Microsoft Updates Not Progressing
-
@stormgate Tried disabling pfBlockerNG ?
-
@nogbadthebad Oh sorry, yes I had disabled pfblockerng and turned off snort, same issue after a reboot. I should have included that info. Thank you.
-
How did you have Snort / pfBlocker configured?
I would guess there is still something applied there. Most likely would be DNS-BL with something preventing the clients resolve the actual download servers.
Also disabling Snort does not clear the blocked hosts lists so if you had it enabled in blocking mode that would still apply. Go to Diag > Tables and check the snort2c table.
Steve
-
@stephenw10 Ahh really, let me VPN in and have a look, thank you.
-
If that's a possibility then I strongly suggest leaving Snort in non-blocking mode for at least a few weeks whilst you tune it to ignore false positives from your network. Only move to blocking mode when you're confident it's not alerting on traffic you need.
With it enabled you can view and clear the blocks from the Snort package config.Steve
-
@stephenw10 So the snort table had 4 entries, 3 resolved back to Google and the 4th to Stackpath-CDN in Texas so nothing in regards to Microsoft itself.
-
-
Mmm, well I'd still remove those and retest. The fact that it showed any entries makes it my number 1 suspect!
-
@stephenw10 I just went to and they are now gone, I guess they purge on their own after a period of time I take it.
-
Yes, they do. You can set that timeout though and it can be disabled entirely.
https://docs.netgate.com/pfsense/en/latest/packages/snort/setup.html#managing-blocked-hosts
-
@stephenw10 Onething I have noticed with this 6100 is it's dead slow when reloading pfblockerNG lists. I made some changes and reloaded "All" and so far 38 minutes to run that CRON job. I expected a bit better performance overall.
-
Hmm, yeah, something not right there. That should take a few minutes at most. Something is probably blocking access to the lists and has to timeout. I would expect to see a bunch of errors in the update log.
-
Just don't.
PHP is parsing that file. PHP isn't the tool you want to parse such a file.I've activated that DNSBL_UT1 on my 4100-MAX : even the restart of unbound took 30 seconds to start.
When you see things like this in the pfblokcerng 'update' log, you know you should back of.
TLD analysis........xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx completed [ 09/12/22 17:13:06 ]
** TLD Domain count exceeded. [ 800000 ] All subsequent Domains listed as-is **
Anyway .... a list with 4+ million DNSBL ...... and only 4 hits ?
[ Force Reload Task - All ] UPDATE PROCESS START [ v3.1.0_4 ] [ 09/12/22 17:07:16 ] ..... UPDATE PROCESS ENDED [ 09/12/22 17:16:27 ]Yep, 10 minutes, as it needed 6 minutes to download this U1 file.
And now I have to deal with :
so using this U1 feed is a no-go for 4 Gbytes.
-
@gertjan I'll go have a look thank you.
-
@gertjan Looks like the "Adult" category is the large database.
-
-
-
@gertjan That helped. it now took 2 min 49 seconds to "Reload All" which took almost 40minutes with the adult list added. To help with adult site, I simply changed my cloudflare setting to 1.1.1.3 and 1.0.0.3. Thanks
-
That with python mode enabled?
-
@stephenw10 Unbound Mode only
