Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    i7 4GHz CPU + 128GB RAM, still slow when I load a large list in DNSBL

    pfBlockerNG
    7
    18
    1.3k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      iTestAndroid
      last edited by

      @BBcan177

      Oct 10 21:35:00 	unbound 	29825:1 	info: Verified that unsigned response is INSECURE
Oct 10 21:35:00 	unbound 	29825:1 	info: NSEC3s for the referral proved no DS.
Oct 10 21:35:00 	unbound 	29825:1 	info: query response was nodata ANSWER
Oct 10 21:35:00 	unbound 	29825:1 	info: reply from <.> 1.0.0.1#853
Oct 10 21:35:00 	unbound 	29825:1 	info: response for amazonaws.com. DS IN
Oct 10 21:35:00 	unbound 	29825:1 	info: resolving amazonaws.com. DS IN
Oct 10 21:35:00 	unbound 	29825:1 	info: Verified that unsigned response is INSECURE
Oct 10 21:35:00 	unbound 	29825:1 	info: NSEC3s for the referral proved no DS.
Oct 10 21:35:00 	unbound 	29825:1 	info: resolving yahoo.com. DS IN
Oct 10 21:35:00 	unbound 	29825:1 	info: query response was ANSWER
Oct 10 21:35:00 	unbound 	29825:1 	info: reply from <.> 1.0.0.1#853
Oct 10 21:35:00 	unbound 	29825:1 	info: response for us-east-1.onemobile.yahoo.com. A IN
Oct 10 21:35:00 	unbound 	29825:1 	info: resolving us-east-1.onemobile.yahoo.com. A IN
Oct 10 21:35:00 	unbound 	29825:1 	info: query response was CNAME
Oct 10 21:35:00 	unbound 	29825:1 	info: reply from <.> 1.1.1.1#853
Oct 10 21:35:00 	unbound 	29825:1 	info: response for us-east-1.onemobile.yahoo.com. A IN
Oct 10 21:35:00 	unbound 	29825:1 	info: resolving us-east-1.onemobile.yahoo.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for c2s-resources-global.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving c2s-resources-global.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for beacons-prodga.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:1 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:1 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:1 	info: response for dicts-prodga.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving beacons-prodga.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:1 	info: resolving dicts-prodga.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:4 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:59 	unbound 	29825:4 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:59 	unbound 	29825:4 	info: resolving google.com. DS IN
Oct 10 21:34:59 	unbound 	29825:4 	info: resolving clients1.google.com. A IN
Oct 10 21:34:59 	unbound 	29825:4 	info: query response was CNAME
Oct 10 21:34:59 	unbound 	29825:4 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:4 	info: response for clients1.google.com. A IN
Oct 10 21:34:59 	unbound 	29825:4 	info: resolving clients1.google.com. A IN
Oct 10 21:34:59 	unbound 	29825:4 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:4 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:4 	info: response for scripts-prodga.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:4 	info: resolving scripts-prodga.c2s-sa-production.aws.oath.cloud. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:59 	unbound 	29825:9 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was nodata ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for oath.cloud. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving oath.cloud. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: validated DNSKEY cloud. DNSKEY IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for cloud. DNSKEY IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving cloud. DNSKEY IN
Oct 10 21:34:59 	unbound 	29825:9 	info: validated DS cloud. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for cloud. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving cloud. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:59 	unbound 	29825:9 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving yahoo.com. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for guce.yahoo.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving guce.yahoo.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was CNAME
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for guce.yahoo.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving guce.yahoo.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was CNAME
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for guce.yahoo.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving guce.yahoo.com. A IN
Oct 10 21:34:59 	unbound 	29825:8 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:59 	unbound 	29825:8 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:59 	unbound 	29825:8 	info: query response was nodata ANSWER
Oct 10 21:34:59 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:8 	info: response for psicdn.net. DS IN
Oct 10 21:34:59 	unbound 	29825:1 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:1 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:1 	info: response for edge.gycpi.b.yahoodns.net. A IN
Oct 10 21:34:59 	unbound 	29825:8 	info: resolving psicdn.net. DS IN
Oct 10 21:34:59 	unbound 	29825:8 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:59 	unbound 	29825:8 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:59 	unbound 	29825:8 	info: query response was nodata ANSWER
Oct 10 21:34:59 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:8 	info: response for oath.com. DS IN
Oct 10 21:34:59 	unbound 	29825:1 	info: resolving edge.gycpi.b.yahoodns.net. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:59 	unbound 	29825:9 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving yahoodns.net. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:59 	unbound 	29825:9 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was nodata ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for yimg.com. DS IN
Oct 10 21:34:59 	unbound 	29825:8 	info: resolving oath.com. DS IN
Oct 10 21:34:59 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:8 	info: response for consent.cmp.oath.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving yimg.com. DS IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was ANSWER
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for s.yimg.com. A IN
Oct 10 21:34:59 	unbound 	29825:8 	info: resolving consent.cmp.oath.com. A IN
Oct 10 21:34:59 	unbound 	29825:8 	info: query response was CNAME
Oct 10 21:34:59 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:59 	unbound 	29825:8 	info: response for consent.cmp.oath.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving s.yimg.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: query response was CNAME
Oct 10 21:34:59 	unbound 	29825:9 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:59 	unbound 	29825:9 	info: response for s.yimg.com. A IN
Oct 10 21:34:59 	unbound 	29825:8 	info: resolving consent.cmp.oath.com. A IN
Oct 10 21:34:59 	unbound 	29825:9 	info: resolving s.yimg.com. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:7 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for akamai.net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:7 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for yahoodns.net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:8 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for yahoodns.net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:8 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for akamai.net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:8 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for amazon.com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving akamai.net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:7 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for edgesuite.net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving yahoodns.net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:7 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for yahoo.com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:7 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for amazon.com. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving yahoodns.net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:8 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for yahoo.com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:7 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for google.com. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving akamai.net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: Verified that unsigned response is INSECURE
