@ronpfs said in My new pfBlockerNG is showing 100% on the dashboard. That's not right is it?: With DHCP registration checked, unbound restart with every new lease. When you save DHCP settings, it also restart unbound. So it "normal" behaviour to see the 100% in the Widget. At this point I can live without an accurate % as long as nothing else is happening that would cause negative effects. At this point I am going to leave settings where they are and see what happens. Right now I'm getting an accurate measurement of blocking at 22.36% (4,382 of 19,608), and my dns names are showing up in BandwidthD which I expect will disappear at some point and revert to "configure dns to see names" If/when it does I'll decide which is more important, knowing % blocked or resolving names. Roveer

I agree that the RAID-0 could be considered 'overkill'. This is why I originally was using RAID-1. However, I started to see significant performance degradation. Then I learned that INTEL RAID only supports TRIM on RAID 0, not on RAID 1. So, it was more out of necessity. I suppose I could have had separate non-raid SSDs, but I chose to have a single volume, to keep it simple. The extra performance doesn't help. I'm getting a full 1000 MB/s read/write. If I were buying new hardware, I would buy ONE NVMe SSD (non RAID), but I have to work with what I have. After a few weeks with this setup, I've been quite happy with the performance and stability. Now, I'm trying to fine-tune exactly which feeds I add. The biggest performance hit I see now is when I add too many feeds, or the very large feeds (BBC, hpHosts). I think I'm noticing excessive latency with large lists like those. Since I get very few hits on those lists, I've dropped them for now. I may add them back slowly to see if things change.

@BBcan177 Maybe enable the ability for the web server to also run on IPv6 and add AAAA records. @isaacfl said in Does pfBlockerNG work in pure ipv6 environment?: @nogbadthebad When I nslookup adservice.google.com I get: Name: adservice.google.com Address: 10.10.10.1 So there is no AAAA record. ping adservice.google.com gives me: Ping request could not find host adservice.google.com. Please check the name and try again Nothing ever shows in the pfBlockerNg logs though. So probably not going to work very well in an ipv6 only environment. My prior adblocker would always respond with both an A and an AAAA record for blocked sites.

I did the steps to no avail. I have uploaded my unbound.conf and remotecontrol.conf. hopefully you can help me figure out what setting is wrong. 0_1542452701420_conf.zip

Running pfSense 2.4.4-RELEASE (amd64) and latest pfBlockerNG devel and can confirm this same issue. Example: "192.168.10.10 - blops3 udp port" which appears to be one of my NAT port forward descriptions.

Thanks, didn't know Feodo lists were hosted by abuse.ch, too. Bit sad to read, that a simple dist-upgrade causes multi-day failures... our customers would kill us for that ;)

@rico said in How to install pfBlockerNG if you don't want to upgrade to pfSense v2.4.4: Shrew Soft is obsolete, there is not even some official Windows 10 Client. 5 year old VPN client is allowed by IT restrictions but no top of the line and free OpenVPN? Weird company... -Rico Had the same restriction with an financial sector customer (SAP consultants) and told them the same things. ShrewSoft is allowed for some IPSec dial-ins (with chosen cipher suites that are equally old as the software, 3DES and such) or - even worse - guys that stubbornly told me, that they used PPTP(!) to "VPN into that bank customer" - sometimes reality is more satirical as any magazine/show/internet blog you can imagine ;)

chrome dns page is blank

@johnpoz Yup

Upgrade looks like it went really smooth! Disable service. Keep config ticked. Uninstall package. Reinstall package. Config was retained and looks like it's fully working (even the locally cron downloaded shallalist-lists are still working). To be modified is the custom feeds, migration to a selection from the predefined list now available. And lots of new features to spend some time with a see as a padawan! brgs,

Ah, that explains it! Quick feedback about that: In a cluster setup I see that as bit of a problem, as you will setup the standby node with all things you have to setup there at first, then activate sync and then hope you have to never touch it again ;) In pfBNG terms that would mean you have to not only install the package but also configure it the first time the same time as the primary node because otherwise the standby will throw errors because it can't find the aliases the primary uses in its ruleset (e.g. pri1...). That's something that perhaps you should keep in mind. I'd suggest a slightly different approach: In the wizard screen ask if it is installed on a CARP cluster. If so, tell them to install the package on the standby node first but to NOT run the installer, just let it rest. Then proceed with the installer, let them create the DNSBL IP as Alias on a CARP address they created themself so you don't have to deal with CARP at all and then after the setup do the initial update and sync it to slave. :) With that the first time pfBNG runs its update, all lists are updated, created etc. and you can then sync all to the standby node. Perhaps than trigger a force update there via XMLRPC so the standby node also gets the IP/DNS lists correctly. After that the cron update is set to - an hour per default? - so that it should be somewhat safe to leave it alone and have it sync only every hour. But I'd go like the freeradius package for example and just push the configs to the slave every time you save it on the primary and only let the cron do the list updating on both, not the syncing. But that would be my opinion only :)

upgrading to the dev version seems to have fixed the problem. Thank you.

@talaverde said in pfBlocker and High Availability CARP working?: @jegr Gotcha. So, should I configure both nodes, each pointing to each other? With the main pfSense XMLRPC Sync, only the primary node is configured. Would this be the same with the pfB 'sync' tab? Or, as initially mentioned in this message, should I have both nodes configured to sync to each other? (I hope that makes sense). thanks. Aye, pfSense Sync is always Master to Standby not the other way round. There's only one case I'm aware (the top part of the HA sync - pfsync settings) that actually speaks with each other rather than master to standby. So configure pfBNG to replicate from master to standby node (use sync settings would be easiest) and the standby node should receive the configuration for the package :)

@rmalla said in pfblockerNG - Do not Block on specific specific Interface: @bbcan177 Dear BB, first of all, thanks for creating this great package. I've been playing with it for a couple of days but can't seem to find the correct config for me. I have a kind of specific situation. I have my WAN (which fails regularly), so I have setup a USB Drive from my local cellphone company (which is very reliable, but I only have 5 GB per month quota). I have them setup as a Failover Wan, meaning, when WAN goes offline the USB goes online automatically. The problem I've had the last couple of months is that my WAN goes offline (we don't even notice when its offline) and my family keeps on using the internet as usual (youtube, netflix, facebook etc etc) so the USB drive runs out in a matter of days. So I would like to only block all the high bandwith services on the USB Drive (opt1 inteface), so when my wan is offline, everybody is able to use the internet, but not use the high bandwith services. Is this possible with the current version of Pfblocker? My bottom line is that I would like to apply the PFBlocker to the opt1, but not to the WAN interface. Hello All, Any news on this?

@bbrendon said in Best use of pfBlocker: @stewart Yea, this is the way I do it. I create an alias in pfblocker and then make rules using it. Basically I say "if packet is not in goodcountries then block". This was the only way to do it a year or so ago and there might be new ways, but I haven't tried. With pfBlockerNG-devel, you don't need to link the the GeoIP files anymore... it will still work, but you can now change the State field to the new GeoIP option :) You can also use Auto-Rules and configure the Advanced In/Outbound Rule options to configure more settings for the Firewall Rules.

@tagit446 said in Question about included Feeds: I could not even imagine all of the effort put into choosing certain feeds to be included. I know there are alot out there and its hard \ I started a new sub-Reddit for pfBlockerNG and started a Thread for Feed Feedback! https://www.reddit.com/r/pfBlockerNG/comments/9t1w6o/pfblockerngdevel_feed_feedback/ Thank you for all of your hard work, pfBlockerNG is just absolutely brilliant! Thanks!

@bbcan177 Thank you, that worked great!