrt, interfaces and direction of traffic it is the way you describe (and more clear imho). I have to admit that is all rather confusing and when i moved from openwrt to opensense recently i found i needed to prevent myself from getting a false sense of security by implementing rules with unclear/ambiguous terminology. I didn't even bother spending much time figuring that out, instead i went straight to floating rules which make things more clear (imho): as an (related, similar) example: setup an alias to include any local network, e.g. "locally_managed_networks". Put all the local "__lan_network", "__openvpn_network" (pre-defined local networks) etc in there. The floating rule will just be: incoming on any interface, source: "locally_managed_networks" (the network group alias we just created), destination interface: any, destination address: the blocklist alias, action: reject. Why reject? Because that will make troubleshooting easier in the future and i trust my local hosts to a degree that i am ok with them getting "destination denied"-like response from the gateway, instead of being silent and blocking (dropping!) the traffic. If you go a step further and mirror the rule you will want to block(drop) the traffic, because we obviously do not trust any of the hosts on that blocklist alias, we don't want them to get any response when trying to reach out to us.

[@mpssantos1]

Thank you very much, I loved the video. Congratulations Brazil - Sao Paulo

[@infinit3i]

so happy to have set this up!

[@AncientAmerican]

The haus part of Spamhaus is pronounced "house" not hoss (nod to Dan Blocker, the greatest Hoss). The use of haus in English (later spelled house) is a result of English's Proto-Germanic ancestry. The haus spelling is often used to add flair or charm to a name. Like using the archaic spelling of shoppe as shop. FYI for anyone wanting to say it correctly after watching this video.

[@asek2]

How to check if the IP list has been downloaded and how to test if it works?

[@lOBO-li5vb]

I don't understand, why would you add this rule in the WAN interface, if you do not have any pass rule? All incoming connections on the WAN interface will be blocked by default until pass rules are added. These two rules (GEoIP and BL_spam) should be added in your LAN and or subnets

[@SomeoneTookMyHandle]

came here to say this

[@QuantumByteHub]

why not using floating rules for in and out?

[@Jorvs]

is there any opnsense features or plugin that works like an PI hole? like a DNS hole?

[@svenwilhelm3942]

yes, the Unbound DNS blocklist feature

[@ecotts]

@PhasedLogix IT Services keep up the OPNsense videos man as it appears that more and more people are gradually realising that Netgate isn't as community orientated as they once appeared and as such more and more people are wanting to jump ship from PFsense but are afraid to because their are little to no decent OPNsense tutorials out there. 😂

[@PowerUsr1]

As a twist i created the Alias containing multiple URLs and created a floating rule for all my interfaces

[@leedress2187]

Im looking to use this as an edge router. Ie: isp provider address on the wan side, my ip block on the lan side. I haven't started testing any of it yet. Is there an "any any permit" rule that can be used after the block rules? I need to be able to allow all traffic in to my local wan addresses.

[@leedress2187]

The answer is yes in case anyone is reading this.

[@over-there]

I tried doing it manually, couldnt get it to work.

[@nullnull9877]

Thanks Sir

[@GetMeTheGeek]

You're welcome

[@huseyinparmaksiz944]

thnx 👌

[@lencumbow]

Opnsense blocks all Inbound wan traffic by default. why do I need inbound firewall rules on my wan?