PfBlockerNG v2.1 w/TLD
-
Anyone have issues with pfBlocker and Playstation 4 online gaming? While playing online games lag a lot that the only fix was to disable pfb.
The logs show nothing of what exactly is blocking it.Is there a way to exclude the PS4 to not use the service?
-
Anyone have issues with pfBlocker and Playstation 4 online gaming? While playing online games lag a lot that the only fix was to disable pfb.
The logs show nothing of what exactly is blocking it.Is there a way to exclude the PS4 to not use the service?
Did you review the pfBlockerNG Alerts Tab? If its being blocked via an IP List, it will show in the logs. For DNSBL it should also show in the Alerts Tab. For DNSBL there are some further instructions listed in the DNSBL tab which can be seen when you click on the blue infoblock icon in the INFO section. If it is being blocked by DNSBL and you can't find the Domain thats being blocked, you can set the DNS settings of the LAN device to a different DNS server to bypass DNSBL.
-
Hi @BBcan177
I just wanted to inform you that the info link/icon (to the right of the update ion), links to the wrong forum thread.It's pointing to (pfBlockerNG v2.0 w/DNSBL): https://forum.pfsense.org/index.php?topic=102470.0
When it should be pointing to (pfBlockerNG v2.1 w/TLD): https://forum.pfsense.org/index.php?topic=115357.0
-
-
Hi @BBcan177
I just wanted to inform you that the info link/icon (to the right of the update ion), links to the wrong forum threadThanks good catch! Will change that when I submit the next release :)
Wow! This thread had over 1000 views since last night ;)
That's high 1k over night! For now 2.1.1_4 is running 22 hours without a flaw ;) . I did a php /usr/local/www/pfblockerng/pfblockerng.php dc and all went right (took about 25 min, but that is to be expected as of the dramatic raise of the resources of MaxMind).
-
First of all sorry if this is not in the right forum thread, there is now 3+ active threads for pfbng…
My problem is with the latest release (2.1.1_4) so I figured this is the right location to post.
This morning I got the notification that 2.1.1_4 was released which would fix the late php error problems caused by MaxMind. I immediately updated my package then started pfblockerNG. Then I went to the force update and did a force update. All went well, then I did a force reload. At this moment, the hard drive went crazy for 10min+ and I lost all network connectivity. Lost contact with pfsense, LAN connectivity and of course lost connectivity to the internet.
I rebooted the firewall (reset button) then it came back online. I immediately deactivated pfbng. After that I got these errors by email:
There were error(s) loading the rules: /tmp/rules.debug:53: cannot define table pfB_Top_v6: Cannot allocate memory - The line in question reads [53]: table <pfb_top_v6>persist file "/var/db/aliastables/pfB_Top_v6.txt" There were error(s) loading the rules: /tmp/rules.debug:199: macro 'pfB_Africa_v4' not defined - The line in question reads [199]: block log quick on { em5 } inet from $pfB_Africa_v4 to any tracker 1770009617 label "USER_RULE: pfB_Africa_v4 auto rule"</pfb_top_v6>
-
Take a look a /var/log/pfblockerng/extras.log, /var/log/pfblockerng/pfblockerng.log, Status / System Logs / System / General, Status / System Logs / System / DNS Resolver, Dashboard for crash report.
Resolver log won't tell much. On reboot you have to go to Status / Services and restart the unbound service. After the restart, the log will have unbound messages.
-
@lpallard:
First of all sorry if this is not in the right forum thread, there is now 3+ active threads for pfbng…
My problem is with the latest release (2.1.1_4) so I figured this is the right location to post.
This morning I got the notification that 2.1.1_4 was released which would fix the late php error problems caused by MaxMind. I immediately updated my package then started pfblockerNG. Then I went to the force update and did a force update. All went well, then I did a force reload. At this moment, the hard drive went crazy for 10min+ and I lost all network connectivity. Lost contact with pfsense, LAN connectivity and of course lost connectivity to the internet.
