pfSense

Prerequisites

• A pfSense firewall that supports URL aliases (blocklist ingestion).
• A Trusteed account with access to the Noise-Aware IP blocklist feed.

Setup Steps

1. Log in to your Trusteed Console.
2. Navigate to Integrations → Firewalls → pfSense.
3. Click Connect under the pfSense logo and assign a unique integration name.
4. Copy the credentials (shown once) for configuring your pfSense device.
5. In pfSense:
   • Go to Firewall → Aliases → URL Aliases.
   • Create a new URL alias with update frequency set to 1 day.
   • Paste the Trusteed feed URL in this format:
   https://<username>:<password>@api.trusteed.io/v1/integrations/<integration_id>/content
6. Verify the alias is working.
7. Create a firewall rule using the alias to block malicious IPs.

Blocklist Format Example

Plain text format, one IP per line:

192.168.38.187
192.168.38.186


Outcome

• Known attacker IPs blocked automatically at the pfSense firewall.
• SOC and SIEM pipelines see fewer false positives.
• Analysts focus on high-fidelity signals instead of background noise.

Next Steps

• Explore Trusteed’s Blocklist Catalog to add more feeds.
• Combine pfSense enforcement with SIEM/SOAR logging for visibility.
• Automate response with enriched intelligence from Trusteed.

‍

‍