Oct 10 21:34:58 	unbound 	29825:8 	info: NSEC3s for the referral proved no DS.
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was nodata ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for edgesuite.net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving yahoo.com. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving amazon.com. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validated DNSKEY com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validated DNSKEY com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving edgesuite.net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DNSKEY net. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for net. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving google.com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving yahoo.com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving amazon.com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DNSKEY com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DNSKEY com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DNSKEY com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving edgesuite.net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validated DNSKEY net. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for net. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving net. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DS net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DS com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for answers.yahoo.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validated DS com. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validated DS com. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving com. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DS com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validated DS com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was NXDOMAIN ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for _ta-4f66. NULL IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving net. DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validated DS net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving com. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving com. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving net. DS IN
Oct 10 21:34:58 	unbound 	29825:8 	info: Successfully primed trust anchor . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validate keys with anchor(DS): sec_status_secure
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving net. DS IN
Oct 10 21:34:58 	unbound 	29825:7 	info: Successfully primed trust anchor . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validate keys with anchor(DS): sec_status_secure
Oct 10 21:34:58 	unbound 	29825:8 	info: Successfully primed trust anchor . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validate keys with anchor(DS): sec_status_secure
Oct 10 21:34:58 	unbound 	29825:7 	info: Successfully primed trust anchor . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validate keys with anchor(DS): sec_status_secure
Oct 10 21:34:58 	unbound 	29825:8 	info: Successfully primed trust anchor . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: validate keys with anchor(DS): sec_status_secure
Oct 10 21:34:58 	unbound 	29825:7 	info: Successfully primed trust anchor . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: validate keys with anchor(DS): sec_status_secure
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: prime trust anchor
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for www.msftncsi.com.edgesuite.net. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: prime trust anchor
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for clients4.google.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: prime trust anchor
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for answers.yahoo.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was NXDOMAIN ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for _ta-4f66. NULL IN
Oct 10 21:34:58 	unbound 	29825:8 	info: prime trust anchor
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for www.msftncsi.com.edgesuite.net. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving answers.yahoo.com. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was CNAME
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for answers.yahoo.com. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving _ta-4f66. NULL IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:7 	info: generate keytag query _ta-4f66. NULL IN
Oct 10 21:34:58 	unbound 	29825:7 	info: prime trust anchor
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for msh.amazon.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving _ta-4f66. NULL IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving . DNSKEY IN
Oct 10 21:34:58 	unbound 	29825:8 	info: generate keytag query _ta-4f66. NULL IN
Oct 10 21:34:58 	unbound 	29825:8 	info: prime trust anchor
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was ANSWER
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for api.amazon.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving www.msftncsi.com.edgesuite.net. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was CNAME
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.1.1.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for www.msftncsi.com.edgesuite.net. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving www.msftncsi.com.edgesuite.net. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was CNAME
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for www.msftncsi.com.edgesuite.net. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving clients4.google.com. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: query response was CNAME
Oct 10 21:34:58 	unbound 	29825:7 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:7 	info: response for clients4.google.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving answers.yahoo.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: query response was CNAME
Oct 10 21:34:58 	unbound 	29825:8 	info: reply from <.> 1.0.0.1#853
Oct 10 21:34:58 	unbound 	29825:8 	info: response for answers.yahoo.com. A IN
Oct 10 21:34:58 	unbound 		[29825:a] error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:6 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:5 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 		[29825:b] error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:0 	info: start of service (unbound 1.9.1).
Oct 10 21:34:58 	unbound 	29825:0 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:2 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:1 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:3 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:9 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:4 	error: duplicate forward zone . ignored.
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving api.amazon.com. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving clients4.google.com. A IN
Oct 10 21:34:58 	unbound 	29825:8 	info: resolving www.msftncsi.com.edgesuite.net. A IN
Oct 10 21:34:58 	unbound 	29825:7 	info: resolving answers.yahoo.com. A IN

