Blog

OPNsense: Blocklist filtering

CrowSec
Firewall Blocklists
Firewall Rules
Inspecting the Blocklist Aliases
Firewall Live View
Conclusion

At Open Circle, we consistently rely on open-source technologies, tools and products. Wherever appropriate, we favour open solutions that enable transparency, flexibility and long-term independence.

For firewalling and routing, we rely on OPNsense. We use the platform both as a virtualised appliance in the data centre and on dedicated hardware from Deciso – the company behind OPNsense.

OPNsense offers a wide range of security and filtering mechanisms that enable networks to be effectively protected and managed. A particularly useful feature is IP blocklists, which can block suspicious or unwanted connections at the network level. This article focuses precisely on these firewall blocklists and their potential applications.

Crowdsec

CrowdSec is a modern Fail2Ban alternative and is available as a plugin for OPNsense (installed by default in our setups). The CrowdSec agent on the OPNsense Firewall pulls the community blocklist and additionally analyses the local logs to block IPs showing suspicious behaviour. The resulting dynamic blocklist is then available as a Firewall Alias to be used in Firewall rules. This provides a good basic protection from malicious IPs and is part of all our managed Firewalls.

By default the CrowdSec agent creates automated rules blocking both incoming and outgoing traffic on all interfaces with no logging. Traffic is silently discarded and does not show up in the Firewall Live Log. Make sure to activate logging when troubleshooting Firewall issues.

Firewall Blocklists

OPNsense has a powerful Aliases system which can work with a wide variety of external blocklist to be used in addition to (or instead of) CrowdSec. An overview of all alias types can be found in the official documentation. There are many community and also commercial blocklists available from different providers. Which lists are the right ones for you depends on the use case and your preferences.

Overview firewall blocklisten

FireHOL

FireHOL is a community tool that analyzes and aggregates many security-related IP feeds and provides dynamically updated IP blocklists. In this example we use the Level 2 list

In OPNsense this is a URL Table (IPs) type blocklist and it’s configured as follows. Make sure to set the refresh frequency to a sensible level.

Edit Alias FireHOL

Spamhaus DROP

The Spamhaus DROP “Don’t Route Or Peer (DROP) lists the worst of the worst IP traffic.”

In OPNsense this is a URL Table in JSON format (IPs) type blocklist. As this list changes less frequently, set a longer refresh frequency.

Edit Alias Spamhaus DROP

Other list

FireHOL provides a great starting point for IP blocklists. Another recommendable list is the GriffinGuard Top 10K Abusive Hosts Feed.

GeoIP blocking

OPNsense Firewall Aliases include a feature to use MaxMind or IPinfo databases for geoblocking. Check the official documentation for setup instructions.

Firewall Rules

Once you have the Aliases for the desired blocklists defined, you still have to create the Firewall rules. I recommend using the floating rules feature and apply the filtering on all WAN interfaces. It’s important to have a rule for incoming and a rule for outgoing traffic (by default OPNsense creates incoming rules). For the outgoing traffic, the reject action instead of block can be used to inform the client about the block.

The rules will look something like this:

Firewall Rules

Once you have the blocklist setup tested, I recommend to disable the logging on the incoming rules. Otherwise they generate a lot of noise in your Firewall log. Leaving the logging on for outgoing traffic allows you to identify and track down potentially infected clients within your network when they try to access a blocked IP.

Inspecting the Blocklist Aliases

If you want to know which IPs or IP ranges are blocked by a list, you can use the Firewall Aliases Diagnostics Tool. You can see the content of the selected Alias or also search for a specific IP or range with the Find references field to see which lists contain the IP of interest.

Firewall: Diagnostics: Aliase

Firewall Live View

To see the blocklist in action head over to the Live View in the Log Files section of the Firewall. Make sure you have logging enabled on the blocklist rules, else you won’t see anything. The label shows you which blocklist has taken action.
Keep in mind the process sequence of the filter rules. The first rule that matches blocks the packet in question. The subsequent rules won’t see that packet. In our example the rule order is CrowdSec > FireHOL Level 2 > Spamhaus DROP > GriffingGuard Top 10k > Blocked Regions. This means traffic blocked by GriffinGuard did not match any of CrowdSec, FireHOL or Spamhaus DROP. This illustrates the importance of using a combination of different filter lists

Firewall Log Files Live View

Conclusion

IP blocklists are an effective way of blocking known problematic traffic, both incoming and outgoing. The global community provides regularly updated lists that cover a range of use cases. Commercial solutions such as CrowdSec or GriffinGuard are also available. We’d be happy to assist you if you have any questions about using blocklists in OPNsense, or we can take over the management of your network and firewall so that you can focus on your core tasks.