oisd blocklist not working

revengineer

Hi,
I am trying to use the oisd blck list found here. pfBlockerNG seems to process this fine, but unbound will not start afterward. Can anyone advise why this is? I cannot post the full log, as it is too long. Below is the final snippet.

Thank you.

===[ FINAL Processing ]=====================================

[ Original IP count ] [ 51967 ]

===[ Deny List IP Counts ]===========================

49753 total
18492 /var/db/pfblockerng/deny/pfB_Top_v4.txt
16387 /var/db/pfblockerng/deny/FireHOL3_IPs.txt
6052 /var/db/pfblockerng/deny/pfB_Top_v6.txt
5789 /var/db/pfblockerng/deny/BD_IPs.txt
2245 /var/db/pfblockerng/deny/ET_Block_IPs.txt
788 /var/db/pfblockerng/deny/ET_Comp_IPs.txt

===[ DNSBL Domain/IP Counts ] ===================================

431133 total
371953 /var/db/pfblockerng/dnsbl/oisd.txt
24262 /var/db/pfblockerng/dnsbl/MDS.txt
16794 /var/db/pfblockerng/dnsbl/EasyList.txt
6097 /var/db/pfblockerng/dnsbl/Cameleon.txt
5381 /var/db/pfblockerng/dnsbl/PhishTank.txt
3265 /var/db/pfblockerng/dnsbl/Adaway.txt
1752 /var/db/pfblockerng/dnsbl/yoyo.txt
751 /var/db/pfblockerng/dnsbl/MDL.txt
713 /var/db/pfblockerng/dnsbl/OpenPhish.txt
92 /var/db/pfblockerng/dnsbl/PhishTank.ip
49 /var/db/pfblockerng/dnsbl/EasyList.ip
16 /var/db/pfblockerng/dnsbl/OpenPhish.ip
8 /var/db/pfblockerng/dnsbl/DNSBL_TLD.txt

====================[ Last Updated List Summary ]==============

Mar 31 00:30 ET_Block_IPs
Mar 31 00:30 ET_Comp_IPs
Apr 1 07:04 FireHOL3_IPs
Apr 1 16:31 BD_IPs
Apr 1 17:49 pfB_Top_v4
Apr 1 17:49 pfB_Top_v6

IPv4 alias tables IP count

43858

IPv6 alias tables IP count

6052

Alias table IP Counts

49910 total
18492 /var/db/aliastables/pfB_Top_v4.txt
16387 /var/db/aliastables/pfB_FireHOL3.txt
6052 /var/db/aliastables/pfB_Top_v6.txt
5789 /var/db/aliastables/pfB_BinaryDefense.txt
3033 /var/db/aliastables/pfB_EmergingThreatsDShield.txt
157 /var/db/aliastables/pfB_DNSBLIP.txt

pfSense Table Stats

table-entries hard limit 2000000
Table Usage Count 161305

UPDATE PROCESS ENDED [ 04/01/20 17:49:17 ]

RonpfS

Check the pfblockerng.log, system log, resolver log, memory usage, maybe you hit the limit your system can handle going from 60000 DNSBL entries to 430000.

revengineer

@RonpfS Thank you for the pointer. The problem seems to be that the oisd black list contains one domain for which I also have a local host override. The dual override seems to result in the failed loading of unbound. I would like to keep the local override because I have no control of future changes to the blacklist. Is there a workaround?

RonpfS

Put that domain in the DNSBL Whitelist, you might also have to put it (or it's parent domain) in the TLD Exclude list to get better control over whitelisting.

revengineer

@RonpfS Perfect, that worked! Adding the domain with subdomains (leading ".") was sufficient to fix the problem. It took me a while to figure it out because I did a "Force Update" which was insufficient. Once I did the "Force Reload" I was good to go. Thanks for the help!

RonpfS

Yeah sometimes you save time by clicking on the

BBcan177

@revengineer
The is a log snippet above that to show the processing of that feed and the restart of Unbound. Take a look at those two sections of the pfblockerng.log.