Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DNSBL Out of Sync after reloads/updates

    pfBlockerNG
    2
    8
    1.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      aograin
      last edited by

      Older Thread: https://forum.netgate.com/topic/142435/pfblockerng-devel-dnsbl-is-out-of-sync-perform-a-force-reload-to-correct

      pfblocker_log.txt

      I am running into DNSBL update [ 368701 ] [ 515215 ] ... OUT OF SYNC errors in my logs constantly.

      I have tried enabling/disabling pfblockerNG and doing a force reload. I also don't see any duplicate headers in my log files.

      I have a feeling it may be related to this in the log file.

      TLD finalize

 Original    Matches    Removed    Final     

 832537      396919     463836     368701    

TLD finalize... completed [ 06/17/19 12:13:29 ]

      I feel like I'm missing something simple.

      Some system info:

      pfSense: 2.4.4-RELEASE-p3
Version: pfblockerNG-devel 2.2.5_23
CPU: i5 - 7300U
RAM: 16GB
      1 Reply Last reply Reply Quote 0
      • A
        aograin
        last edited by aograin

        Maybe it's the TLD blocking of full domains causing the sync issue:

        Blocking full TLD/Sub-Domain(s)... |cm|party|click|link|technology|gdn|study|men|biz|reise|stream|ru| completed

        If so then I assume DNSBL will never be "In Sync", not sure if that's ok or what best practice would recommend.

        BBcan177B 1 Reply Last reply Reply Quote 0
        • BBcan177B
          BBcan177 Moderator @aograin
          last edited by

          @aograin
          https://www.reddit.com/r/pfBlockerNG/comments/c0q1sc/dnsbl_is_out_of_sync_but_dnsbl_is_fully_functional/

          "Experience is something you don't get until just after you need it."

          Website: http://pfBlockerNG.com
          Twitter: @BBcan177  #pfBlockerNG
          Reddit: https://www.reddit.com/r/pfBlockerNG/new/

          1 Reply Last reply Reply Quote 0
          • A
            aograin
            last edited by aograin

            @BBcan177 Thank you for sending me that link. I have read through the thread but I'm not sure if I am running into the same issue or if it is one of a similar type.

            I am only using the DNSBL Whitelist (below) to allow certain domains and subdomains and the TLD Blacklist. TLD Exclusion List and TLD Whitelist are blank.

            .s3.amazonaws.com
.amazonaws.com
.s3-1.amazonaws.com # CNAME for (s3.amazonaws.com)
.github.com
.githubusercontent.com
github.map.fastly.net # CNAME for (raw.githubusercontent.com)
.apple.com
.sourceforge.net
.fls-na.amazon.com # alexa
.control.kochava.com # alexa 2
.device-metrics-us-2.amazon.com # alexa 3
.amazon-adsystem.com # amazon app ads
.px.moatads.com # amazon app 2
.wildcard.moatads.com.edgekey.net # CNAME for (px.moatads.com)
.e13136.g.akamaiedge.net # CNAME for (px.moatads.com)
.secure-gl.imrworldwide.com # amazon app 3
.pixel.adsafeprotected.com # amazon app 4
.anycast.pixel.adsafeprotected.com # CNAME for (pixel.adsafeprotected.com)
.bs.serving-sys.com # amazon app 5
.bs.eyeblaster.akadns.net # CNAME for (bs.serving-sys.com)
.bsla.eyeblaster.akadns.net # CNAME for (bs.serving-sys.com)
.adsafeprotected.com
.anycast.static.adsafeprotected.com # CNAME for (static.adsafeprotected.com)
google.com
www.google.com
docs.google.com
youtube.com
www.youtube.com
youtube-ui.l.google.com # CNAME for (youtube.com)
stackoverflow.com
www.stackoverflow.com
dropbox.com
www.dropbox.com
www.dropbox-dns.com # CNAME for (dropbox.com)
control.kochava.com
secure-gl.imrworldwide.com
pbs.twimg.com # twitter images
www.pbs.twimg.com # twitter images
onedrive.live.com
www.onedrive.live.com
odc-web-geo.onedrive.akadns.net # CNAME for (onedrive.live.com)
odc-web-brs.onedrive.akadns.net # CNAME for (onedrive.live.com)
odwebpl.trafficmanager.net.a-0014.dc-msedge.net.a-0014.a-msedge.net # CNAME for (onedrive.live.com)
a-0014.a-msedge.net # CNAME for (onedrive.live.com)
.mzstatic.com
            1 Reply Last reply Reply Quote 0
            • BBcan177B
              BBcan177 Moderator
              last edited by

              In the General Tab, uncheck "Keep Settings", then Save. That will clear all previously downloaded Feeds. Re-check "Keep Settings", Save, and follow that with a Force Update. If its still out of sync, post a link to the pfblockerng.log for review.

              "Experience is something you don't get until just after you need it."

              Website: http://pfBlockerNG.com
              Twitter: @BBcan177  #pfBlockerNG
              Reddit: https://www.reddit.com/r/pfBlockerNG/new/

              1 Reply Last reply Reply Quote 0
              • A
                aograin
                last edited by

                @BBcan177 That fixed the sync issue! I could have sworn I've done that step a few times this week. I'll keep an eye on it to see if it goes out of sync during the next cron job.

                My only issue now is that after running the force update the DNSBL is listed as disabled on the Dashboard.

                96107e5e-aa58-4bf6-9d04-7fb0dd7c913d-image.png

                BBcan177B 1 Reply Last reply Reply Quote 0
                • BBcan177B
                  BBcan177 Moderator @aograin
                  last edited by

                  @aograin Check the log for details about why its disabled. Need to ensure in the General Tab that pfBNG is enabled, and also enabled in the DNSBL Tab. Finally need to ensure that Unbound is running, and that the DNS Resolver "Custom Options" has this line (which is automatically added by the pkg):

                  server:include: /var/unbound/pfb_dnsbl.*conf

                  "Experience is something you don't get until just after you need it."

                  Website: http://pfBlockerNG.com
                  Twitter: @BBcan177  #pfBlockerNG
                  Reddit: https://www.reddit.com/r/pfBlockerNG/new/

                  1 Reply Last reply Reply Quote 0
                  • A
                    aograin
                    last edited by

                    @BBcan177 Everything looked good and had the appropriate check box checked. I saved the existing DNS Resolver settings and that seemed to correct the issue. Didn't see anything in the logs that stood out.

                    Saving DNSBL database... completed
Reloading Unbound Resolver..... completed [ 06/18/19 20:40:10 ]
DNSBL update [ 515852 | PASSED  ]... completed
Adding to existing Unbound custom options

                    I'll consider this issue closed. Thank you for the support.

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.