Connect Q-Feeds to pfSense

Create your API key in the portal first. See Get your threat feeds. Do not schedule updates more often than every 20 minutes. License intervals: Community daily, Plus every 4 hours, Premium hourly (as configured in pfBlockerNG).

Available feeds for pfSense

Malware domains: https://api.qfeeds.com/api?feed_type=malware_domains&api_token=YOUR_TOKEN&limit=…
Malware IPs: https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN&limit=…

Test with:

curl -v -u api_token:YOUR_TOKEN "https://api.qfeeds.com/api?feed_type=malware_domains&limit=1000"

Install and open pfBlockerNG

Go to System > Package Manager > Available Packages.
Find pfBlockerNG and select Install.
Open Firewall > pfBlockerNG. On first launch a wizard appears. You can exit it (“here”) for this guide, or complete the wizard for other feeds.

Configure the IPv4 blocklist

Go to IP > IPv4 and select the green Add button.
Enter a name and description for the collection.
Under IPv4 source definitions, set State to ON.

In Source, paste:

https://api.qfeeds.com/api?feed_type=malware_ip&api_token=YOUR_TOKEN

Replace YOUR_TOKEN with your API key.

Set Action to Deny Both.
Set Update Frequency to match your license (Community = daily, Plus = 4 hours, Premium = 1 hour).
Select Save IPv4 Settings.

Configure domain (DNSBL) blocking

Open the DNSBL tab (same pattern as the IP list).
Set State to ON.

Use source URL:

https://api.qfeeds.com/api?feed_type=malware_domains&api_token=YOUR_TOKEN

Set Action to Unbound.
Select Save DNSBL Settings.

Fetch the latest intelligence

Open the Update tab.
Select Reload and run it to force a download of the latest Q-Feeds data.
Do not force an update while cron is already running or about to run.

Download the PDF manual