> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate with pfBlockerNG

> Enable the built-in Pulsedive feeds in pfBlockerNG to block Pulsedive's IP indicators at the firewall and its domain indicators at the DNS layer.

The Pulsedive feeds in pfBlockerNG require a Pulsedive [Pro](https://pulsedive.com/about/pro) or [Feed](https://pulsedive.com/about/feed) subscription.

[pfBlockerNG](https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html) is the pfSense package that turns threat intelligence feeds into firewall rules and DNS blocking.
pfBlockerNG ships with Pulsedive feeds built in, so you enable the feed you want and supply your API key rather than building a feed URL by hand.

This is a blocklist integration, so it blocks traffic rather than enriching it.
It works differently from Pulsedive's TAXII and API integrations.
To enrich indicators on demand instead, visit [API](https://docs.pulsedive.com/api/overview.md).

## Available Feeds

pfBlockerNG provides two Pulsedive feeds, one for each layer you can block at, so choose by the kind of indicator you want to act on.

* **Pulsedive**, in the IPv4 feed list under the PRI1 group, using the feed header `Pulsedive`.
  This feed carries Pulsedive's IP addresses and blocks them at the firewall.
* **Pulsedive**, in the DNSBL feed list under the Malicious2 group, using the feed header `Pulsedive_BD`.
  This feed carries Pulsedive's domains and blocks them at the DNS layer.

### What each feed contains

Each feed URL filters by indicator type alone, so the export carries every risk level your plan allows, not only the risky ones.
It also includes retired indicators when your plan allows retired downloads, and Pulsedive retires an indicator once it stops looking risky.

To narrow either feed, add a `risk` filter to the **Source** field when you configure it, such as `&risk=high,critical`.
Pulsedive applies only the values your plan allows and ignores the rest without raising an error, so check the results rather than assuming a filter took effect.

To understand what each risk level means, visit [Risk](https://docs.pulsedive.com/model/risk.md).

## Prerequisites

Before you enable a Pulsedive feed in pfBlockerNG, make sure you have the account and access the feed needs:

* A Pulsedive account and API key.
  Find your API key on your [Pulsedive account page](https://pulsedive.com/account).
* A Pulsedive [Pro](https://pulsedive.com/about/pro) or [Feed](https://pulsedive.com/about/feed) plan.
  pfBlockerNG lists both Pulsedive feeds as subscription-only, so a free account doesn't reach them.
* pfSense with the pfBlockerNG or pfBlockerNG-devel package installed.

## Connecting pfBlockerNG to Pulsedive

pfBlockerNG downloads Pulsedive indicators from a feed URL that carries your API key, then turns them into firewall or DNS blocking rules on each update.
Once the feed is on and has an action, pfBlockerNG blocks matching traffic and refreshes the list on its schedule.

**1. Add the feed**

Add the Pulsedive feed from pfBlockerNG's catalog, so its URL and schedule arrive already filled in.

1. Go to **Firewall** > **pfBlockerNG** > **Feeds**.
   This tab lists pfBlockerNG's pre-defined aliases, groups and feeds under the columns **Category**, **Alias/Group**, **Feed/Website**, and **Header/URL**.

2. Find the Pulsedive entry for the layer you want:

   * The IPv4 entry sits in the **PRI1** group, with the header `Pulsedive`.
   * The DNSBL entry sits in the **Malicious2** group, with the header `Pulsedive_BD`.

   Both entries carry the note **Subscription required to access Feed**.

3. Select the add icon beside the entry, whose tooltip reads **Add feed: \[ Pulsedive ]** or **Add feed: \[ Pulsedive\_BD ]**.
   pfBlockerNG opens the list, with the feed already added and its URL already filled in.

**2. Configure the feed**

Supply your API key, turn the feed on, and choose what happens on a match.

1. In the **Source Definitions** section, replace the `_API_KEY_` placeholder in the **Source** field with your Pulsedive API key.

   > [!TIP]
   >
   > To narrow the feed, append filters to the **Source** field, such as `&risk=high,critical` to keep only the riskiest indicators, or `&retired=false` so each refresh drops indicators Pulsedive has retired since the last download.

2. Set the row's **State** to **ON**.

   > [!WARNING]
   >
   > The feed arrives with **State** set to **OFF**, and pfBlockerNG checks for a missing API key only on rows that are on.
   > If you leave the row off, the page saves without an error and the feed never downloads.

3. In the **Settings** section, set **Action**.
   Adding a feed doesn't carry the catalog's action across, so this arrives as **Disabled** and stays that way if you leave it.
   For the IPv4 feed, choose one of the **Deny** actions to block matches at the firewall.
   For the DNSBL feed, choose **Unbound**.

4. Confirm **Update Frequency**.
   Adding the feed copies the group's schedule, so this arrives set to **Every hour** for PRI1 and **Once a day** for Malicious2.
   Keep a regular schedule, because Pulsedive updates and retires indicators over time and one download goes stale.

5. Save your changes.

For pfBlockerNG's reference, visit the [pfBlocker-NG package documentation](https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html).

**3. Verify the feed**

Confirm that the feed downloads before you rely on it for blocking.

1. Go to **Firewall** > **pfBlockerNG** > **Update**.
2. Run an update, and confirm the feed downloaded without errors.

## Using Pulsedive Data in pfBlockerNG

Once the feed is on, pfBlockerNG blocks matching traffic on its own, so your ongoing work is reviewing what it blocks and making exceptions where you need them.

1. Go to **Firewall** > **pfBlockerNG** > **Reports** > **Alerts** to see each blocked match and the feed that triggered it.
2. If a Pulsedive indicator blocks traffic you need, suppress or whitelist it from its alert.

To understand why Pulsedive flags an indicator, search for it on [pulsedive.com](https://pulsedive.com) or visit [Risk](https://docs.pulsedive.com/model/risk.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.