Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Unknown User defined feeds

    Scheduled Pinned Locked Moved pfBlockerNG
    11 Posts 5 Posters 2.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      token
      last edited by

      Hello all, I noticed a legit website being blocked so I started to dig into my pfblocker setup- turned out to be the pfB_PRI1_v4 feed (pfblocker IP not dnsbl).

      Buuuuut, while in there I noticed in the logs some DNSBL activity from a feed “Cameleon”. I saw it blocking an API I actually didn’t want blocked/dropped/blackholed. So I wend to feeds to disable it and I can’t. Its at the bottom of feeds found with a number of other feeds in an “Unknown user defined Feeds” panel- there are no controls to disable or delete them. Maybe a reelect from an older pfblocker install?
      c6f90c03-ebdd-43bd-b224-f1b20ed686c8-image.png

      How can I go about purging these lists out? I imagine somewhere in an SSH session there is a path I can nuke?

      I think I might have found the path, some of the files here are in this unknown user defined feeds, but not all of them. I don’t want to rm -rf without knowing more.
      1773f85d-889d-453c-89cf-f3b655696bca-image.png

      RonpfSR 1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS @token
        last edited by

        @token Those URLs were removed from the Feeds tab because they are offline, discontinued, etc.

        Click on the Alias/Group name and it will open the appropriate Alias/Group tab. Delete the URL, Save Settings, when done, run a Force Update, that should remove the feed from the db/pfblockerng folder. Inspect the logs, to find more problems.

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        T 1 Reply Last reply Reply Quote 1
        • T
          token @RonpfS
          last edited by

          @ronpfs said in Unknown User defined feeds:

          @token Those URLs were removed from the Feeds tab because they are offline, discontinued, etc.

          Click on the Alias/Group name and it will open the appropriate Alias/Group tab. Delete the URL, Save Settings, when done, run a Force Update, that should remove the feed from the db/pfblockerng folder. Inspect the logs, to find more problems.

          Thank you!

          1 Reply Last reply Reply Quote 0
          • ruicaramalhoR
            ruicaramalho
            last edited by

            Hi following you instructions I can delete the links... but I wan't to delete the entire group Abuse_PS, how can i do that?

            Capture.PNG

            RonpfSR 1 Reply Last reply Reply Quote 0
            • RonpfSR
              RonpfS @ruicaramalho
              last edited by RonpfS

              @ruicaramalho You can not delete the last URL in a Group.
              You could disable the Group or you can delete de Group from the IPv4 tab.

              2.4.5-RELEASE-p1 (amd64)
              Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
              Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

              1 Reply Last reply Reply Quote 0
              • ruicaramalhoR
                ruicaramalho
                last edited by

                Hi @RonpfS thanks for your answer.

                I do not now how to delete the entire IPV4 Group Abuse_PS, that is my objective.

                S 1 Reply Last reply Reply Quote 0
                • S
                  SteveITS Galactic Empire @ruicaramalho
                  last edited by

                  @ruicaramalho said in Unknown User defined feeds:

                  I do not now how to delete the entire IPV4 Group

                  On the Firewall/pfBlockerNG/IP/IPv4 page click the trash can icon on the far right, for that line.
                  cc6eb056-ca98-4d37-a01f-19730a3af681-image.png

                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                  Upvote 👍 helpful posts!

                  1 Reply Last reply Reply Quote 0
                  • M
                    MaxFactor 0
                    last edited by

                    Hi fellows,

                    sorry to bring up this old post but its topic is exactly what I was looking for.

                    I have set up some IP blocklists [Firewall > pfBlockerNG > IP > IPv4] and some DNSBL Groups [Firewall > pfBlockerNG > DNSBL > DNSBL Groups]

                    After reloading both the IP and DNSBL [Firewall > pfBlockerNG > Update] I always get some Feeds in the Unknown List.

                    5381fb1a-0724-4cd9-b26d-9dfd1359f6c4-image.png

                    Most of that links are updated and yet mantained, and I can even get some drops caused by them (so pfBlocker actively uses them).

                    What is the meaning of getting them in the "Unknown User defined feed" list?

                    S 1 Reply Last reply Reply Quote 0
                    • S
                      SteveITS Galactic Empire @MaxFactor 0
                      last edited by

                      @MaxFactor-0 said in Unknown User defined feeds:

                      get some Feeds in the Unknown List.

                      If memory serves that can happen if the feed is no longer in pfB’s feed page. IIRC they are sorted to the bottom there as well…?

                      Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                      When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                      Upvote 👍 helpful posts!

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        MaxFactor 0 @SteveITS
                        last edited by

                        @SteveITS Somewhere above @token reports that "Those URLs were removed from the Feeds tab because they are offline, discontinued, etc."

                        In my case I'm sure they are not offline/discontinued and also sure that they are actually actively used by the pfBL engine (Reports show that clearly). Hence the question, why they are said to be Unknown? I thought to remove them, until I found they are actually blocking the ips or urls they list.

                        S 1 Reply Last reply Reply Quote 0
                        • S
                          SteveITS Galactic Empire @MaxFactor 0
                          last edited by

                          @MaxFactor-0 I suspect something isn't matching. Did the name or the URL change? Maybe the old URL is being redirected?

                          As long as the file exists on disk pfB should use it as is. It doesn't mean it's being updated. And being Unknown doesn't mean the feed isn't downloading it just means it's not recognized in the predefined list.

                          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                          Upvote 👍 helpful posts!

                          1 Reply Last reply Reply Quote 1
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.