@ivor: I think one of the built in blocklists had certain YouTube IP's blacklisted, it happened to me as well. I just updated feeds and problem is gone. I updated the feeds and that seems to have resolved the issue. Thanks everyone.

There is a fix you can try https://forum.pfsense.org/index.php?topic=116307

These are the main threads : Original pfBlocker thread https://forum.pfsense.org/index.php?topic=86212.0 pfBlockerNG v2.0 w/DNSBL https://forum.pfsense.org/index.php?topic=102470 pfBlockerNG v2.1 w/TLD https://forum.pfsense.org/index.php?topic=115357 I have seed a guide not long ago but I can't remember which one.

https://forum.pfsense.org/index.php?topic=102470.msg643960#msg643960

BBCan177 you're quick to reply!!!  THanks! Yes I have modified the headers/labels (thats the name I was searching for…) to be unique ones. Is it just normal for me to find all my lists under a single Alias named "CustomBlockedLists"??  I really do not remember to have merged everything like that, unless I was drunk?  :o Looking forward to the TLD feature in pfblockerNG!!  This will save us from entering multiple domains, and simplify things... Thanks again!

Sooooooooooooooo, I figured it out. The problem was (is) me.  pfBlocker was working as it should. The problem was that I have a few NAT / Firewall rules that pick off DNS requests from certain hosts on my LAN. These DNS requests are to be sent to a different DNS server…  a service that I use (GetFlix).  I know that I can use domain overrides within DNS Resolver, but I never could figure out how to send an entire hosts DNS requests using Resolver... so instead, I just use NAT rules to redirect them before they reach resolver. I usually only have my AppleTV and a few other streaming devices in an alias that this rule applies to... however, the desktop I was doing all this testing on (posts above) was in this alias as well. I was doing some testing the other day with the DNS requests being redirected aaaaaaaaaand forgot to take my desktop out of this alias. So I just took it out... retested... bam.  Works like a charm. Thanks for your help, much appreciated.

If you restored a config from a different box, maybe the interfaces are different in this hardware. Check the interface assignments in pfSense, as the package reads those pfSense settings.

And that's where I went wrong.  I thought that by enabling it on the General Tab that enabled everything.  I should have checked the DNSBL tab since, you know, that's the service that wasn't running.  I guess it's because in my previous build it didn't have the extra options.  Am I correct in seeing that pfBlockerNG General is IP and Region blocking and that the DNSBL blocks based on DNS categories like Advertising?  I guess it's changed a lot since my last setup!  I don't usually do the updates since things tend to break when I do but then I get thrown when there are extra things I'm not expecting.  Good Job!

Seemed to work.  Thanks for your speedy reply.

Thanks so much! The more I read the more I realize how little I know.  I'll be doing a gob of reading over the next month.

check these threads, have tons of lists https://forum.pfsense.org/index.php?topic=102470.0 https://forum.pfsense.org/index.php?topic=86212.0

@BBcan177: Is your OpenVPN a "Server" or "Client" configuration?  Do you want both "Inbound" and "Outbound" auto-rules to be created? I have a fix that will add "Outbound" auto-rules for a OpenVPN "Server" config, and add both "In/Outbound" auto-rules for a "Client" configuration…. Typically, with OpenVPN, you assign an interface in the Interface tab, and it will show in the pfBlockerNG In/Outbound Interface options. The checkbox option, is for some corner-cases where there is no interface assigned and there is no Interface listed in the drop-down menu. My OpenVPN is a server configuration (think "road warrior" setup with mobile clients connecting).  So my use case is that I want to apply the same PFBlockerNG outbound rules I use for local clients to road warrior clients connected through the VPN for ad-blocking and content blocking purposes.  So it sounds like your fix would address my problem.

Sent you a PM …

Looks good on today's snapshot. Thanks Chris!

I have been working on some new features, so I will most likely submit it all at once… So it probably won't be for atleast a few more weeks... Been really busy lately...

I chose the first rule. I also created an alias (pfsense, not pfbng) to allow the particular IP's I want and put that as the first rule. Everything works like a charm for an hour, then the CRON job resorts to the Rule Order. Looks like I can accomplish the same thing through pfbng's alias system.  Wasn't aware that's what the ipv4 and ipv6 tabs were for. btw, the help link on the ipv4 tab is broken (https://<url to="" pfsense="">/help.php?page=/pfblockerng/pfblockerng_v4lists.xml) Thanks for your help - I'll tinker from here until I get it.</url>

Confirmed that the DNSBL VIP will not be accessible when Pfsense is in bridge mode even when the Bridge logical interface is used for DNSBL listening. It works fine in Layer 3 mode and DNSBL alerts are visible.

Thank you cmb - you're right it just needed a package list update. Here's to hoping Chinese port scanners never bother me again!

Solved, it's a bug, just upgrade to latest version.

Thanks BBcan177.. That was it. I changed it to: |pfSense Pass/Match | pfB_Pass/Match | pfB_Block/Reject| And it works fine now. I'll look at creating aliases within pfB for my overrides. Thanks again for your help and for your work on this package! Regards, Nate D.