Skip to main content
The Pulsedive feeds in pfBlockerNG require a Pulsedive Pro or Feed subscription.
pfBlockerNG is the pfSense package that turns threat intelligence feeds into firewall rules and DNS blocking. pfBlockerNG ships with Pulsedive feeds built in, so you enable the feed you want and supply your API key rather than building a feed URL by hand. This is a blocklist integration, so it blocks traffic rather than enriching it. It works differently from Pulsedive’s TAXII and API integrations. To enrich indicators on demand instead, visit API.

Available Feeds

pfBlockerNG provides two Pulsedive feeds, one for each layer you can block at, so choose by the kind of indicator you want to act on.
  • Pulsedive, in the IPv4 feed list under the PRI1 group, using the feed header Pulsedive. This feed carries Pulsedive’s IP addresses and blocks them at the firewall.
  • Pulsedive, in the DNSBL feed list under the Malicious2 group, using the feed header Pulsedive_BD. This feed carries Pulsedive’s domains and blocks them at the DNS layer.

What each feed contains

Each feed URL filters by indicator type alone, so the export carries every risk level your plan allows, not only the risky ones. It also includes retired indicators when your plan allows retired downloads, and Pulsedive retires an indicator once it stops looking risky. To narrow either feed, add a risk filter to the Source field when you configure it, such as &risk=high,critical. Pulsedive applies only the values your plan allows and ignores the rest without raising an error, so check the results rather than assuming a filter took effect. To understand what each risk level means, visit Risk.

Prerequisites

Before you enable a Pulsedive feed in pfBlockerNG, make sure you have the account and access the feed needs:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • A Pulsedive Pro or Feed plan. pfBlockerNG lists both Pulsedive feeds as subscription-only, so a free account doesn’t reach them.
  • pfSense with the pfBlockerNG or pfBlockerNG-devel package installed.

Connecting pfBlockerNG to Pulsedive

pfBlockerNG downloads Pulsedive indicators from a feed URL that carries your API key, then turns them into firewall or DNS blocking rules on each update. Once the feed is on and has an action, pfBlockerNG blocks matching traffic and refreshes the list on its schedule.
1

Add the feed

Add the Pulsedive feed from pfBlockerNG’s catalog, so its URL and schedule arrive already filled in.
  1. Go to Firewall > pfBlockerNG > Feeds. This tab lists pfBlockerNG’s pre-defined aliases, groups and feeds under the columns Category, Alias/Group, Feed/Website, and Header/URL.
  2. Find the Pulsedive entry for the layer you want:
    • The IPv4 entry sits in the PRI1 group, with the header Pulsedive.
    • The DNSBL entry sits in the Malicious2 group, with the header Pulsedive_BD.
    Both entries carry the note Subscription required to access Feed.
  3. Select the add icon beside the entry, whose tooltip reads Add feed: [ Pulsedive ] or Add feed: [ Pulsedive_BD ]. pfBlockerNG opens the list, with the feed already added and its URL already filled in.
2

Configure the feed

Supply your API key, turn the feed on, and choose what happens on a match.
  1. In the Source Definitions section, replace the _API_KEY_ placeholder in the Source field with your Pulsedive API key.
    To narrow the feed, append filters to the Source field, such as &risk=high,critical to keep only the riskiest indicators, or &retired=false so each refresh drops indicators Pulsedive has retired since the last download.
  2. Set the row’s State to ON.
    The feed arrives with State set to OFF, and pfBlockerNG checks for a missing API key only on rows that are on. If you leave the row off, the page saves without an error and the feed never downloads.
  3. In the Settings section, set Action. Adding a feed doesn’t carry the catalog’s action across, so this arrives as Disabled and stays that way if you leave it. For the IPv4 feed, choose one of the Deny actions to block matches at the firewall. For the DNSBL feed, choose Unbound.
  4. Confirm Update Frequency. Adding the feed copies the group’s schedule, so this arrives set to Every hour for PRI1 and Once a day for Malicious2. Keep a regular schedule, because Pulsedive updates and retires indicators over time and one download goes stale.
  5. Save your changes.
For pfBlockerNG’s reference, visit the pfBlocker-NG package documentation.
3

Verify the feed

Confirm that the feed downloads before you rely on it for blocking.
  1. Go to Firewall > pfBlockerNG > Update.
  2. Run an update, and confirm the feed downloaded without errors.

Using Pulsedive Data in pfBlockerNG

Once the feed is on, pfBlockerNG blocks matching traffic on its own, so your ongoing work is reviewing what it blocks and making exceptions where you need them.
  1. Go to Firewall > pfBlockerNG > Reports > Alerts to see each blocked match and the feed that triggered it.
  2. If a Pulsedive indicator blocks traffic you need, suppress or whitelist it from its alert.
To understand why Pulsedive flags an indicator, search for it on pulsedive.com or visit Risk.