Hi,
I don't have your environment to test, but I do have some changes to the Lighttpd web server configuration to listen on 10.10.10.1 (For DNS requests made from pfSense itself) and log those blocked domains… Not sure if this will help your situation or not?
Save to [ /var/unbound/pfb_dnsbl_lighty.conf ]
#
#pfBlockerNG Lighttpd DNSBL configuration file
#
server.bind = "0.0.0.0"
server.port = "8081"
server.event-handler = "freebsd-kqueue"
server.network-backend = "freebsd-sendfile"
server.dir-listing = "disable"
server.document-root = "/usr/local/www/pfblockerng/www/"
server.errorlog = "/var/log/pfblockerng/dnsbl_error.log"
server.pid-file = "/var/run/dnsbl.pid"
server.modules = ( "mod_access", "mod_fastcgi", "mod_rewrite" )
server.indexfiles = ( "index.php" )
mimetype.assign = ( ".html" => "text/html", ".gif" => "image/gif" )
url.access-deny = ( "~", ".inc" )
fastcgi.server = ( ".php" => ( "localhost" => ( "socket" => "/var/run/php-fpm.socket", "broken-scriptfilename" => "enable" ) ) )
debug.log-condition-handling = "enable"
$HTTP["host"] =~ ".*" {
url.rewrite-once = ( ".*" => "index.php" )
}
$SERVER["socket"] == "10.10.10.1:80" {
$HTTP["host"] =~ ".*" {
url.rewrite-once = ( ".*" => "index.php" )
}
}
$SERVER["socket"] == "0.0.0.0:8443" {
ssl.engine = "enable"
ssl.pemfile = "/var/unbound/dnsbl_cert.pem"
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
ssl.honor-cipher-order = "enable"
ssl.cipher-list = "AES128+EECDH:AES256+EECDH:AES128+EDH:AES256+EDH:AES128-SHA:AES256-SHA:!aNULL:!eNULL:!DSS"
$HTTP["host"] =~ ".*" {
url.rewrite-once = ( ".*" => "index.php" )
}
}
$SERVER["socket"] == "10.10.10.1:443" {
ssl.engine = "enable"
ssl.pemfile = "/var/unbound/dnsbl_cert.pem"
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
ssl.honor-cipher-order = "enable"
ssl.cipher-list = "AES128+EECDH:AES256+EECDH:AES128+EDH:AES256+EDH:AES128-SHA:AES256-SHA:!aNULL:!eNULL:!DSS"
$HTTP["host"] =~ ".*" {
url.rewrite-once = ( ".*" => "index.php" )
}
}
then:
/usr/local/etc/rc.d/dnsbl.sh restart
Note: The NAT address of 127.0.0.1, is defined here:
/usr/local/pkg/pfblockerng/pfblockerng.inc
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/pkg/pfblockerng/pfblockerng.inc#L791