      This is what I found in logs (level 2), answers.yahoo.com took very long time to resolve. I don't think it took long time for answer.yahoo.com in the DNS resolver, I think the pfBlockerNG test took long time.

      BBcan177B 1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator @iTestAndroid
        last edited by

        @iTestAndroid
        Try without DNS over TLS. Seems to be the Resolver issue and not pfBlockerNG.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        I 1 Reply Last reply Reply Quote 0
        • I
          iTestAndroid
          last edited by iTestAndroid

          @BBcan177
          For testing, sure, I'm turning it off now and will try again. But generally speaking, I have to keep the DNS over TLS. Will test and let you know soon.

          A 1 Reply Last reply Reply Quote 0
          • A
            akuma1x @iTestAndroid
            last edited by

            @iTestAndroid Why do you "have to keep" DNS over TLS? Don't trust your ISP with your DNS traffic?

            Just wondering...

            Jeff

            I 1 Reply Last reply Reply Quote 0
            • I
              iTestAndroid @akuma1x
              last edited by

              @akuma1x
              Yep, I'd rather hand all my DNS data to CloudFlare than to my ISP.

              1 Reply Last reply Reply Quote 0
              • NollipfSenseN
                NollipfSense
                last edited by

                This is off topic; however, curious about how much of your 128GB RAM do you use? I got 16GB and using 17% of it.

                pfSense+ 23.09 Lenovo Thinkcentre M93P SFF Quadcore i7 dual Raid-ZFS 128GB-SSD 32GB-RAM PCI-Intel i350-t4 NIC, -Intel QAT 8950.
                pfSense+ 23.09 VM-Proxmox, Dell Precision Xeon-W2155 Nvme 500GB-ZFS 128GB-RAM PCIe-Intel i350-t4, Intel QAT-8950, P-cloud.

                1 Reply Last reply Reply Quote 0
                • I
                  iTestAndroid @BBcan177
                  last edited by iTestAndroid

                  @BBcan177
                  I tried without DNS over TLS, used 8.8.8.8 and 4.4.4.4 DNS servers and had same results. It goes smoothly most of the time, but every here and there it gets stuck

                  @NollipfSense Same, pfSense barely uses 16GB. I also enable/disable ntopng here and there to analyze and monitor activities in network. I just turned an old PC I had into firewall for my home net, so didn't really take out anything.

                  1 Reply Last reply Reply Quote 0
                  • T
                    tman222
                    last edited by

                    Hi @iTestAndroid - I have a couple clarifying questions:

                    1. Is DNS performance acceptable if you temporarily disable pfBlockerNG?
                    2. Can you confirm your DNS settings for us? What do you have checked for DNS Query Forwarding under the DNS Resolver Settings? Do you have DNSSEC checked or unchecked?
                    3. What DNS Servers listed in the Dashboard System Information widget?
                    4. If you ping Google's DNS or Cloudflare's DNS servers, is the packet RTT acceptable?

