Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Page works but refresh or “next page” hits DNSBL - only on iPad

    Scheduled Pinned Locked Moved pfBlockerNG
    9 Posts 3 Posters 537 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • keyserK
      keyser Rebel Alliance
      last edited by

      Okay I have a very weird issue. I have pfBlockerNG installed and use a few feeds to block the most obvious offenders :-)
      However: I use www.tomshardware.com or www.anandtech.com quite a lot, and they work just fine on my PC - everytime and all the time.
      On my Ipad they also work when i first access them, and if i click on subpage links within the first minute or two that works just fine too. But if I read for several minutes any click to a subpage will be blocked and I’m presented with my DSNBL certificate error (I get blocked by DNSBL). This is only a problem on my iPad, and it only started happening after I upgraded to pfBlockerNG_Devel to get the included feeds structure.
      I have included a screenshot of my DNSBL alerts that shows DNSBL blocking those sites, but why is everything unknown on those alerts?

      PS: I have also whitelisted the sites, but that makes no difference.

      Any ideas?

      -Keyser

      2809161C-CA22-4567-97DB-4BF90CD25ED7.jpeg

      Love the no fuss of using the official appliances :-)

      1 Reply Last reply Reply Quote 0
      • BBcan177B
        BBcan177 Moderator
        last edited by

        What browser are you using on the Ipad? Try an alternative and see if its reproducible.
        When you see "unknown", it means that Domain is not in any Blocklists, but something on the Ipad is telling those two sites to resolve to the DNSBL VIP (10.10.10.1).
        A quick test would be to run a "host -t A example.com" on the pfSense box and see what it resolves to.

        "Experience is something you don't get until just after you need it."

        Website: http://pfBlockerNG.com
        Twitter: @BBcan177  #pfBlockerNG
        Reddit: https://www.reddit.com/r/pfBlockerNG/new/

        1 Reply Last reply Reply Quote 0
        • keyserK
          keyser Rebel Alliance
          last edited by keyser

          The issue is reproducible in Edge on my iPad. I have also tried using a DNS resolver app on my iPad, and whenever the issue is present in the browser, resolving www.anandtech.com goes to my DNSBL Vip Address. So wtf is going on?

          I cannot seem to get the command “host -t A www.anandtech.com” to fail to resolve to an akamai address on the pfsense itself.

          So it would seem it’s an iPad/cache issue allthough it’s VERY VERY strange this started happening the very day I upgraded my pfSense to an SG-1100 and installed pfBlockerNG_devel instead of the stable release.

          PS: I noticed that both tomshardware and anandtech resolves to the same akamai IP address which would suggest thats the common ground they share.

          Btw: It happens on my iPhone as well, so it seems it happens on all iOS devices.

          Any ideas?

          Love the no fuss of using the official appliances :-)

          1 Reply Last reply Reply Quote 0
          • NogBadTheBadN
            NogBadTheBad
            last edited by NogBadTheBad

            @keyser said in Page works but refresh or “next page” hits DNSBL - only on iPad:

            cannot seem to get the command “host -t A www.anandtech.com” to fail to resolve to an akamai address on the pfsense itself.

            DNSBL is blocking www.anandtech.com by the looks of things, but it doesn't appear to be matching a feed.

            Screenshot 2019-05-29 at 07.56.34.png

            mac-pro:~ andy$ host -t A www.anandtech.com
            www.anandtech.com is an alias for www.anandtech.com.edgekey.net.
            www.anandtech.com.edgekey.net is an alias for e1151.e12.akamaiedge.net.
            e1151.e12.akamaiedge.net has address 2.19.145.189
            mac-pro:~ andy$

            A capture of DNS while trying to view a page:-

            Screenshot 2019-05-29 at 08.08.58.png

            172.16.255.2 is my DBNSBL VIP

            Andy

            1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

            1 Reply Last reply Reply Quote 0
            • keyserK
              keyser Rebel Alliance
              last edited by

              Thanks Andy - That was a valuable clue.