I rebooted the firewall (reset button) then it came back online. I immediately deactivated pfbng. After that I got these errors by email:
There were error(s) loading the rules: /tmp/rules.debug:53: cannot define table pfB_Top_v6: Cannot allocate memory - The line in question reads [53]: table <pfb_top_v6>persist file "/var/db/aliastables/pfB_Top_v6.txt" There were error(s) loading the rules: /tmp/rules.debug:199: macro 'pfB_Africa_v4' not defined - The line in question reads [199]: block log quick on { em5 } inet from $pfB_Africa_v4 to any tracker 1770009617 label "USER_RULE: pfB_Africa_v4 auto rule"</pfb_top_v6>
I'm having a very similar problem. I had uninstalled pfblockerng using the package manager and was waiting for an update to fix the memory problems. When I installed the latest version, I began getting the following errors:
There were error(s) loading the rules: /tmp/rules.debug:27: cannot load "/var/db/aliastables/pfB_NAmerica_v4.txt": No such file or directory - The line in question reads [27]: table <pfB_NAmerica_v4> persist file "/var/db/aliastables/pfB_NAmerica_v4.txt" @ 2016-08-24 21:03:13 There were error(s) loading the rules: /tmp/rules.debug:27: cannot load "/var/db/aliastables/pfB_NAmerica_v6.txt": No such file or directory - The line in question reads [27]: table <pfB_NAmerica_v6> persist file "/var/db/aliastables/pfB_NAmerica_v6.txt" @ 2016-08-24 21:03:24 There were error(s) loading the rules: /tmp/rules.debug:178: macro 'pfB_NAmerica_v4' not defined - The line in question reads [178]: block in log quick on $WAN reply-to ( re0 174.49.92.1 ) inet from ! $pfB_NAmerica_v4 to any tracker 1770009560 label "USER_RULE: pfB_NAmerica_v4 auto rule" @ 2016-08-24 21:03:27 There were error(s) loading the rules: /tmp/rules.debug:178: macro 'pfB_NAmerica_v4' not defined - The line in question reads [178]: block in log quick on $WAN reply-to ( re0 174.49.92.1 ) inet from ! $pfB_NAmerica_v4 to any tracker 1770009560 label "USER_RULE: pfB_NAmerica_v4 auto rule" @ 2016-08-24 21:03:30
The end result for me is that my white list rule allowing only inbound traffic from the U.S. fails to load. However, I have no problems with other features, (e.g., adblocking). No errors show up in extras.log or pfblockerng.log.
-
When you uninstalled the pkg previously, did you uncheck "Keep Settings"… If not, some files may have remained.
I would suggest you goto the pfBlockerNG General tab, and uncheck "Enable pfBlockerNG" and uncheck "Keep Settings", followed by "Save"... Then reverse this by re-checking both options and "Save".
Goto the Dashboard and clear any notices so that you are starting fresh...
Then goto the Update tab and run a "Force Update".
Then review the pfblockerng.log for any issues (if any).
-
OK so I tried unchecking the "Keep settings" and "Enable pfb" checkboxes then saving. Then I checked them back on and did a force update. The process never ended. 45minutes later, everything was dead and the last thing I could see on the WebUI was "Rstsarting Unbound".
The hard drive gpoes completely off charts while this happens. I tried getting the system logs after the hard reset but it goes only up to 22:35 which is already 5 minutes after I manually reset the pfsense box.
Tomorrow I will try to simulate this once more, and gather all logs I will be able to find. My feeling, somehow, since I lose all network connectivity, is that unbound crashes hard probably due to lack of RAM?? Is it even possible? I am saying that because when this happens I have network connectivity for a few minutes then everything drops. Then I cant even connect to my internal clients (same subnet).
-
If outbound crashes, you should still be able to access the FW by it's IP. So open one tab in your browser using the FW IP and have Diagnostics / System activity open so you can see what is happening while you run Force Reload on another tab with the FW FQDN.
Again, you won't get any log from Resolver(unbound) if you do not restart it right after reboot.Could you be running out of disk space ? Do you have /var in RAM Disk? Maybe your hard disk is failing.
Before enabling pfBlockerNG, disable the tables and enable them progressively to pinpoint the problem.
Then before enabling DSNBL, disable the tables and go progressively until the issue appears.
-
BBcan177, private email sent.
-
Same issues as lpallard. I mostly resolved this by bumping Max table entries above 2MM and disabling/enabling PFBNG.
-
Trying to figure out pfblocker on CARP….
I've used this extensively on single installs but not via CARP. Are there any considerations I should take into account? I was told by pfsense support when I first installed that firewalls should mirror (ie. have pfblocker installed on both, etc.)