                    Thanks in advance.

                    1 Reply Last reply Reply Quote 0
                    • provelsP
                      provels
                      last edited by provels

                      Are you using ramdisks for /var and /tmp?
                      System/Advanced/Miscellaneous

                      Peder

                      MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
                      BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

                      1 Reply Last reply Reply Quote 0
                      • I
                        iTestAndroid
                        last edited by iTestAndroid

                        @tman222

                        1. Yes. Actually, with pfBlocker and list of around 400-500k, it works flawlessly, its super fast and blocks most ads. When I turn on all lists I have, the total count adds up to ~1.4M and that's when things start to go south. Otherwise both DNS resolver and pfBlocker works fine. So when 1.4M entry is added to pfBlocker, things get slow and some DNS requests hangs.

                        2. DNS Query Forwarding -> Enabled
                          Use SSL/TLS for outgoing DNS queries -> Enabled
                          Custom Options:
                          server:
                          forward-zone:
                          name: "."
                          forward-ssl-upstream: yes
                          forward-addr: 1.1.1.1@853
                          forward-addr: 1.0.0.1@853
                          forward-addr: 9.9.9.9@853

                        server:include: /var/unbound/pfb_dnsbl.*conf

                        1. These are the DNS server addresses listed there
                          1.1.1.1
                          1.0.0.1
                          9.9.9.9

                        2. I have gigabit internet, RTT is acceptable:
                          ping cloudflare.net
                          PING cloudflare.net (104.16.208.90) 56(84) bytes of data.
                          64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=1 ttl=57 time=2.73 ms
                          64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=2 ttl=57 time=2.60 ms
                          64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=3 ttl=57 time=2.43 ms
                          64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=4 ttl=57 time=2.37 ms
                          64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=5 ttl=57 time=2.53 ms

                        @provels
                        Yes, I have both enabled and each of them have size of 4096MB (4GB)

                        T 1 Reply Last reply Reply Quote 0
                        • T
                          tman222 @iTestAndroid
                          last edited by

                          @iTestAndroid said in i7 4GHz CPU + 128GB RAM, still slow when I load a large list in DNSBL:

                          @tman222

                          1. Yes. Actually, with pfBlocker and list of around 400-500k, it works flawlessly, its super fast and blocks most ads. When I turn on all lists I have, the total count adds up to ~1.4M and that's when things start to go south. Otherwise both DNS resolver and pfBlocker works fine. So when 1.4M entry is added to pfBlocker, things get slow and some DNS requests hangs.

                          2. DNS Query Forwarding -> Enabled
                            Use SSL/TLS for outgoing DNS queries -> Enabled
                            Custom Options:
                            server:
                            forward-zone:
                            name: "."
                            forward-ssl-upstream: yes
                            forward-addr: 1.1.1.1@853
                            forward-addr: 1.0.0.1@853
                            forward-addr: 9.9.9.9@853

                          server:include: /var/unbound/pfb_dnsbl.*conf

                          1. These are the DNS server addresses listed there
                            1.1.1.1
                            1.0.0.1
                            9.9.9.9

                          2. I have gigabit internet, RTT is acceptable:
                            ping cloudflare.net
                            PING cloudflare.net (104.16.208.90) 56(84) bytes of data.
                            64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=1 ttl=57 time=2.73 ms
                            64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=2 ttl=57 time=2.60 ms
                            64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=3 ttl=57 time=2.43 ms
                            64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=4 ttl=57 time=2.37 ms
                            64 bytes from 104.16.208.90 (104.16.208.90): icmp_seq=5 ttl=57 time=2.53 ms

                          @provels
                          Yes, I have both enabled and each of them have size of 4096MB (4GB)

                          Hi @iTestAndroid - do you see any difference if you take out 9.9.9.9 and just use Cloudflare's 1.1.1.1 and 1.0.0.1 servers? Do you have DNSSEC checked or unchecked? I'm still not quite convinced this is a pfBlockerNG issue -- 1.4M is really not that big and you have got some pretty powerful hardware too.

                          Hope this helps.

                          1 Reply Last reply Reply Quote 0
                          • D
                            durianbusuk
                            last edited by

                            This post is deleted!
                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.