6 ms·

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use p

I have thought about moving from pfsense to opnsense but in my test install I had a feeling it has fewer features (and messy UI). For example something I use pretty heavily is pfblocker that automatically geo-blocks ips from different countries that most attack my homelab (Russia, USA, china ,etc..) from accessing my homelab Is there something like this on opnsense?

alias_neo 3y ago
This is important for me too. From my searching, they have "GeoIP aliases" which is supposed to be their alternative to PfBlocker-NG; I have no idea if/how it functions as I haven't made the mode yet, but this is a deal breaker if it doesn't work the way I need.
- BLKNSLVR 3y ago
  It works as far as I can tell. I use it, and the logs show that it blocks connections to and from IP addresses associated with the selected countries.
  - alias_neo 3y ago
    Excellent, thanks for the confirmation.
LeoPanthera 3y ago
OPNsense supports blocklists in Unbound: https://docs.opnsense.org/manual/unbound.html#blocklists https://docs.opnsense.org/manual/unbound.html#blocklists However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense. Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.
- alias_neo 3y ago
  No, there is a feature in Pfsense with Pf-Blocker-NG where you can open a port to a service as usual, say a web-server, then use an alias for the source address to only allow incoming connections from, say, your own country. Useful for if you're roaming around and need access to that service from your laptop/mobile without a VPN, but also prevents attacks from countries you're unlikely to access it from.
fostware 3y ago
Aliases can consist of one or more countries (tick boxes) pulled from MaxMind's GeoIP DB. Doesn't use ASN-based sources unfortunately. Can be used in source and destination networks, IPv4&/IPv6 , just like pfSense.
BLKNSLVR 3y ago
I use it on OPNSense and it seems to work fine. There may be a Megamind (edit: MaxMind, not Megamind) account plugin setup out something to get it going, but if I worked it out, then you should be right. I use it to flat out block all incoming and outgoing connections to a certain small group of countries. More out of curiosity than necessity. It's also got a Crowdstrike interface for more dynamic blocking.

alias_neo 3y ago

This is important for me too. From my searching, they have "GeoIP aliases" which is supposed to be their alternative to PfBlocker-NG; I have no idea if/how it functions as I haven't made the mode yet, but this is a deal breaker if it doesn't work the way I need.

BLKNSLVR 3y ago
It works as far as I can tell. I use it, and the logs show that it blocks connections to and from IP addresses associated with the selected countries.
- alias_neo 3y ago
  Excellent, thanks for the confirmation.

LeoPanthera 3y ago

OPNsense supports blocklists in Unbound: https://docs.opnsense.org/manual/unbound.html#blocklists https://docs.opnsense.org/manual/unbound.html#blocklists However what you're saying doesn't make any sense. All incoming connections, from anywhere, are blocked by default. That's true in both pfSense and OPNsense. Are you saying that you allow all incoming connections, but then block specific countries? Because that's mad, and given the existence of VPNs, pointless.

alias_neo 3y ago
No, there is a feature in Pfsense with Pf-Blocker-NG where you can open a port to a service as usual, say a web-server, then use an alias for the source address to only allow incoming connections from, say, your own country. Useful for if you're roaming around and need access to that service from your laptop/mobile without a VPN, but also prevents attacks from countries you're unlikely to access it from.

fostware 3y ago

Aliases can consist of one or more countries (tick boxes) pulled from MaxMind's GeoIP DB. Doesn't use ASN-based sources unfortunately. Can be used in source and destination networks, IPv4&/IPv6 , just like pfSense.

BLKNSLVR 3y ago

I use it on OPNSense and it seems to work fine. There may be a Megamind (edit: MaxMind, not Megamind) account plugin setup out something to get it going, but if I worked it out, then you should be right. I use it to flat out block all incoming and outgoing connections to a certain small group of countries. More out of curiosity than necessity. It's also got a Crowdstrike interface for more dynamic blocking.