Am I ok to configure FW1 on 10.0.10.1 with whatever pfblocker stuff I want then simply sync to 10.0.10.2 (FW2?) I don't have to worry about the CARP interface or sync issues between this package and that right (let's say CARP interface is on 10.0.10.250) -
Trying to figure out pfblocker on CARP….
I've used this extensively on single installs but not via CARP. Are there any considerations I should take into account? I was told by pfsense support when I first installed that firewalls should mirror (ie. have pfblocker installed on both, etc.)
Am I ok to configure FW1 on 10.0.10.1 with whatever pfblocker stuff I want then simply sync to 10.0.10.2 (FW2?) I don't have to worry about the CARP interface or sync issues between this package and that right (let's say CARP interface is on 10.0.10.250)Hi blueduckdock,
You can use CARP/HA in pfSense without issue. The package has an XMLRPC sync Tab that allows for the configuration of the package to be sync'd to other boxes… But with the current DNSBL code, this will cause issues with the DNSBL VIP, as both pfSense boxes will have the same DNSBL VIP address..
I had one user several months ago ask if this could be addressed and I did create a patch to get this addressed... If you are able to test it out, shoot me a PM if that works for you...
-
Trying to figure out pfblocker on CARP….
I've used this extensively on single installs but not via CARP. Are there any considerations I should take into account? I was told by pfsense support when I first installed that firewalls should mirror (ie. have pfblocker installed on both, etc.)
Am I ok to configure FW1 on 10.0.10.1 with whatever pfblocker stuff I want then simply sync to 10.0.10.2 (FW2?) I don't have to worry about the CARP interface or sync issues between this package and that right (let's say CARP interface is on 10.0.10.250)Hi blueduckdock,
You can use CARP/HA in pfSense without issue. The package has an XMLRPC sync Tab that allows for the configuration of the package to be sync'd to other boxes… But with the current DNSBL code, this will cause issues with the DNSBL VIP, as both pfSense boxes will have the same DNSBL VIP address..
I had one user several months ago ask if this could be addressed and I did create a patch to get this addressed... If you are able to test it out, shoot me a PM if that works for you...
Yeah, I saw that post about DNSBL. Sucks because that's a big part of what I'm looking for with this.
Unfortunately I cannot test on that (it's prod.) If I get to it, I'll try to set either my home up with CARP (was thinking about doing it in the future between proxmox and physical anyway) or at least two pfsense VMs in my homelab.
I will let you know as I'd like to test it and help out. I've used pfblocker for so long it's the least I can do.
Thanks BBcan
-
Yeah, I saw that post about DNSBL. Sucks because that's a big part of what I'm looking for with this.
Unfortunately I cannot test on that (it's prod.) If I get to it, I'll try to set either my home up with CARP (was thinking about doing it in the future between proxmox and physical anyway) or at least two pfsense VMs in my homelab.
I will let you know as I'd like to test it and help out. I've used pfblocker for so long it's the least I can do.
Thanks BBcan
Thanks, if/when you have a test environement setup, shoot me a PM and we can go from there!
I've used pfblocker for so long it's the least I can do.
Thanks, I appreciate that! ;)
-
Running the latest 2.1.1_4
When force updates via the GUI all control is lost but I can see the updates. The only way to get it back is to ssh and reset using 11 and 16, or close the browser and wait a while before login back in. If I run the updates via console do not have the same issue, I think it's has something to do with the live logs.
Thanks
Tony -
Running the latest 2.1.1_4
When force updates via the GUI all control is lost but I can see the updates. The only way to get it back is to ssh and reset using 11 and 16, or close the browser and wait a while before login back in. If I run the updates via console do not have the same issue, I think it's has something to do with the live logs.
Your back from the netherworld ;)
With the change to NGINX, the "View" button in the Update Tab is not working 100% …. I have that on the list of things to fix, but it might be removed from future releases as I don't think there is a good resolution for that one...
-
Running the latest 2.1.1_4
When force updates via the GUI all control is lost but I can see the updates. The only way to get it back is to ssh and reset using 11 and 16, or close the browser and wait a while before login back in. If I run the updates via console do not have the same issue, I think it's has something to do with the live logs.
Thanks
TonyIt's just your browser that is sometimes unable to open any connections to the FW FQDN when you run Force Update. You can still access the FW in another tab using the FW IP, or with another browser, or from another computer.
