Suricata Rules download error - pfsense 2.3.3

hilfi2000

Hi,

I use pfsense 2.3.3 on a fresh installation with suricata.

if i click on update or force update it takes quite a while but no updates are downloaded.
At the system log i see that error:

Feb 23 11:13:14 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Rules download error: Resolving timed out after 10649 milliseconds
Feb 23 11:13:14 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Will retry in 15 seconds…
Feb 23 11:13:40 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Rules download error: Resolving timed out after 10593 milliseconds
Feb 23 11:13:40 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Will retry in 15 seconds…
Feb 23 11:14:06 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Rules download error: Resolving timed out after 10890 milliseconds
Feb 23 11:14:06 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Will retry in 15 seconds…
Feb 23 11:14:32 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Rules download error: Resolving timed out after 10681 milliseconds
Feb 23 11:14:32 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: [Suricata] Will retry in 15 seconds…
Feb 23 11:14:47 php /usr/local/pkg/suricata/suricata_check_for_rule_updates.php: File 'emerging.rules.tar.gz.md5' download attempts: 4 ...

At the Update log following:

Starting rules update... Time: 2017-02-23 11:13:04
Downloading Emerging Threats Open rules md5 file emerging.rules.tar.gz.md5...
Emerging Threats Open rules md5 download failed.
Server returned error code 0.
Server error message was: Resolving timed out after 10681 milliseconds
Emerging Threats Open rules will not be updated.
Downloading Snort VRT rules md5 file snortrules-snapshot-2990.tar.gz.md5...
Snort VRT rules md5 download failed.
Server returned error code 0.
Server error message was: Resolving timed out after 11018 milliseconds
Snort VRT rules will not be updated.
The Rules update has finished. Time: 2017-02-23 11:16:29

i have read the following forum contribution, but the solution does not seem to fit my version.

can someone help me please.

Thanks.

HilFi

doktornotor

Your DNS is broken.

hilfi2000

but i can use the internet from local clients…
you mean really?

doktornotor

Yeah, I mean really. The DNS on pfSense itself is broken. It cannot resolve things. Perhaps configure some DNS servers in System - General. Or untick the "Disable DNS Forwarder" checkbox.

hilfi2000

Hi,

youre right. The DNS-Forwarder runs only on the LAN Interface. Im still off the opinion that is also right so.

At global settings i used the ins server 8.8.8.8 but is overwritten by pppoe.
It looks as it is only the first dos server entry is used for the update process.
This is 127.0.0.1. But the DNS Forwarder listens only on LAN.

If i changed the Forwarder to listen at all it works.

doktornotor

There's be exactly zero need to do any of that if you simply

unticked the "Disable DNS Forwarder" checkbox
let it listen on localhost

hilfi2000

if i deactivate the dns forwarder internet doesn't work…

doktornotor

Sigh. Go read the checkbox description a couple more times.

hilfi2000

Thank you ;)