              I did a packetcapture, and indeed the iPad first resolves www.anandtech.com and recieves the CNAME and IP for the page which it uses and loads the page.
              After a minute when i click a subpage, the iPad directly tries to resolve the CNAME record (e1151.e12.akamaiedge.net) which goes to my DNSBL. So that explains why this i happening. Two things however:

              1: My PC has a different behaviour - after a minute it still tries to resolve www.anandtech.com again instead of directly going for the CNAME. Is that just different OS behavior?
              2: What is the best way to “mitigate” this issue? Whitelist the specific akamai CNAME which seems like a very temporary solution, or whitelist akamai more in general? It seems this akamai content cache is blocked by the SBL_ADs feed in pfBlockerNG

              Love the no fuss of using the official appliances :-)

              1 Reply Last reply Reply Quote 0
              • NogBadTheBadN
                NogBadTheBad
                last edited by

                [2.4.4-RELEASE][admin@pfsense]/var/unbound: grep edgekey *
                pfb_dnsbl.conf:local-data: "79423.analytics.edgekey.net 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "ma180-r.analytics.edgekey.net 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "ma728-r.analytics.edgekey.net 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "ma156-r.analytics.edgekey.net 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "analytics.edgekey.net 60 IN A 172.16.255.2"
                [2.4.4-RELEASE][admin@pfsense]/var/unbound: grep anandtech *
                pfb_dnsbl.conf:local-data: "tracker.anandtech.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "dynamic1.anandtech.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "dynamic2.anandtech.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "anandtechverce.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www.anandtechverce.com 60 IN A 172.16.255.2"
                pfb_dnsbl.tsp:local-zone: "anandtechverce.com" redirect local-data: "anandtechverce.com 60 IN A 172.16.255.2"
                2.4.4-RELEASE][admin@pfsense]/var/unbound: grep tomshardware *
                pfb_dnsbl.conf:local-data: "tomshardware.fr.intellitxt.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "tomshardware.se.intellitxt.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "tomshardware.us.intellitxt.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "tracking.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www1.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www10.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www11.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www12.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www13.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www14.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www15.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www2.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www3.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www4.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www5.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www6.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www7.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www8.ad.tomshardware.com 60 IN A 172.16.255.2"
                pfb_dnsbl.conf:local-data: "www9.ad.tomshardware.com 60 IN A 172.16.255.2"
                [2.4.4-RELEASE][admin@pfsense]/var/unbound:
                

                Andy

                1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                1 Reply Last reply Reply Quote 0
                • keyserK
                  keyser Rebel Alliance
                  last edited by

                  I can't figure out what you are suggesting in your post (it's only a screendump of a search in unbound of all the DNSBL entries containing anandtech/tomshardware).

                  Removing those entries will not solve my problem. On subpages/clicks i do, iOS has decided to directly resolve the e1151.e12.akamaiedge.net A record it was given as a CNAME when it initially asked for www.anandtech.com.
                  What it should do is like my PC: It should continue to resolve www.anandtech.com and use the IP it is given (along with the info that anandtech is a CNAME).
                  It is www.anandtech.com I'm visiting after all....

                  So to fix this (Until Apple behaves better) I have to make sure the e1151.e12.akamai.net A record does not get resolved to my DNSBL VIP address.

                  Love the no fuss of using the official appliances :-)

                  1 Reply Last reply Reply Quote 0
                  • NogBadTheBadN
                    NogBadTheBad
                    last edited by NogBadTheBad

                    It's not an Apple issue it's something the server is doing, if you disable DNSBL everything works.

                    I even tried changing the User Agent without much luck.

                    The config from pfb_dnsbl.conf is created when pfBlocker does an update NOT when a client views a page.

                    Andy

                    1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                    1 Reply Last reply Reply Quote 0
                    • keyserK
                      keyser Rebel Alliance
                      last edited by

                      Well yes, ofcourse it works if I disable DNSBL, and it also works if I whitelist e1151.e12.akamaiedge.net (which is my current workaround).
                      I know pfb_dnsbl.conf is created at update time, but currently the akamai entry is included in the config because it is present in the SBL_ADs feed (Hence my need to whitelist it).
                      So I still don’t quite get what you are reffering to - as far as I can tell it is an Apple issue because iOS the second time around decides to lookup the original A record (akamai) for which www.anandtech.com is a CNAME. It seems my PC continues to lookup www.anandtech.com.

                      Love the no fuss of using the official appliances :-)

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.