So many config changes from WireGuard (and even more from pfBlocker if DNSBL is disabled)

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

I don't normally use the config restore feature, etc. but I was really just looking into it for some thread.. And I was like well thats pretty useless all that was listed was pfblocker changes.. So I updated the list to be much longer so I could go back a few days even if filled up with the pfblocker nonsense.

That is not the list I was showing or is it? Because mine doesn't contain pfBlockerNG and I let that update itself every hour.

johnpoz

@Bob-Dig option 15 from the menu from console/ssh or config history in the menu..

I haven't touched pfblocker in days, but you can see its taking up a slot in the config history

But its not listed in the ACB

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

@Bob-Dig option 15 from the menu from console/ssh or config history in the menu..

It is not listed there for me either. I only see that problem with WireGuard.

johnpoz

@Bob-Dig I would love to know how to stop it.. If you look at a diff, there isn't any listed other than the description

Are you on + or CE?

I don't have wireguard installed, I have tailscale installed.

Not meaning to hijack your thread, but seems related to me - stuff being added to config history, that really shouldn't be imho.

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

@Bob-Dig I would love to know how to stop it..

I am on plus with this machine.
Do the settings play a role here under DiagnosticsBackup & Restore?

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

I don't have wireguard installed, I have tailscale installed.

Becoming lazy, don't want to open a port?

johnpoz

@Bob-Dig while I have a port open for tailscale - I thought I was reading somewhere recently that someone has tailscale working without opening that port.. tailscale is not my go to vpn solution. I use openvpn for day to day remote access.. Which is way less than it use to be now that just full time work from home ;)

As to the backup/config settings - I don't see anything there that would have an effect on the pfblocker stuff

bmeeks

@johnpoz said in So many config changes from WireGuard:

I would love to know how to stop it.

Currently the only way would be to manually edit the PHP code of the pfBlockerNG GUI and add the additional arguments to calls to the write_config() function that I copied in my earlier post. That would require knowledge of the code paths in the package or some study to figure them out.

stephenw10

Do you actually have DNS-BL enabled?

Maybe: https://redmine.pfsense.org/issues/14409

I do have DNS-BL enabled and don't see config backups for it.

johnpoz

@stephenw10 no I do not actually have dns-bl enabled. I just use pfblocker to create native aliases that I use in my firewall rules.

here is what I am using pfblocker for

Bob.Dig

@johnpoz I use both.

johnpoz

@Bob-Dig I wonder if I just enabled dns-bl, without actually using it would get rid of the config entries?

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

@Bob-Dig I wonder if I just enabled dns-bl, without actually using it would get rid of the config entries?

Sounds like a plan.

johnpoz

@Bob-Dig yup have it enabled now, just not doing anything.. So check back tmrw to see if those config entries are in there..

Bob.Dig

@johnpoz Do you have anything in DNSBL Groups enabled or the other tabs?
Still wouldn't make any sense.

johnpoz

@Bob-Dig nope have never setup dns-bl, have no use for it. Have never had it enabled ever..

Bob.Dig

@johnpoz I think one ad list is included by installation there, maybe removing it does something; or not.

johnpoz

@Bob-Dig I looked I have nothing selected.. Ah, this is set by default for top 1M whitelist

Default: COM, NET, ORG, CA, CO, IO

But can not unselect them.. if you do and then hit save, and then go back into it.. They are selected again, but this is not even enabled.

I have no groups listed

No categories selected, nothing in safesearch, its not enabled.. I don't use dns-bl, my clients use pihole on my network for this sort of thing.. The only thing I use pfblocker for is creating aliases I use in my own firewall rules.

Bob.Dig

@johnpoz I am quite happy with pfBlocker doing DNSBL, what am I missing? Seriously.

johnpoz

@Bob-Dig I have nothing against it, it prob works great.. But have been using pihole for like forever.. It works for me, its eyecandy is nicer and I know it inside and out.. I have no good reason to change..

But I do love the flexibility of creating aliases with pfblocker, and make use of them quite a bit.. But the blocking with dnsbl I don't have a current use for..

If I want filtered dns, I query my pihole, which in turn forwards to unbound on pfsense. If I want unfiltered I can just query unbound on pfsense directly.. I see no point in filtering in 2 different locations. Maybe I could move to just using pfblocker dnsbl - but then I would miss the eyecandy pihole provides. And would be more difficult to just query a filtered or unfiltered dns that I run locally, etc.

The alias rules I create in pfblocker, are only for inbound into my wan.. etc..