Slow DNS resolution with PfBlocker/DNSBL
-
Overlooked that.
Well I guess if someone has a large DNSBL feeds and the service takes to long to restart you will start to notice it on the network. The restarting of the service is a problem when used with PfBlocker DNSBL Feeds and Register DHCP leases in the DNS Resolver are enabled.
Kind of sucks that you have to enable DNSBL or Registering DHCP leases but not both.
-
You can still define Static DHCP Mapping ;)
-
Very true, though still sad the service needs to restart with every DHCP renewal. Means more work for those that have multiple devices they'd like to be able to do a reverse lookup with or where DNS is critical and needs to be functioning correctly.
-
Hi. I am also seeing the same behaviour with pfsense unbound with pfblocker and dnsbl feeds. I tried all kind of suggestions, disabled registration of clients in DNS when requesting DHCP lease etc. etc. Nothing matters. In the end I experience DNS lag on my network. My solution was to stop using pfblocker on pfsense and move adblocking to ubuntu server with pihole installed. Problem solved.
I am looking forward to the next pfblocker release and hope that it will be more stable and perform a lot better then what it is doing now.
edit: I have pfsense running on dedicated core i3 with 4GB RAM and SSD disk. Tested it on core i5 with 32GB RAM and SSD disk. Unbound with pfblocker and dnsbl still lags.
-
When do you see laggs? You need to provide more information.
Do you have vlans? If so, ensure the Dnsbl permit option is enabled with all of the interfaces selected as required.
You should be able to ping the dnsbl VIP and browse to the dnsbl VIP. If that doesn't occur, your browser may timeout.
If the laggs are occurring when dnsbl is performing an update there can be some dns resolution issues until it fully reloads. You can set it to update once per day after hours, or use the new live reload option.
-
Hi. Is the live reload option available in the current stable release of pfblocker? Thanks!
-
@vjizzle said in Slow DNS resolution with PfBlocker/DNSBL:
Hi. Is the live reload option available in the current stable release of pfblocker? Thanks!
No, only available in devel.
-
Thnx. I will make a backup of my current setup and test with development version of pfsense and pfblockerng.
-
Hi again :). So I have setup pfblockerNG-devel now and so far it is looking good!. I have set all my DNSBL and IP feeds to update Once A Day. Now I want them to update at 05:00. Is it enough to set the cron job to run like the screenshot here?
-
Depending on you configuration an Unbound reload can take a few seconds to a few minutes to complete, hence disruption DNS service to devices. Running cron update during off hours is recommended.
With the Live Reload, pfBlockerNG perform live Unbound conf modification without interrupting DNS service. So you can run Cron Update hourly.
Live reload still have an issue where the Unbound internal DB becomes out of sync with pfb_dnsbl.conf file. It shows in the pfblockerng.log as
Resolver Live Sync... completed [ 09/06/18 05:29:28 ] DNSBL update [ 1107297 | PASSED ]... completed [ 09/06/18 05:29:29 ] DNSBL DEBUG..[ Data(s): 1107298 Zone(s): 950371 | 09/06/18 05:29:52 ]When this happens, you can run a Force Reload DNSBL to correct the drift. Or you can just perform a Unbound reload with the shell cmd :
unbound-control -c /var/unbound/unbound.conf reload codeThe widget DNSBL Unbound total queries counter might be cleared when an Unbound reload, giving you bad statistics. Simply clear the DNSBL counters by clicking on the Garbage Can icon in the widget.
