Configure pfSense Plus Denylist for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform network-based response actions in your network using pfSense Plus.

pfSense Plus supports these response actions:
  • Add a malicious IP address to a denylist
For more information, see Response action descriptions.

These resources are required:

  • Administrator access to the pfSense Plus appliance interface, including access to packages, aliases, and firewall rules.

These actions are required:

  • Contact your CST to validate the Active Response integration. Have an IP address ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create an alias to store IP addresses

  1. Sign in to the pfSense Plus appliance interface.
    Your pfSense Plus appliance interface URL is the IP address of your appliance, similar to https://192.168.1.1/.
  2. In the navigation menu, click Firewall > Aliases.
  3. Click the URLs tab, and then click + Add.
  4. Enter a name for the alias.
    For example, FirewallAlias.
  5. In the Type list, select URL Table (IPs).
  6. For the URL, enter:
    CODE 
    <cloudformation_output_url>/<file_name>
    Where:
  7. Click Save.
  8. Click Apply Changes to update the firewall.

Create a firewall rule

  1. In the navigation menu, click Firewall > Rules.
  2. Add a new rule to the top of the list by clicking Add.
  3. In the Action list, select Block.
  4. In the Interface list, select WAN or LAN based on the type of traffic you want to block.
  5. Do one of these actions:
    Option Description
    Block IP addresses from communicating with your firewall
    1. For Source, change any to Address or alias.
    2. In the Source Address field, enter the name of the alias created in Create an alias to store IP addresses.
    3. Keep the Destination as any.
    Block your firewall from communicating with IP addresses
    1. Keep the Source as any.
    2. For Destination, change any to Address or alias.
    3. In the Destination Address field, enter the name of the alias created in Create an alias to store IP addresses.
  6. For the Description, enter a name for the firewall rule.
    For example, AWFirewallRule.
  7. Click Save.
  8. Click Apply Changes to update the firewall.

Configure a cron schedule

By default, pfSense Plus polls external lists every 24 hours. For faster policy enforcement, configure a cron schedule to reduce the polling interval to one hour.

  1. If cron is not already installed, install cron:
    1. In the navigation menu, click System > Package Manager.
    2. Click the Available Packages tab.
    3. Search for Cron and click + Install.
    4. Click Confirm.
    The cron package is installed and Success is displayed in the command line output.
  2. In the navigation menu, click Services > Cron.
  3. Click + Add to add a new cron schedule.
  4. In the Minute field, enter 0.
  5. In the Hour, Day of the Month, Month of the Year, and Day of the Week fields, enter *.
  6. In the User field, enter root.
  7. In the Command field, enter:
    CODE 
    to /usr/bin/nice -n20 /etc/rc.update_urltables now forceupdate <alias_name>
    Where:
  8. Click Save.