-
Malvertising in Action:
Published on Sep 1, 2016
Exploit kits are a class of threat that indiscriminately attempt to compromise all users. Malicious advertisements, or malvertising, are a common vector adversaries use to try and redirect users to an exploit kit.https://www.youtube.com/watch?v=-E56rSF01no&feature=youtu.be
-
Hi all
I am looking for some IP/DNSBL blocklist / blacklist with very small false positive and was wondering from your experience with using different block lists which one would you recommend.Thanks in advance for taking the time to respond.
-
can someone help me on that:
i bave many firewall log entries likeSep 26 11:05:04 LAN 10.0.0.80:45511 127.0.0.1:8443
why is it blocked by pfblock rule?
and why 127.0.0.1?? -
can someone help me on that:
i bave many firewall log entries likeSep 26 11:05:04 LAN 10.0.0.80:45511 127.0.0.1:8443
why is it blocked by pfblock rule?
and why 127.0.0.1??Goto the General tab, and enable "Suppression", the Force Reload - All…. This will remove all RFC1918 and loopback addresses...
-
Okay thank you. Did that 8)
-
Is it possible to use some of the paid databases from Maxmind with pfBlockerNG ? (other than GeoLite2)
And if possible, how ?
-
Is it possible to use some of the paid databases from Maxmind with pfBlockerNG ? (other than GeoLite2)
And if possible, how ?
Hi, I have not tested it, but if you do have a paid subscription, I would think that they would give you an API key that could be added to the MaxMind URL…
You could manually edit the URL in /usr/local/www/pfblockerng/pfblockerng.php
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/www/pfblockerng/pfblockerng.php#L52
And adjust the MaxMind cron task to run once a week (I think thats the update freq. of the paid subscription database).
https://github.com/pfsense/FreeBSD-ports/blob/devel/net/pfSense-pkg-pfBlockerNG/files/usr/local/pkg/pfblockerng/pfblockerng.inc#L5303
-
http://10.10.10.1:8443 return a gif
It should be https://10.10.10.1:443 but that doesn't return and doesn't it log to dnsbl.log either.
Sorry guys if this is dumb, or I missed something obvious. I am power reading as much as I can possibly stand (eyes starting to hurt) about PFBNG, and I came across this and from my understanding from previous reading, this site should be blocked via all of the settings I have… I think?
I navigated to https://10.10.10.1:443 in chrome and got the "Your connection is not private" warning, not a Gif. This tells me something isn't working correct. I am not even sure where to start with my question, so I will start at the obvious:
This does mean something isn't working, correct? If so, what exactly may that be?
Once again, just trying to get my feet wet and start actually using pfsense for what its worth, I have had my box deployed for about a month now with no packages running, and for better or worse this was my first package to try!
Edit
Also, is there a list somewhere of all of the available DNSBL Feeds? I have read through lots of pages and have input all of BBCan's lists that I have found, I didn't document them.... and I am not sure how to printout a list of all that are currently running on my pfsense box. Like I said, pretty noob, but very interested in learning :)
I guess to this same question, like I said, I haven't kept a list, would it be an issue to have the same feed in multiple groups? I don't think this has happened, but without keeping valiant records of what I have added, it would be hard to even figure this out unless there is a way to show what all has been loaded and running (I assume there is a way to do this).
And what I have seen BBCan117 write SO MANY times is, its better not to block the world, still trying to figure out exactly how to do that...
Also, what I can say, I am somewhat happy I started using this, finally using the 8 GBs of RAM I put in this box! Up to almost 70% utalization, before PFBNG I was at ~2% LOL!
-
See the following:
https://forum.pfsense.org/index.php?topic=119954.msg663601#msg663601 -
See the following:
https://forum.pfsense.org/index.php?topic=119954.msg663601#msg663601Ok. Well, maybe it is ok. I pulled up 10.10.10.1:443 on my iPad s and just allowed it to show the website. The iPad tab in chrome did say "1x1 pixel". So I am thinking this means it actually is working, I doubt the chrome tab would say 1x1 pixel on its own lol.
-
Edited, I think I have figured out my issue, it was a dumb question in the first place :-[
-
I just wanted to ask if I can (ab)use the GeoIP data in PFBlocker.
