Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    I found a weird "bug" in pfblockerng

    pfBlockerNG
    2
    3
    476
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      moscato359 last edited by

      If you have pfblockerng installed with DNSBL enabled, and only use unbound as your firewall's only DNS server, you can't complete a reboot after configuration restore.

      Netgate support confirmed the issue.

      This is essentially what happens:

      You wipe the machine, and install with a new image.

      Configure it enough to do a configuration restore.

      The configuration detects that you have missing packages, and tries to download them.

      This makes a DNS request to unbound.

      Unbound can't start because the configuration file includes a custom line to load pfblockerng blocked entries, which don't exist, because the package isn't installed yet.

      As unbound can't load, you can't complete the dns request necessary to download and install packages, including pfblockerng, which means that a circular dependency occurs.

      The escape strategy is to load the webui, and change the DNS entries the firewall is using, and disabling unbound.

      Perhaps a warning message needs to be made while using only 127.0.0.1 as dns, while using dnsbl.

      1 Reply Last reply Reply Quote 0
      • BBcan177
        BBcan177 Moderator last edited by

        See the following redmine:

        https://redmine.pfsense.org/issues/6603

        Until this is fixed in Unbound, you should either disable DNSBL before making a backup, or run the following command to temporarily create the file:

        touch /var/unbound/pfb_dnsbl.conf
        
        1 Reply Last reply Reply Quote 0
        • M
          moscato359 last edited by

          Thank you for your fast reply, and good information.

          1 Reply Last reply Reply Quote 0
          • First post
            Last post

          Products

          • Platform Overview
          • TNSR
          • pfSense
          • Appliances

          Services

          • Training
          • Professional Services

          Support

          • Subscription Plans
          • Contact Support
          • Product Lifecycle
          • Documentation

          News

          • Media Coverage
          • Press
          • Events

          Resources

          • Blog
          • FAQ
          • Find a Partner
          • Resource Library
          • Security Information

          Company

          • About Us
          • Careers
          • Partners
          • Contact Us
          • Legal
          Our Mission

          We provide leading-edge network security at a fair price - regardless of organizational size or network sophistication. We believe that an open-source security model offers disruptive pricing along with the agility required to quickly address emerging threats.

          Subscribe to our Newsletter

          Product information, software announcements, and special offers. See our newsletter archive to sign up for future newsletters and to read past announcements.

          © 2021 Rubicon Communications, LLC | Privacy Policy