Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Dnsbl causes iOS apps to hang

    Scheduled Pinned Locked Moved pfBlockerNG
    19 Posts 3 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      If you are not seeing any Alerts that's not a good sign. Do you have a multi Lan segmented network? If so enable the DNSBL permit rule option to auto create a Floating permit rule to allow all LAN subnets to access the DNSBL VIP.

      Can all your Lan devices ping the DNSBL VIP address? If not, that can cause browser timeouts.

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User
        last edited by

        I only have one LAN network that's not segmented. My LAN devices can ping the DNSBL VIP address but there's nothing appearing in the alerts tab. If it helps I leave everything default and followed this guide here https://www.fredmerc.com/2016/07/pfsense-adblock-using-pfblockerng-guide/ but regardless if I enable DNSBL it causes issues with iOS apps hanging even if theres no lists enabled.

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          Which Feeds are you using in DNSBL?

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User
            last edited by

            I use the three suggested ones yoyo, SomeoneWhoCares, and Adaway

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              @crisdavid:

              I use the three suggested ones yoyo, SomeoneWhoCares, and Adaway

              With those lists enabled, try to browse to:

              http://101com.com

              This should be blocked and logged to the Alerts Tab. If not, then your LAN devices might not have their DNS settings configured properly…

              Also this command should return the DNSBL VIP address:

              host -t A 101com.com
              

              or for Windows:

              nslookup 101com.com
              

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User
                last edited by

                So I tried out the command which points back to the DNSBL address but it still unfortunately doesn't show up in the alerts tab. Would adding the VIP address to the DNS Resolver access list properly configure DNSBL?

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  No you don't need to touch the Resolver ACL.

                  Is the DNSBL VIP address defined as the default to 10.10.10.1? What is your LAN IP network defined as?
                  For your LAN devices, did you define the DNS server settings to point only to the pfSense address?

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • ?
                    A Former User
                    last edited by

                    Yes VIP is at it's default 10.10.10.1 while my LAN is 192.168.127.x I believe this issue is due to the dns forwarder option being checked within the DNS resolver settings …

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @crisdavid:

                      Yes VIP is at it's default 10.10.10.1 while my LAN is 192.168.127.x I believe this issue is due to the dns forwarder option being checked within the DNS resolver settings …

                      No that won't make a difference. DNSBL can use the DNS Resolver in "Resolver" or "Forwarder" mode…. It just can't use the DNS Forwarder (DNSMasq).

                      Do you have any other Firewall Rule Limiters or other NAT rules that might be interfering?

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • ?
                        A Former User
                        last edited by

                        If it makes it easier I've included my limiter and NAT settings. The limiter is only meant to distribute my bandwidth evenly between devices to prevent one device from consuming most of the bandwidth.

                        Limiter1.png
                        Limiter1.png_thumb
                        Limiter2.png
                        Limiter2.png_thumb
                        Limiter3.png
                        Limiter3.png_thumb
                        Limiter4.png
                        Limiter4.png_thumb
                        NAT1.png
                        NAT1.png_thumb
                        NAT2.png
                        NAT2.png_thumb

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          @crisdavid:

                          If it makes it easier I've included my limiter and NAT settings. The limiter is only meant to distribute my bandwidth evenly between devices to prevent one device from consuming most of the bandwidth.

                          Have you tried pfSense 2.4 as I believe there are some fixes for Limiters in that version… Maybe someone whos using DNSBL and Limiters will chime in... As a test, if you disable the limiters, does that fix your timeout issues?

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User
                            last edited by

                            Still testing out this issue but turned off the limiters and it worked fine. Turned back on limiters with DNSBL and it's working for now. I killed the states as well but haven't done a reboot to verify it won't happen again should the system go down. If the problem resurfaces I may just jump to the version 2.4 in hopes it resolves this issue. Good news I saw that now I'm getting alerts! :)

                            1 Reply Last reply Reply Quote 0
                            • BBcan177B
                              BBcan177 Moderator
                              last edited by

                              Maybe the issue previously was that the Limiters Rules were above the DNSBL NAT rules. First rule wins…

                              "Experience is something you don't get until just after you need it."

                              Website: http://pfBlockerNG.com
                              Twitter: @BBcan177  #pfBlockerNG
                              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                              1 Reply Last reply Reply Quote 0
                              • ?
                                A Former User
                                last edited by

                                @BBcan177:

                                Maybe the issue previously was that the Limiters Rules were above the DNSBL NAT rules. First rule wins…

                                You know what? The difference between my network and my fathers is the fact I had hybrid outbound NAT rules while he had Manual outbound NAT rules. I've wondered about this and can now see why/how using hybrid mode could cause issues as opposed to manual. Thank you for your help!

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  A Former User
                                  last edited by

                                  If anyone else is having the same issue I was having with pfblockerNG while having a traffic shaper (especially with this method) https://forum.pfsense.org/index.php?topic=63531.0
                                  I was able to completely resolve this issue by upgrading to the 2.4 beta (at the time I'm posting this) and was able to have no issues with my iOS devices loading web pages slow or certain apps hanging.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.