I'm currently using it to drop outbound traffic to certain countries.
I'd also like to set up multiple aliases, so I can route traffic to certain other countries via a designated interface.Is this possible?
-
I just wanted to ask if I can (ab)use the GeoIP data in PFBlocker.
I'm currently using it to drop outbound traffic to certain countries.
I'd also like to set up multiple aliases, so I can route traffic to certain other countries via a designated interface.Is this possible?
You can goto the IPv4/6 Tab and create any combination of GeoIP aliases… Click the blue infoblock icons for further details... You can also use "Alias type" settings which will allow you to manually create your firewall rules and add the GeoIP Aliases as required.
-
How do you guys block these annoyings youtube ads popping up before the video playback starts or worst are showing up randomly during playback?
This is weird, I am not seeing any form or kind of advertisement on my computers, but on our android devides we see those. Two examples:
https://youtu.be/weyiTnwtGrk
https://youtu.be/d-AH_IEnLIgDamn I hate those!
I currently maintain a decent list of DNSBL ads feeds but for whatever reasons the ads are getting by.
http://pgl.yoyo.org/adservers/serverlist.php?hostformat=hosts&mimetype=plaintext
http://hosts-file.net/ad_servers.txt
https://adaway.org/hosts.txt
http://sysctl.org/cameleon/hosts
http://winhelp2002.mvps.org/hosts.txt -
Hi, BBcan -
First, I'd like to thank you for this excellent tool!
I've been testing out the TLD feature with version 2.1.1_6 with a set of DNSBL lists totaling more than 600k domains. It's working really well, but as you explained it uses a lot of memory.
I think the memory situation could be improved significantly if deduplication could be improved to identify redundant subdomains that don't have a corresponding higher level domain in the list.
I've noticed that some of the larger lists I'm using (for example, hosts-file.net) contains large numbers of domains with randomly generated third, fourth, or fifth level subdomains. Other than Bambanek's DGA list (all 2nd level) most of the generated names are third level or below.
There are a few methods I can think of that this could be implemented.
The easiest method would be to simply truncate subdomains lower than a certain level (say, second, third or fourth) before deduplication. This would be relatively fast and should work relatively well. A configuration option could allow the user to determine how aggressively to apply this. More aggressive truncation would result in substantially shorter lists.
Another way is to dynamically by count the number of subdomains for each higher level domain, and if the count is greater than some configurable threshold replacing subdomains with the higher level domain. This would take more processing but could be a way to identify domains that could be replaced by a wildcard.
-
Hi, BBcan -
First, I'd like to thank you for this excellent tool!
Thanks!
I think the memory situation could be improved significantly if deduplication could be improved to identify redundant subdomains that don't have a corresponding higher level domain in the list.
I have intentions to add "Reputation" options to DNSBL… Similar to "Reputation" in the IPv4 section. Maybe after the next release of the package.
TLD will block the whole domain/sub-domains if the root domain is listed... Its really strange that some of these feeds will list >50 Sub-domains which are obviously DGA but not list the root domain name?
You can run the following command to find which domains are listed over a specific count.
You can modify this command:
find the first two TLD levels ( cut -d '.' -f 1-2)
find the first three TLD levels ( cut -d '.' -f 1-3)find count of 30 ( max=30 )
sed 's/local-data: \"\(.*\) 60.*/\1/' /var/unbound/pfb_dnsbl.conf | rev | cut -d '.' -f 1-2 | rev | awk -v max=50 '{a[$0]++}END{for(i in a){if(a[i] > max){print i}}}' Then you can choose which of these repeated domains to add to a [u][b]DNSBL Customlist[/b][/u], which will block the domain/sub-domains and remove all the duplicated entries... After adding them, run a "Force reload - DNSBL" Keep in mind that (msn.com and amazonaws.com) also have a lot of sub-domains listed... [code]grep "msn.com" /var/unbound/pfb_dnsbl.conf grep "amazonaws.com" /var/unbound/pfb_dnsbl.conf[/code][/i]
-
Glad to hear you're planning a reputation system - that is basically what I was thinking when I'd suggested counting subdomains.
