pfBlockerng very slow at DNS



  • Hi I recently virtualized pfSense and installed pfBlockerng.
    With activated pfblocker it take about 20 seconds to start loading the page.
    If I turn it off, it is at ~1.5 sec

    any idea what causes this massive delay?

    virtualized with esxi 6.7, running on 1 core, 8gb ram 35gb space.
    ![alt text](3_1551810030383_4.JPG 2_1551810030383_3.JPG 1_1551810030383_2.JPG 0_1551810030382_1.JPG image url)


  • Moderator

    Check the Alerts tab to see what is being blocked.
    Try to enable IP blocking first, then enable DNSBL to narrow down which component to review.

    Also there are some Dashboard notices. What do they say?



  • 0_1551897486529_5.JPG
    1_1551897495565_7.JPG 0_1551897495565_6.JPG

    2_1551897502891_10.JPG 1_1551897502891_9.JPG 0_1551897502891_8.JPG

    with
    DNSBL->ON
    IP De-Dublication-> ON
    PFblockerNG->ON
    I am not able to upload the pics above

    with
    DNSBL->OFF
    IP De-Dublication-> ON
    PFblockerNG->ON
    I am not able to upload the pics above

    with
    DNSBL->OFF
    IP De-Dublication-> OFF
    PFblockerNG->ON
    I am not able to upload the pics above

    with
    DNSBL->OFF
    IP De-Dublication-> OFF
    PFblockerNG->OFF
    I am able to upload the pics above

    Will do some more testing and come back. Thanks for support!



  • is any issue known with the RADIUS package of pfSense and pfblockerng?

    I uninstalled it and it seems much faster!

    Will continue testing tomorrow.



  • @pooperman said in pfBlockerng very slow at DNS:

    There were error(s) loading the rules: /tmp/rules.debug:46: cannot define table

    Try to increase the Firewall Maximum Table Entries under System / Advanced / Firewall & NAT



  • @ronpfs

    thanks for feedback, changed it. will try performance and report back.



  • I think it is now running quite well.
    many thanks for your help.

    one more point I would like to ask.
    I'd like to browse through this news page, but I do not know why the ads are note being blocked with TLD, DNSBL etc.
    0_1552066812755_11.JPG

    Any idea what to do?


  • Moderator

    Right-click on the AD, and click "Inspect".... If the HTML code shows a domain name, and the domain is not from the site itself, then you can add that Domain to a DNSBL Customlist at the bottom of any DNSBL Feed page.



  • Definitely inspect the content--you will probably find a URL which is not blocked being used there.

    Sometimes you may be getting ads from a subdomain, so you may need to check the "Enable TLD" to attempt to deal with these subdomains.
    Also, so sites host ads locally, but that is less common. A content inspection should tell you.


Log in to reply