@BBcan177 so I have "Mem: 5293M Active, 734M Inact, 3236K Laundry, 1055M Wired, 742M Buf, 764M Free
Swap: 3881M Total, 94M Used, 3787M Free, 2% Inuse"

This is a Qotom mini pc with one sodium memory slot. 8 gig was the max I could get. It seems to idle around 81% not sure if that will go up as more users are on my network.

I am just wondering if it's hits 100% for some periods of time if this will cause issues.

I remove squid as well and it went down to about 71% but I like squid for the built in virus scanner. I don't really need the proxy as I have a fast fiber internet connection but it's part of the package...

If it stays at near 100% I will need try what you suggested with TLDs cn or ru... etc

Thanks for the tips

@harison said in pfBlockerNG firewall filter service stopped:

What do think? thank

I think you need glasses: https://forum.netgate.com/topic/136069/pfblockerng-2-2-5_16-pfb_filter

Thanks for the follow up!

@reg1982 I posted to you in another thread... pls try those steps...

Until BBcan177 can reply I will tell you my lists as a starting point. I would recommend the top two if your system can handle it. What is your hardware setup?

Malicious (disable "Malekal_Hosts" as it's a paid service) hpHosts Cryptojackers

@paint said in Issue with PFBlocker v2.1.4_11:

PM'ed you my list

Thanks!

PR here:
https://github.com/pfsense/FreeBSD-ports/pull/572
https://github.com/pfsense/FreeBSD-ports/pull/573

Solved after a fresh 2.4.4 install.
Anyway 2.4.4 has open other issues (ex. c-icap and freeradius configurations had to be manually fixed, some issue on traffic shaper solved after rules recreations)
To my personal opinion, could be a good idea lock packages upgrade to its pfsense version, and not to permit a package upgrade, from previous pfsense version, when a new one is available.

@nagaraja said in pfblockerng renice or setpriority:

Since I have pfsense boxes in a production environment I do not think it is a good idea to use a -devel package but if you confirm it stable enough I could give it a shot

Thanks!

There is a whole thread devoted to that... decision is always yours to make :)
https://forum.netgate.com/topic/135708/is-pfblockerng-devel-stable

@jimp said in pfSense upgrade 2.4.3 -> 2.4.4:

The best practice is to always remove every package before an upgrade. Failing that, leave them alone and let the upgrade process handle any changes.

Reporting back , Yup everything went smooth, looking at the console, the last step was upgrading the packages, in this case, Avahi 1.12 to 1.13 and pfBlockerNG 2.2.5_11 to 2.2.5_13.

Cheers Qinn

@krbvroc1 said in How to determine DNSBL block list:

Finally tracked it down - I had followed some documentation here - https://docs.microsoft.com/en-us/windows/privacy/manage-windows-endpoints
It listed 'star-mini.c10r.facebook.com' as an ms endpoint for facebook - I assumed for their store app. It has been blocked for months. For some reason today www.facebook.com started resolving to that cname and that is why it is blocked. It is a custom block list I entered months ago, not sure why pfblockerng doesn't show the feed name rather than 'no match' on the alerts - would have saved me hours.

There are many changes to the code with pfBlockerNG-devel, including the Alerts Tab. I would suggest moving to devel and see if you can reproduce the same issue.

In the Firewall / pfBlockerNG / IP there is the Firewall 'Auto' Rule Order settings you can configure.

If the settings doesn't fit you needs, then you need to create your own rules.

All issues should be addressed in this PR:
https://github.com/pfsense/FreeBSD-ports/pull/567

Most of them were already in the PR, I just added one more commit tonight.

Hopefully the devs merge this soon before more people move to 2.4.4 RC :)

thanks for your prompt reply.

@bartkowski said in GeoIP policy based routing not working with pfBlockerNG-devel?:

@bbcan177 If I change my rule to Destination: ANY, my traffic is routed via NordVPN. Rule order is the same in this case. Wouldn't it imply something wrong with the alias list created by the package?

You are using Alias type rules, so you are creating your own rules. Either way, pfBlockerNG is just adding IPs to an Aliastable. There has to be something else in your setup that is causing your issue. Check the other rules/nat etc...

There is a Pull Request posted to fix these issues. Just waiting for the devs to approve and merge.

@bbcan177 Hi! I've tried doing this method but I'm still getting blocked on WorkPlace by Facebook. Too many sub domains to try and test by force reloading DNSBL. (I'm blocking them via Manual Custom List as I cant figure out via feed)

Is it probably I'm blocking the wrong subdomains or that's just how Workplace and Facebook works as they correlate?

Thanks!

I never use the vpn provider dns because they have none. Everything is done within DNS resolver. (forwarder is off).

I used DNS over TLS. But it is really surprising to me that devices not connected to openvpn Pfblockerng are blocking ads.

@nesense

Try the pfBlockerNG-devel package, as it now logs all HTTPs blocked domains which wasn't possible in the previous version.

Also review the Reports/Alerts tab for all blocked events. Whitelisting options are available using the "+" icons.

Really hard, if not impossible, to help you without seeing your firewall rules on WLAN.

But there is something to this. It is the combination of both the pass NAT rule and NAT reflection (which is also enabled on the port forward installed by the package).

# NAT Inbound Redirects rdr pass on re0 proto tcp from any to 10.10.10.1 port 80 -> 127.0.0.1 port 8081 # Reflection redirect rdr pass on { re2 enc0 openvpn } proto tcp from any to 10.10.10.1 port 80 -> 127.0.0.1 port 8081 rdr pass on re0 proto tcp from any to 10.10.10.1 port 443 -> 127.0.0.1 port 8443 # Reflection redirect rdr pass on { re2 enc0 openvpn } proto tcp from any to 10.10.10.1 port 443 -> 127.0.0.1 port 8443

re0 is LAN, re2 is OPT1

OPT1 has no rules on it. Can access 10.10.10.1 on 80 and 443. Because the traffic is passed by the port forward.

The ruleset is just doing what it has been told to do.

This is not a NAT issue but a pfBlockerNG issue. Moving there.