Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.

RonpfS

@themadsalvi You could investigate your config.xml to check if something obvious might cause your problems.

RonpfS

@themadsalvi here is what I have on my side :

[2.4.4-RELEASE][2019-05-06 18:51:20][admin@pfsense.local]/var/log: ls -altr
total 4195
drwx------   2 www      www             2 Oct  3  2018 lighttpd
-rw-r--r--   1 root     wheel      161664 Dec  8 19:40 bsdinstall_log
drwxr-xr-x   2 root     wheel           2 Dec  8 19:42 ntp
-rw-r--r--   1 root     wheel           0 Dec  8 19:46 lastlog
drwx------   3 root     wheel           4 Dec  8 19:51 suricata
drwxr-xr-x  26 root     wheel          26 Dec 12 07:42 ..
drwxr-xr-x   7 root     wheel          30 Dec 12 07:42 .
-rw-------   1 root     wheel    10240000 Dec 20 21:14 vpn.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 poes.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 l2tps.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 openvpn.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 portalauth.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 ipsec.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 ppp.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 relayd.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 wireless.log
-rw-------   1 root     wheel    10240000 Dec 20 21:14 routing.log
drwxr-xr-x   2 root     wheel           4 Feb 25 17:03 nginx
-rw-r--r--   1 root     wheel       11566 Feb 26 12:40 dmesg.boot
-rw-------   1 root     wheel        9252 Feb 26 12:40 userlog
-rw-------   1 root     wheel    10240000 Mar 29 12:40 ntpd.log
-rw-r--r--   1 root     wheel         394 May  6 17:45 utx.lastlogin
-rw-------   1 root     wheel       11801 May  6 17:45 utx.log
drwxr-xr-x   2 unbound  unbound        12 May  6 18:19 pfblockerng
-rw-------   1 root     wheel    10240000 May  6 18:20 system.log
-rw-------   1 root     wheel    10240000 May  6 18:20 dhcpd.log
-rw-------   1 root     wheel    10240000 May  6 18:20 resolver.log
-rw-------   1 root     wheel    10240000 May  6 18:20 gateways.log
-rw-------   1 root     wheel    10240000 May  6 18:28 nginx.log
-rw-------   1 root     wheel    10240000 May  6 18:51 filter.log

So some files are updated, some are dated from the last install.

greyv

I'm new to using pfblocker and just had the same issue. I noticed you are using squid as i am also. pfblocker will not filter ip addresses while squid is enabled. I tested enabling and disabling it. I'm not sure what the better option is because i cant get pfblocker to filter https. so currently i'm just using pfblocker to filter dnsbl

cryptonym

@themadsalvi Not to resurrect this very old thread, but just setting this all up and had same issue. Wanted to share in case someone else lands here via a search...

DNSBL was working, resolving them to 10.10.10.1 but no logs.

What was missing was I left "BNSBL Mode" on Unbound (default) rather than setting it to "Unbound Python mode". That one checkbox and a reload and logging is working perfectly.

Gertjan

@cryptonym said in Not seeing IP blocks in Alerts area of reports tab. DNSBL shows up properly.:

DNSBL was working, resolving them to 10.10.10.1 but no logs.

What was missing was I left "BNSBL Mode" on Unbound (default) rather than setting it to "Unbound Python mode". That one checkbox and a reload and logging is working perfectly.

God news - and bad news :

I switched from Python to unbound mode :

I tested with a listed DNDBL host entry (StevenBlack's list) 010sec.com

Sure enough : using http, not https ....

and sure enough :

So Python mode isn't mandatory to make this work.

Btw : I really though everybody had abandoned "unbound mode" by now .... as Python mode is way better/faster/much cooler ^^

That said : imho, you can safely forget about that pFb black web server page that shows up when a visitor visits a site that is blocked.It's something that worked well in the past, when all sites were http based. Because : it needs http sites to actually work - not https.
You know this already : https can't be intercept / redirected - not by me, not by the CIA, not by the NSA, so probably you can't neither ^^
No body is visiting http sites anymore .... Google doesn't index them anymore for years now.
So : the perfect DNSBL setting these days is :

If you find people on your network still using "http" sites, go have a talk with them, before you throw them off your network. I get it, this is a bit harsh, but these days thsi should be common knowledge of any Internet user. Like : when you drive your car on the road you stay on the 'right' side of the road.