Pfblocker blocks all WAN traffic
-
Starting yesterday mid-afternoon, All Wan traffic was suddenly blocked. The internal network functioned fine, but no internet traffic. After checking all hardware and connections I focused on Pfsense. REstarted the router several times with no luck. I then decided to use the process of elimination by removing one service at a time. I started with Pfblocker and boom everything came back up. I thought it might be outdated so I updated the package. When I enabled it the same thing happened...no internet. Turned it off..All is well. I'm funning the 2,7.2 CE release and the latest PfblockerNG devel. as of yesterday.
I don't understand why it suddenly created a problem? It has worked fine for over a year. Very strange. Any ideas would be greatly appreciated.
Thanks,
Mark -
I think every one is going to need to know what feeds you are utilizing. Along with firewall rules.
-
Here are screen shots of my feeds:
I set up Pfsense according to Tom Lawrences suggestions. Pretty standard. The Wan interface has no rules.
Mark
-
You haven’t said, but I’m sure you’ve already checked your active alerts and status block. Just to see DNS or one IP address is being blocked somehow. It’s happened before. You may want to try deactivating one feed at a time , That way will help hopefully narrow down the problem.
-
Thanks, I'll give that a try.
-
@docsquic yeah I do recall like 8.8.8.8 getting blocked before.. If that is what your client is using for dns - kind of hard for the internet to work ;)
So its possible if your using external dns on your client, or doh for example that could of been blocked by one of your feeds.
-
Makes sense. Thanks
-
@docsquic did you ever find a resolution to this, having the same issue right now and only thing that seems to work is turning off pfBlocker, which is suboptimal to say the least.
-
@jlw52761 as @johnpoz wrote above "when your DNS is on the blocklist it's hard for the internet to work".
I certainly doubt that pfB just blocked your entire internet but mainly perhaps some IP you used for DNS or sth alike. That's to check and if that's the case, just exclude the IP from being blocked either by the supression list or by including / making an allowlist for false positives.
Cheers
-
@jlw52761 Yes, I followed the suggestions in the answers and started disabling the feeds one by one and found the culprit. I checked the logs and found which feeds were mentioning the DNS address ( there were about 8) then just disabled them one at a time and found the one blocking DNS traffic.
