pfBlockerng very slow at DNS

pooperman

Hi I recently virtualized pfSense and installed pfBlockerng.
With activated pfblocker it take about 20 seconds to start loading the page.
If I turn it off, it is at ~1.5 sec

any idea what causes this massive delay?

virtualized with esxi 6.7, running on 1 core, 8gb ram 35gb space.
![alt text]( image url)

BBcan177

Check the Alerts tab to see what is being blocked.
Try to enable IP blocking first, then enable DNSBL to narrow down which component to review.

Also there are some Dashboard notices. What do they say?

pooperman

with
DNSBL->ON
IP De-Dublication-> ON
PFblockerNG->ON
I am not able to upload the pics above

with
DNSBL->OFF
IP De-Dublication-> ON
PFblockerNG->ON
I am not able to upload the pics above

with
DNSBL->OFF
IP De-Dublication-> OFF
PFblockerNG->ON
I am not able to upload the pics above

with
DNSBL->OFF
IP De-Dublication-> OFF
PFblockerNG->OFF
I am able to upload the pics above

Will do some more testing and come back. Thanks for support!

pooperman

is any issue known with the RADIUS package of pfSense and pfblockerng?

I uninstalled it and it seems much faster!

Will continue testing tomorrow.

RonpfS

@pooperman said in pfBlockerng very slow at DNS:

There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table

Try to increase the Firewall Maximum Table Entries under System / Advanced / Firewall & NAT

pooperman

@ronpfs

thanks for feedback, changed it. will try performance and report back.

pooperman

I think it is now running quite well.
many thanks for your help.

one more point I would like to ask.
I'd like to browse through this news page, but I do not know why the ads are note being blocked with TLD, DNSBL etc.

Any idea what to do?

BBcan177

Right-click on the AD, and click "Inspect".... If the HTML code shows a domain name, and the domain is not from the site itself, then you can add that Domain to a DNSBL Customlist at the bottom of any DNSBL Feed page.

CyberMinion

Definitely inspect the content--you will probably find a URL which is not blocked being used there.

Sometimes you may be getting ads from a subdomain, so you may need to check the "Enable TLD" to attempt to deal with these subdomains.
Also, so sites host ads locally, but that is less common. A content inspection should tell you.