The pfSense mode consists of filling an alias group object with a time-limited duration.
Note that this is a "hard" method, meaning that an IP address detected by the sources will be automatically banned by your firewall without notice.
Artica PCAP filter is not able to create the firewall alias; you have to create the alias group in the pfSense firewall and the API key allowed to manage the object.
¶ The method:
Artica PCAP Filter is only able to work with a pfSense alias. In pfSense, an alias is used to define a group of network ports, hosts or subnets.
These aliases can then be used in filter rules, port forwarding rules, NAT rules and so on.
Using aliases is a good practice for clear, short, simple and readable rules on our firewall.
When CrowdSec or Artica PCAP Filter detects a bad-reputation IP, Artica uses the HTTP API to add this IP to the defined alias list.
You just have to create a rule associated with the defined alias to automatically ban the defined IP address.
¶
Limits:
The total size of all tables must fit in roughly half the amount of Firewall Maximum Table Entries, which defaults to 400,000.
If the maximum number of table entries is not large enough to contain all of the entries, the rules may fail to load.
See Firewall Maximum Table Entries for information on changing that value.
¶ Enable/Disable the pfSense remediation method
Tokens -pfsense-disable or -pfsense-enable enable or disable the pfSense remediation.
¶ Set the pfSense remediation settings to the Alias object
The token -pfsense-address [URL address] defines your pfSense address.
The token -pfsense-alias [alias name] defines the pfSense alias to populate.
The token -pfsense-apiclient defines the API Client ID to authenticate Artica PCAP.
The token -pfsense-apitoken defines the API Client Token to authenticate Artica PCAP.
The token -pfsense-ttl defines the time to live (in minutes) of a banned IP address inside your addresses group object.
You can use all commands in the same command line.
Example:
articapsniffer -pfsense-enable -pfsense-address https://192.168.1.247 -pfsense-apiclient 61646d696e -pfsense-apitoken c64fd96f7167905fe5bdc6d0d088b3e4 -pfsense-alias ArticaPCAP -pfsense-ttl 30
¶ Get configuration status
The command -pfsense-status (or -status for the global parameters ) displays the saved settings.
If your configuration is correct, you can see the number of stored addresses in the defined alias
¶ Add an IP address to test the link
Use the token -pfsense-add to add a new record inside your alias or, instead of specifying an IP address, you can set the path to a file containing a list of addresses separated by carriage returns.
articapsniffer -pfsense-add 177.37.170.134articapsniffer -pfsense-add /home/jbea/badips.txt
You can also add a -limit when importing a file:
articapsniffer -pfsense-add /home/jbea/badips.txt -limit 500
¶ Remove an IP address from the object
Use the token -pfsense-del to remove a specific IP address from your pfSense alias.
articapsniffer -pfsense-del 177.37.170.134
¶ Reset the alias object
You can use the -pfsense-reset. This command will destroy the data in your pfSense alias.
¶ List the content of alias object
You can use the -pfsense-list. This command will list all stored records.
¶ Scan the expired records
If you use Artica PCAP filter as daemon, this process is done automatically every 15 minutes.
You can use it manually with the token -pfsense-clean