OPNsense

Schildmark can block attacking addresses on an OPNsense firewall from an alert, a policy rule or Schildmark Analyst. It keeps them in one alias that your own block rules use, and adds and removes only the addresses it blocked. It never edits your rules.

Single IPv4 addresses only for now.

pfSense

pfSense is not supported. It has no official API: the third-party pfSense-pkg-RESTAPI package adds one, with a different interface, and Schildmark does not use it yet.

On OPNsense

1. Alias. Under Firewall → Aliases, add an alias named Schildmark_Blocked (alias names allow letters, digits and _ only), type Host(s), with no content, and Apply. With a Host(s) alias OPNsense saves each address Schildmark adds in its configuration, so blocks survive a reboot. An External (advanced) alias also works, but its addresses are lost when the firewall restarts.

2. Block rules. Under Firewall → Rules, add rules with action Block that use the alias, at the top of the list:

   • on the WAN interface: source Schildmark_Blocked, destination any;
   • on the LAN (and other inside) interfaces: source any, destination Schildmark_Blocked.

   Apply.

3. API user. Under System → Access → Users, add a user schildmark-api (no shell, a random password you do not need to keep) with only these privileges:

   • Diagnostics: PF Table IP addresses (adding and removing addresses in the alias);
   • Firewall: Aliases (reading the alias, for the health check).

   Under API keys, create a key. OPNsense downloads a file with the key and its secret.

In the console

Admin → Integrations → OPNsense:

Field	Notes
OPNsense URL	The web interface address, for example https://10.0.0.1
API key	The key from the downloaded file
API secret	The secret. Never shown again once saved
Alias	The name of the alias you created, for example Schildmark_Blocked. Left empty when you first set the integration up, Schildmark_Blocked is saved. An integration set up with an earlier release and this field left empty keeps using the alias name that release used; enter a name to change it
Check the OPNsense certificate	Off for the self-signed certificate OPNsense ships with

Values cannot contain spaces, $, #, quotes or backquotes; OPNsense API keys and secrets never do.

Test connection reads the alias (nothing is changed) and shows how many addresses it holds. Save applies the change within a minute, and the Block dialog then offers Block on OPNsense.

How a block works

• Block adds the address to the alias; the firewall enforces it at once. Blocking an address twice changes nothing.
• Unblock removes it from the alias.