Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Microsoft Updates Not Progressing

    General pfSense Questions
    5
    53
    7.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      StormGate @stephenw10
      last edited by

      @stephenw10 Ahh really, let me VPN in and have a look, thank you.

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        If that's a possibility then I strongly suggest leaving Snort in non-blocking mode for at least a few weeks whilst you tune it to ignore false positives from your network. Only move to blocking mode when you're confident it's not alerting on traffic you need.
        With it enabled you can view and clear the blocks from the Snort package config.

        Steve

        S 1 Reply Last reply Reply Quote 0
        • S
          StormGate @stephenw10
          last edited by

          @stephenw10 So the snort table had 4 entries, 3 resolved back to Google and the 4th to Stackpath-CDN in Texas so nothing in regards to Microsoft itself.

          S 1 Reply Last reply Reply Quote 0
          • S
            StormGate @StormGate
            last edited by

            @stormgatednbl.PNG

            GertjanG 1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Mmm, well I'd still remove those and retest. The fact that it showed any entries makes it my number 1 suspect! 😉

              S 1 Reply Last reply Reply Quote 0
              • S
                StormGate @stephenw10
                last edited by

                @stephenw10 I just went to and they are now gone, I guess they purge on their own after a period of time I take it.

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Yes, they do. You can set that timeout though and it can be disabled entirely.

                  https://docs.netgate.com/pfsense/en/latest/packages/snort/setup.html#managing-blocked-hosts

                  S 1 Reply Last reply Reply Quote 1
                  • S
                    StormGate @stephenw10
                    last edited by

                    @stephenw10 Onething I have noticed with this 6100 is it's dead slow when reloading pfblockerNG lists. I made some changes and reloaded "All" and so far 38 minutes to run that CRON job. I expected a bit better performance overall.

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Hmm, yeah, something not right there. That should take a few minutes at most. Something is probably blocking access to the lists and has to timeout. I would expect to see a bunch of errors in the update log.

                      1 Reply Last reply Reply Quote 1
                      • GertjanG
                        Gertjan @StormGate
                        last edited by

                        @stormgate

                        dab12505-8443-434b-a572-ba16893daa3a-image.png

                        Just don't.
                        PHP is parsing that file. PHP isn't the tool you want to parse such a file.

                        I've activated that DNSBL_UT1 on my 4100-MAX : even the restart of unbound took 30 seconds to start.

                        When you see things like this in the pfblokcerng 'update' log, you know you should back of.

                        TLD analysis........xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx completed [ 09/12/22 17:13:06 ]

                        ** TLD Domain count exceeded. [ 800000 ] All subsequent Domains listed as-is **

                        Anyway .... a list with 4+ million DNSBL ...... and only 4 hits ?

                        [ Force Reload Task - All ]
                        UPDATE PROCESS START [ v3.1.0_4 ] [ 09/12/22 17:07:16 ]
                        .....
                        UPDATE PROCESS ENDED [ 09/12/22 17:16:27 ]
                        

                        Yep, 10 minutes, as it needed 6 minutes to download this U1 file.

                        And now I have to deal with :

                        f1b6245e-1baf-4c5e-8e3c-cdff4be6c12b-image.png

                        so using this U1 feed is a no-go for 4 Gbytes.

                        No "help me" PM's please. Use the forum, the community will thank you.
                        Edit : and where are the logs ??

                        S 3 Replies Last reply Reply Quote 1
                        • S
                          StormGate @Gertjan
                          last edited by

                          @gertjan I'll go have a look thank you.

                          1 Reply Last reply Reply Quote 0
                          • S
                            StormGate @Gertjan
                            last edited by

                            @gertjan Looks like the "Adult" category is the large database.

                            adult.PNG

                            S 1 Reply Last reply Reply Quote 0
                            • S
                              StormGate @StormGate
                              last edited by

                              @stormgate dnbl.PNG

                              S 1 Reply Last reply Reply Quote 0
                              • S
                                StormGate @StormGate
                                last edited by

                                @stormgate load.PNG

                                1 Reply Last reply Reply Quote 0
                                • S
                                  StormGate @Gertjan
                                  last edited by StormGate

                                  @gertjan That helped. it now took 2 min 49 seconds to "Reload All" which took almost 40minutes with the adult list added. To help with adult site, I simply changed my cloudflare setting to 1.1.1.3 and 1.0.0.3. Thanks

                                  1 Reply Last reply Reply Quote 1
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    That with python mode enabled?

                                    S 1 Reply Last reply Reply Quote 0
                                    • S
                                      StormGate @stephenw10
                                      last edited by

                                      @stephenw10 Unbound Mode only

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Ah yes, you probably need python mode for a list that large. That's not something I've tried (yet) I only use a few small lists for add-blocking.

                                        S 1 Reply Last reply Reply Quote 0
                                        • S
                                          StormGate @stephenw10
                                          last edited by

                                          @stephenw10 Ahh I see, well being my first setup and installation I think I have more than enough probably, maybe too much, so the device definitely feels way more responsive, and when it finally arrives at its destination when I am finished I can monitor in their real environment and tighten or loosen up the network. Just trying to make sure the devices are getting their correct IP addressing and they can see only what they need to. I will check the Microsoft updates when I get home and see if these changes have affected anything. But we have addressed issues I hadn't even looked into yet so very good. Appreciate all the help so far.

                                          1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @StormGate
                                            last edited by

                                            @stormgate said in Microsoft Updates Not Progressing:

                                            Unbound Mode only

                                            Using this mode, after sorting, removing the doubles, all DNSBL info is placed in one file ( see it here - it(s the 'biggest' file ) and unbound is informed to read it during startup.
                                            Unbound isn't fast at reading these files, so on every restart, it will take time, timing during your network has no DNS.

                                            The "python mode" is using a python script ( as the developers of unbound chose python as a script/API access for unbound ) : unbound loads the small python script, and can continue.
                                            This python scripts handles the big DNSBL file access, and also adds some new features, like regex filtering, AAAA filtering, and gives you a way to exclude some LAN devices from being DNSBL filtered.
                                            Python mode is well tested by now.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            S 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.