ThreatGate Overview¶
This document covers the general behavior of ThreatGate and how it integrates with other areas of Netgate Nexus and pfSense Plus.
ThreatGate Feeds¶
Feeds are collections of entries managed by ThreatGate. Feeds can contain entries in several formats: Network prefixes, domain names, rexdns expressions, or even mixed content. ThreatGate will manage the Feed content and its use throughout Netgate Nexus and pfSense Plus.
Addresses vs. Domains¶
ThreatGate coordinates which components receive the resulting Feed entries based on content:
Network prefixes (subnets) and IP addresses are placed into firewall aliases for use with automatic or manual firewall rules.
Domain names and expressions are placed into CoreDNS Blocklists.
Based on those criteria, keep the following behaviors in mind when attempting to determine if ThreatGate is properly populating feed content:
Feeds containing only network prefixes will only appear in firewall rules and aliases, they will not appear in CoreDNS.
Feeds containing only domain names or expressions will only appear in CoreDNS, they will not appear in firewall aliases.
Feeds with a mix of content will show up in both areas.
Firewall Rules and Aliases¶
The behavior of ThreatGate feeds in the firewall depends on the Mode configuration of the feed.
The content of feeds configured for Always Block mode is always blocked in every direction using rules visible on the Floating tab of the firewall rules.
The content of feeds configured for Managed Alias mode appear as firewall aliases, but they do not automatically get added to any rules. Administrators must manually use them in firewall rules. These aliases can be used like any other firewall alias.
In both cases, the content of the alias is accessible for use in rules. The
alias name is formed by prepending TG_ before the name of the feed in
ThreatGate. For example, if the ThreatGate feed is named MyFeed, the alias
is named TG_MyFeed.
CoreDNS Blocklists¶
Similar to firewall rules and aliases, the behavior of ThreatGate feeds in CoreDNS depends on the Mode configuration of the feed.
Queries matching hosts or expressions from feeds configured for Always Block mode are always blocked from every CoreDNS Group.
Queries matching hosts or expressions from feeds configured for Managed Alias mode appear in CoreDNS Blocklists. Administrators must manually assign those Blocklists to CoreDNS groups to block their content.
ThreatGateDB (Category Feeds)¶
Feeds containing Category and ASN selections obtain their content from Netgate via the ThreatGateDB service. ThreatGateDB serves as the centralized intelligence backbone for ThreatGate. The system is designed to distribute these high-volume feeds to licensed Nexus instances using an optimized differential update mechanism to minimize bandwidth and maximize edge performance.
MaxMind (Country Feeds)¶
Feeds containing Country selections obtain their GeoIP data from MaxMind. To obtain this content, users must sign up for an account with MaxMind and configure a MaxMind Account ID and License Key in ThreatGate.
Warning
If the MaxMind credentials are not configured properly, Feeds with Country content will not populate or function.
ThreatGate will download and synchronize data from MaxMind as needed. This processing can take quite some time depending on hardware performance. Aliases and Blocklists using this data will not appear until ThreatGate has finished synchronizing the data. ThreatGate displays a progress indicator at the top of Services > ThreatGate while it is actively synchronizing this data. It may take a few moments to appear.