Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Google play store and download blocked

    Scheduled Pinned Locked Moved
    Firewalling
    2
    14
    1.6k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      andy22
      last edited by

      Steve,
      Thanks for your quick response.
      I didn't enable the logs in pfblocker. I just enabled it.
      5a565e0d-a43c-4f29-82f4-e7b1196741bc-image.png

      There are no alerts generated when I am trying to download an app from my cell phone. Here are the alerts I see:

      25b08aa3-6c71-4545-bd5c-9494415be621-image.png

      I tried completely disabling pfblockerNG and I still can't download anything
      be2f27b5-921c-4cec-a3ea-da8cd71fbf98-image.png

      Do I need to do anything after diabling pfblocker? Clear cache of any kind OR run force update OR wait for few minutes?

      Thanks
      Andy

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        If it was something in DNS-BL you might need to wait for any cached DNS responses to time-out on the host.

        If it was blocked by a firewall rule without logging enabled that should apply immediately.

        Steve

        1 Reply Last reply Reply Quote 0
        • A
          andy22
          last edited by

          Steve,
          I will keep my pfblocker to stay disabled and wait for some time to see if it fixes an issue. Once I know that pfblocker is causing an issue, I will slowly start enabling one feed at-a-time.
          Here are my LAN rules
          c273af25-5581-469d-a63a-4c92105746d3-image.png

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            So if you have logging enabled on those pfBlocker rules (in pfBlocker) you should see anything rejected by them in the firewall log.
            Anything blocked by DNS-BL should appear in the pfBlocker alerts.

            If you see neither of those it might be something else entirely.
            https://docs.netgate.com/pfsense/en/latest/routing/unable-to-access-some-websites.html

            Steve

            1 Reply Last reply Reply Quote 0
            • A
              andy22
              last edited by

              Steve,
              I followed your guideline and also looked at everything mentioned in the url you specified. Still no luck. Is there any log do you want me to post to look at?
              This is really a weird issue. Do you also want me to disable all feeds? Because, I removed DNS-BL rules from my IOTVLAN but it still exists on WAN.
              I infact tried disabling it for few minutes and tryied it with no luck.
              I didn't feel comfortable disabling the DNS-BL on WAN for a longer time.
              Thanks again sir.
              Andy

              1 Reply Last reply Reply Quote 0
              • A
                andy22
                last edited by andy22

                Steve,
                Looks like I got littler closer now..
                As soon as I completely disable DNS-BL (not pfBlocker), it starts working.
                8b00312a-f8f3-4955-92d3-e9c48df22b8c-image.png

                But as you see below, I only selected DNS-BL for my LAN and not IOTVLAN.
                9a593c43-f48b-4635-bfc7-512405ebce88-image.png

                I am still scratching my head on why it wouldn't work while I am connected to IOTVLAN. None of the DNS-BL should apply on my IOTVLAN (I would like to apply on that interface as well eventually if I can pinpoint the issue with google play and when I know how to debug an issue with url access)

                So looks like, something is applied somewhere as soon as I enable DNS-BL and it is applying on all interfaces even if that interface is not selected. as seen in above picture.
                Now I enabled DNS-BL back and download from google play store is blocked back again in IOTVLAN as well as LAN

                Here is my DNS Resolver settings..
                1741dec6-9b5d-482c-87a7-a5329607b23e-image.png

                This is a learning process for me as I am new to the pfsense.

                Thanks
                Andy

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  That setting only selects where to add firewall rules which DNS-BL will add for any IPs in the lists. The main purpose of DNS-BL though is to add lists to the DNS resolver to prevent it resolving bad fqdns. Mostly ad sites and malware but could be anything in the lists. Those apply to Unbound which all interfaces use identically.
                  By checking 'TLD' you also block any subdomains of listed domains from being resolved.

                  One of you lists has a domain in it that is required by the play store and it cannot be resolved. I would expect it to show in the alerts though where it would show which list contains the domain.

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • A
                    andy22
                    last edited by

                    Steve,
                    I see the following in the alerts:
                    093483b3-7936-4e20-9c5b-e153019d3c77-image.png

                    I think the offending list is FireHoLevel3? I don't know if denied list is for the Google play..
                    But this is the first time something showed up in the Deny list.. I was watching it since you mentioned about it.
                    Do you want me to disable that list and see if it makes any difference?
                    Do I have to run update manually after disabling this list OR it is just a time game?

                    Thanks
                    Andy

                    1 Reply Last reply Reply Quote 0
                    • A
                      andy22
                      last edited by

                      I have disabled the FireHoLevel3 and Reload all with no avail
                      899ce9f9-0f75-4522-88d5-72d6de5ccfa1-image.png

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Mmm, unlikely access to facebook would be required for Google Play.

                        One of those lists is the issue. If it comes to it disable them one at a time until you find it.

                        You could try turning up the logging in Unbound to query level then filter the resolver logs by IP of the host trying to connect.
                        Looks for urls resolving the 10.10.10.1. If you find them you can create a whitelist in pfBlocker to allow them to resolve correctly.

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • A
                          andy22
                          last edited by

                          Steve,
                          How can I turn up the logging to query. This was the option I am looking for so that I can query each host real-time and see what is being blocked.
                          Also How can I see filter resolver logs? what I see is just this in system logs:

                          Here are pfblocker logs
                          78a7c27c-5d4c-4ab1-ba3c-8cf3539cf472-image.png

                          Here are system logs for Resolver
                          de99d7ab-8e5d-4ec7-934f-ff56725486e8-image.png

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            In the Unbound Advanced Settings:

                            Selection_763.png

                            The logs will get VERY busy when you enable that so you will need to check them immediately after trying to connect.

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.