Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Dnsbl causes iOS apps to hang

    Scheduled Pinned Locked Moved pfBlockerNG
    19 Posts 3 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • BBcan177B
      BBcan177 Moderator
      last edited by

      Which Feeds are you using in DNSBL?

      "Experience is something you don't get until just after you need it."

      Website: http://pfBlockerNG.com
      Twitter: @BBcan177  #pfBlockerNG
      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

      1 Reply Last reply Reply Quote 0
      • ?
        A Former User
        last edited by

        I use the three suggested ones yoyo, SomeoneWhoCares, and Adaway

        1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator
          last edited by

          @crisdavid:

          I use the three suggested ones yoyo, SomeoneWhoCares, and Adaway

          With those lists enabled, try to browse to:

          http://101com.com

          This should be blocked and logged to the Alerts Tab. If not, then your LAN devices might not have their DNS settings configured properly…

          Also this command should return the DNSBL VIP address:

          host -t A 101com.com
          

          or for Windows:

          nslookup 101com.com
          

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User
            last edited by

            So I tried out the command which points back to the DNSBL address but it still unfortunately doesn't show up in the alerts tab. Would adding the VIP address to the DNS Resolver access list properly configure DNSBL?

            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              No you don't need to touch the Resolver ACL.

              Is the DNSBL VIP address defined as the default to 10.10.10.1? What is your LAN IP network defined as?
              For your LAN devices, did you define the DNS server settings to point only to the pfSense address?

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User
                last edited by

                Yes VIP is at it's default 10.10.10.1 while my LAN is 192.168.127.x I believe this issue is due to the dns forwarder option being checked within the DNS resolver settings …

                1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator
                  last edited by

                  @crisdavid:

                  Yes VIP is at it's default 10.10.10.1 while my LAN is 192.168.127.x I believe this issue is due to the dns forwarder option being checked within the DNS resolver settings …

                  No that won't make a difference. DNSBL can use the DNS Resolver in "Resolver" or "Forwarder" mode…. It just can't use the DNS Forwarder (DNSMasq).

                  Do you have any other Firewall Rule Limiters or other NAT rules that might be interfering?

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • ?
                    A Former User
                    last edited by

                    If it makes it easier I've included my limiter and NAT settings. The limiter is only meant to distribute my bandwidth evenly between devices to prevent one device from consuming most of the bandwidth.

                    Limiter1.png
                    Limiter1.png_thumb
                    Limiter2.png
                    Limiter2.png_thumb
                    Limiter3.png
                    Limiter3.png_thumb
                    Limiter4.png
                    Limiter4.png_thumb
                    NAT1.png
                    NAT1.png_thumb
                    NAT2.png
                    NAT2.png_thumb

                    1 Reply Last reply Reply Quote 0
                    • BBcan177B
                      BBcan177 Moderator
                      last edited by

                      @crisdavid:

                      If it makes it easier I've included my limiter and NAT settings. The limiter is only meant to distribute my bandwidth evenly between devices to prevent one device from consuming most of the bandwidth.

                      Have you tried pfSense 2.4 as I believe there are some fixes for Limiters in that version… Maybe someone whos using DNSBL and Limiters will chime in... As a test, if you disable the limiters, does that fix your timeout issues?

                      "Experience is something you don't get until just after you need it."

                      Website: http://pfBlockerNG.com
                      Twitter: @BBcan177  #pfBlockerNG
                      Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                      1 Reply Last reply Reply Quote 0
                      • ?
                        A Former User
                        last edited by

                        Still testing out this issue but turned off the limiters and it worked fine. Turned back on limiters with DNSBL and it's working for now. I killed the states as well but haven't done a reboot to verify it won't happen again should the system go down. If the problem resurfaces I may just jump to the version 2.4 in hopes it resolves this issue. Good news I saw that now I'm getting alerts! :)

                        1 Reply Last reply Reply Quote 0
                        • BBcan177B
                          BBcan177 Moderator
                          last edited by

                          Maybe the issue previously was that the Limiters Rules were above the DNSBL NAT rules. First rule wins…

                          "Experience is something you don't get until just after you need it."

                          Website: http://pfBlockerNG.com
                          Twitter: @BBcan177  #pfBlockerNG
                          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                          1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User
                            last edited by

                            @BBcan177:

                            Maybe the issue previously was that the Limiters Rules were above the DNSBL NAT rules. First rule wins…

                            You know what? The difference between my network and my fathers is the fact I had hybrid outbound NAT rules while he had Manual outbound NAT rules. I've wondered about this and can now see why/how using hybrid mode could cause issues as opposed to manual. Thank you for your help!

                            1 Reply Last reply Reply Quote 0
                            • ?
                              A Former User
                              last edited by

                              If anyone else is having the same issue I was having with pfblockerNG while having a traffic shaper (especially with this method) https://forum.pfsense.org/index.php?topic=63531.0
                              I was able to completely resolve this issue by upgrading to the 2.4 beta (at the time I'm posting this) and was able to have no issues with my iOS devices loading web pages slow or certain apps hanging.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.