sed 's/local-data: \"\(.*\) 60.*/\1/' /var/unbound/pfb_dnsbl.conf | rev | cut -d '.' -f 1-2 | rev | awk -v max=50 '{a[$0]++}END{for(i in a){if(a[i] > max){print i}}}' Then you can choose which of these repeated domains to add to a [u][b]DNSBL Customlist[/b][/u], which will block the domain/sub-domains and remove all the duplicated entries... After adding them, run a "Force reload - DNSBL" This is an awesome suggestion! I hadn't thought of periodically searching for DGA type domains as a secondary process to build a filter. That would allow experimenting with various algorithms. For example, I was thinking today that maybe the TLD filter list could be used to moderate the clipping process so that it doesn't disproportionately affect country-code sites. [/i]
-
For example, I was thinking today that maybe the TLD filter list could be used to moderate the clipping process so that it doesn't disproportionately affect country-code sites.
There is an option in Alexa TOP1M, that allows for whitelisting specific TLDs… So I guess it could work similar to that where selected ccTLDs are excluded from the Reputation process... Will keep this in mind.... Thanks!
-
BBcan177,
Thank you for all the work you’ve done in developing pfBlockerNG. I stumbled across pfBlockerNG while looking for an adblock solution on pfSense and have been pleased at how well it works.
I would like to share my experience with pfBlockerNG DNSBL on an iOS device and suggest a new feature. As some other people have pointed out, Safari on iOS presents a certificate warning for the HTTPS sites DNSBL redirects. (https://www.reddit.com/r/PFSENSE/comments/4f56zk/blocking_ads_using_pfblockerng_dnsbl/) As you point out, other browsers like Chrome on iOS behave better and silently drop the redirected requests. While the iOS device is connected to a network that is protected by pfBlockerNG, Chrome presents a much better user experience since it does not constantly show certificate warnings.
However, Chrome on iOS does not support adblock extensions like Safari does. When the iOS device moves to a network that isn’t protected by pfBlockerNG, sites loaded by Chrome now contain ads. Ironically, Safari presents a better user experience since it supports adblock extensions and does not present certificate warnings for ad domains.
A frustrating trivia fact: on the latest version of iOS, the only way to remove a certificate that was trusted in Safari is to use the “Reset All Settings” option. (https://apple.stackexchange.com/questions/130612/how-do-you-remove-ssl-certificate-exceptions-on-ios/130626#130626) Certificates trusted in Safari are not part of a “Profile” that can be deleted. If a user accidentally clicks on “Continue” or “Trust” for any of the numerous certificate warnings presented by Safari for DNSBL redirects, the only way to revoke the self-signed certificate is to reset the iOS device.
In one of your responses (https://www.reddit.com/r/PFSENSE/comments/4f56zk/blocking_ads_using_pfblockerng_dnsbl/d26da1c/), you mention that:
“Solutions like installing AD Blocking with a pi-hole device work by basically sending an NXDOMAIN for these DNS queries. This works, however, you don't get a log of what was blocked.”
Would it be possible to offer two options for DNSBL – redirect and serve pixel as it is currently doing or sending NXDOMAIN, at the cost of some logging? Perhaps even offering the ability to select different options for HTTP and HTTP requests.
Eg:
(current behavior)
HTTP: pixel
HTTPS: pixel(configuration that would help out some iOS users)
HTTP: pixel
HTTPS: NXDOMAIN(other possible configuration)
HTTP: NXDOMAIN
HTTPS: NXDOMAIN–--
Edit: I just found your post https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099 that says "Upcoming version will allow mixing of the DNSBL VIP and 0.0.0.0 so that the domains that are causing these erorrs, can utilize 0.0.0.0 whilst all others use the DNSBL VIP and the logging remains intact... or if you didn't want to log the blocked alerts...."
It seems like you're already working on this feature. :) Thanks!
-
BBcan177,
Thank you for all the work you’ve done in developing pfBlockerNG. I stumbled across pfBlockerNG while looking for an adblock solution on pfSense and have been pleased at how well it works.
Thanks!
Edit: I just found your post https://forum.pfsense.org/index.php?topic=124945.msg691099#msg691099 that says "Upcoming version will allow mixing of the DNSBL VIP and 0.0.0.0 so that the domains that are causing these erorrs, can utilize 0.0.0.0 whilst all others use the DNSBL VIP and the logging remains intact… or if you didn't want to log the blocked alerts...."
It seems like you're already working on this feature. :) Thanks!
Yes the next release will have this feature…