Blocking malicious IPs with OPNsense and blacklists

[binaryanomaly]

Cross posting this here for better discoverability:

Blocking malicious IPs with OPNsense using spamhaus droplists and dshield_30_days is actually quite easy.

How it's done:
➡️ https://www.allthingstech.ch/blocking-malicious-ips-with-opnsense/

[hushcoden]

Thanks, trying to understand why the alias of the blocklists is in 'destination' and in 'source' or in both ?

[binaryanomaly]

Hi,

In the proposed configuration it's currently destination only.
Having it in source and destination would require to set up two separate rules.

For most simple configurations destination should be good enough to catch potential outgoing traffic if you block incoming traffic from WAN already - which probably most simple setups do.

If you have a more advanced set up where you allow incoming traffic from WAN, i.e. for a VPN or other services you may want to have an additional rule to block incoming traffic by source.

That would be my current understanding of how it works.
Does it make sense or have I overlooked something?

[hushcoden]

Thanks binaryanomaly for the explanation, and I think it's better to have just one set of those rules rather than duplicate them in both LAN and WAN as I did following this article: https://docs.opnsense.org/manual/how-tos/edrop.html

I wonder why the official documentation doesn't mention this other option too...

[binaryanomaly]

I wonder why the official documentation doesn't mention this other option too...

I think the official documentation does not get updated too often.
(Updating it is also not as simple and straightforward as with modern wysiwyg wikis.)

[hushcoden]

Sorry, me again, I'm trying to understand how those floating rules work and I'm still confused, i.e. from what I understood from the article and your response, that floating rule blocks any attempt from a LAN client to connect to any of the malicious IPs, am I right?

If so, why we need direction to 'any' and not just 'in' ?

What if I also want to block any attempt from any of those malicious IPs (defined in the alias) to attempt to connect to a LAN client ?
From your response I take it we need to add another rule?

Tia.

[binaryanomaly]

Hi,

The rule blocks any connections where the destination is one of the IPs in the blacklist.

You would need another rule to block any connections where the source is one of the IPs in the blacklist.
But most setups do not allow incoming traffic from the WAN interface anyway so this is kinda obsolete.

You're right, the any for the direction may not even be required but I just didn't bother since any works just fine as well.

-b