@rasputinthegreatest said in pfBlockerNG not logging anything by default?:
This IP does exist on my LAN but why it resolves some weird random desktop-sdshdsd.local?
Then it's time to visit that device "192.168.1.85", and inspect it.
pfSense was just replies on a DNS request coming from it.
Loads of DNS request is 'normal' these days.
Btw : buy yourself a big collection of connected devices (preference : 'foreign origin") and you wind up with loads of bizarre DNS requests.
For example, a classic "Windows 11 Home" PC is already considered as 'bloated', which means that the list of all these xbox, candy store and other 'essential' processes is quiet big? And they all call 'home'.
And ask yourself this question : "do you really know what users actually do with their devices" ?
@rasputinthegreatest said in pfBlockerNG not logging anything by default?:
Also no 192.168.51.5 exists on my network either
Is "192.168.51.5" a typo ? It doesn't show up in any logs ...
If your pfSense LAN uses the 192168.1.1/24 network, and a device connected to that LAN using the 192.168.51.5, it can't communicate.
A network with statically assigned IP info (IP, mask/network, gateways and DNS) is hard to manage. That's why DHCP was invented, and activated by default for every device you buy.
@rasputinthegreatest said in pfBlockerNG not logging anything by default?:
I assume it is related to time servers?
Why do you presume that ?
Look them up and you'll see.
"ntpns.org" is probably the NS server of ntp.org
A lot of devices want to know the exact time.
Even when DHCP can propose a time server - you can set up pfSense as a time server for your LAN devices - many devices will disregard this info, an insist in using their own hard coded time server source.
For example, a Microsoft PC will default to time.microsoft.com, but you can set it to 192.168.1.1 or pfsense.your-sense-domaine.tld (which will point to 192.168.1.1 = pfSense).
You could to do this for every LAN device.
@rasputinthegreatest said in pfBlockerNG not logging anything by default?:
.local addresses
What is your pfSense domain set to ?
@rasputinthegreatest said in pfBlockerNG not logging anything by default?:
Its very mysterious and I only see this now with pfblockerNG.
Set : Services > DNS Resolver > Advanced Settings : Log Level to :
[image: 1754468971160-b17dd7a5-9427-497e-a3d0-5936024787b0-image.png]
and save, apply.
Now have a loo here : Status > System Logs > System > DNS Resolver
or better : console :
tail -f /var/log/resolver.log
Don't forget to set back the Log Level to 1 !! ( !! ) as the resolver.log will get very big very fast.
Conclusion : there is a lot of DNS traffic. These are all small packets, and finally just a small percentage of the total traffic.
