OPNsense

Athena can block attacking addresses on an OPNsense firewall from an alert, a policy rule or Pallas. It keeps them in one alias that your own block rules use, and adds and removes only the addresses it blocked. It never edits your rules.

Single IPv4 addresses only for now.

pfSense

pfSense is not supported. It has no official API: the third-party pfSense-pkg-RESTAPI package adds one, with a different interface, and Athena does not use it yet.

On OPNsense

1. Alias. Under Firewall → Aliases, add an alias named Athena_Blocked (alias names allow letters, digits and _ only), type Host(s), with no content, and Apply. With a Host(s) alias OPNsense saves each address Athena adds in its configuration, so blocks survive a reboot. An External (advanced) alias also works, but its addresses are lost when the firewall restarts.

2. Block rules. Under Firewall → Rules, add rules with action Block that use the alias, at the top of the list:

   • on the WAN interface: source Athena_Blocked, destination any;
   • on the LAN (and other inside) interfaces: source any, destination Athena_Blocked.

   Apply.

3. API user. Under System → Access → Users, add a user athena-api (no shell, a random password you do not need to keep) with only these privileges:

   • Diagnostics: PF Table IP addresses (adding and removing addresses in the alias);
   • Firewall: Aliases (reading the alias, for the health check).

   Under API keys, create a key. OPNsense downloads a file with the key and its secret.

In the console

Admin → Integrations → OPNsense:

Field	Notes
OPNsense URL	The web interface address, for example https://10.0.0.1
API key	The key from the downloaded file
API secret	The secret. Never shown again once saved
Alias	Empty: Athena_Blocked
Check the OPNsense certificate	Off for the self-signed certificate OPNsense ships with

Values cannot contain spaces, $, #, quotes or backquotes; OPNsense API keys and secrets never do.

Test connection reads the alias (nothing is changed) and shows how many addresses it holds. Save applies the change within a minute, and the Block dialog then offers Block on OPNsense.

How a block works

• Block adds the address to the alias; the firewall enforces it at once. Blocking an address twice changes nothing.
• Unblock removes it from the alias.