See this thread:
https://www.reddit.com/r/pfBlockerNG/comments/ao98u1/dnsbl_certificate_error/

Then find and disable that specific pfB block. I can't be more specific because I don't use it myself. Maybe this will help?

https://forum.netgate.com/topic/101452/url-shortener-blocked/3

@emammadov thank you!

@cdls make sure that you are on version 2.2.5_21 as there was a fix for Category Blacklists.

@jpvonhemel
Install pfblockerNG-devel, as it's much improved

@l0rdraiden said in PfblockerNG breaks host override:

But is a bug that will be fixed or I can not enable that setting if I want to use host override?

Let's see if it fix the failure mode after next Cron update.

Resolver Live Sync make dynamic change to Unbound db on the fly. When you disable it, Unbound will reload the pfb_dnsbl.conf file instead.

Depending on your host override settings, it may break the Resolver Live Sync. If you send me your host override settings by MP, I may find what's wrong.
Well there is no MP on this forum. Let's try a chat instead.

Host Override are in /var/unbound/host_entries.conf
Domain Override are in /var/unbound/domainoverrides.conf

Did you run a Force Update or a Force Reload after making the change?

I found the problem. I had a rule that needed the 10.0.0.0 subnet added. When the DNSBL VIP was added, some traffic to pfSense got blocked.

This also happened for me with a clean install of 2.2.5_21.

0_1548273582577_Screenshot_2019-01-23 pf100se ici - Firewall pfBlockerNG.png

Did you disable pfblockerNG before removing the package?

You could try to uncheck both, save, then remove the package.

Reinstalling the package seems to have done the trick.

Thanks for the reply, Johnpoz. Turns out that some of the firewalls/antiviruses in the Mac are messing with the DNS. Everything is working fine on systems that don't have that junk.

Attaching the /conf pkg-log text file which appears that the install is in good order.
0_1547868374225_pkg_log_pfSense-pkg-pfBlockerNG-devel-2.txt.zip

Install Cron package and then you could run a cron shell job 15 min before PfblockerNG Cron Update that download and process the list to a local file to be ready for processing.

So I should edit my port forward rules in NAT to add the a network alias for pfBlocker_NA IPv4 and IPv6.
Like this

Alias
0_1547228457662_fpBlocker Network Alias.jpg

Port Forward rule
0_1547228503649_ForwardRule.jpg

@bbcan177 said in Why is so difficult to block this specific website when using mobilephone's Chrome App?:

d its not possible to block that easily since its not on port 53.

so gettin you right
for optimal filter (pfB / DNSBL) experience it will be wise to
not redirect to port 53 (as i mentioned in the work around)

thanks for input ... makes totally sense
br from snowLand