pfSense integration

Feed URL

Setup

1. Log in to the pfSense web interface Open a browser, navigate to https://<firewall-ip>, and sign in.
2. Install the pfBlockerNG package
   1. Go to System › Package Manager › Available Packages.
   2. Search for pfBlockerNG.
   3. Click Install next to pfBlockerNG (the -devel version includes latest features).
   4. Wait for the installation to complete, then click Finish.
3. Run the pfBlockerNG setup wizard
   1. Go to Firewall › pfBlockerNG.
   2. If prompted, click Wizard.
   3. Set Inbound Firewall Rules interface to WAN and Outbound to your LAN interface, then complete the wizard.
4. Add the ThreatHive blocklist as an IP feed
   1. Go to Firewall › pfBlockerNG › IP › IP Feeds.
   2. Click + Add.
   3. Configure the feed:
      • Name: ThreatHive_Blocklist
      • Description: ThreatHive.net — Malicious IPs
      • Feed URL: https://threathive.net/hiveblocklist.txt
      • Format: Auto
      • State: ON
      • Action: Deny Both (or Deny Inbound for inbound-only blocking)
      • Update Frequency: Every 1 Hour
   4. Click Save.
5. Force an update and apply the blocklist
   1. Go to Firewall › pfBlockerNG › Update.
   2. Under Run, select Force and choose IP from the dropdown.
   3. Click Run to fetch and load the ThreatHive feed immediately.
   4. Verify the output log shows the feed was fetched and loaded successfully.
6. Enable logging and monitor alerts
   • Go to Firewall › pfBlockerNG › Reports › Alerts to view blocked IPs in real time.
   • Set Log Blocked to ON in the IP feed settings.
   • Blocked traffic also appears under Status › System Logs › Firewall.
7. Verify the integration
   • Go to Firewall › pfBlockerNG › IP › IP Feeds.
   • The Statistics column next to ThreatHive_Blocklist should display the number of IPs loaded.
   • Go to Diagnostics › Tables and select pfB_ThreatHive_Blocklist to inspect the full list.

Back to top

Last reviewed 4 November 2026. Questions or corrections: [email protected].