Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfBlockerNG-devel 3.0.0_3 DNSBL alerts no longer showing source IP

    Scheduled Pinned Locked Moved pfBlockerNG
    9 Posts 5 Posters 985 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Mr_JinXM
      Mr_JinX
      last edited by

      I've just updated to the latest release and noticed under the reports and alerts its no longer displaying the source IP that generated an alert,

      The bottom two rows are pre upgrade.

      dnsbl.PNG

      fireodoF provelsP 2 Replies Last reply Reply Quote 0
      • fireodoF
        fireodo @Mr_JinX
        last edited by

        @mr_jinx
        Hi,
        as I have read this should be normal if you are in Unbound Python Mode.

        Regards,
        fireodo

        Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
        SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
        pfsense 2.7.2 CE
        Packages: Apcupsd Cron Iftop Iperf LCDproc Nmap pfBlockerNG RRD_Summary Shellcmd Snort Speedtest System_Patches.

        Mr_JinXM 1 Reply Last reply Reply Quote 1
        • provelsP
          provels @Mr_JinX
          last edited by provels

          @mr_jinx
          Is this the page you're referring to? This, mine on 3.0.0_2 on Python.
          e05c97da-d45f-4714-9aed-912273dbe8a4-image.png

          Peder

          MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
          BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

          fireodoF 1 Reply Last reply Reply Quote 0
          • fireodoF
            fireodo @provels
            last edited by

            @provels said in pfBlockerNG-devel 3.0.0_3 DNSBL alerts no longer showing source IP:

            @mr_jinx
            Is this the page you're referring to? This, mine on 3.0.0_2 on Python.
            e05c97da-d45f-4714-9aed-912273dbe8a4-image.png

            No. mr_jinx is meaning this: "DNSBL Block- Last 50 Alert Entries"
            pfblocker-python.png

            Kettop Mi4300YL CPU: i5-4300Y @ 1.60GHz RAM: 8GB Ethernet Ports: 4
            SSD: SanDisk pSSD-S2 16GB (ZFS) WiFi: WLE200NX
            pfsense 2.7.2 CE
            Packages: Apcupsd Cron Iftop Iperf LCDproc Nmap pfBlockerNG RRD_Summary Shellcmd Snort Speedtest System_Patches.

            provelsP 1 Reply Last reply Reply Quote 0
            • provelsP
              provels @fireodo
              last edited by provels

              @fireodo
              OK, found. I see a mix of Unknown and IPs on my 3.0.0_2 version using Python.
              22d453a1-20b1-4243-8565-434bb4ce2fd6-image.png

              Peder

              MAIN - pfSense+ 24.11-RELEASE - Adlink MXE-5401, i7, 16 GB RAM, 64 GB SSD. 500 GB HDD for SyslogNG
              BACKUP - pfSense+ 23.01-RELEASE - Hyper-V Virtual Machine, Gen 1, 2 v-CPUs, 3 GB RAM, 8GB VHDX (Dynamic)

              1 Reply Last reply Reply Quote 0
              • Mr_JinXM
                Mr_JinX @fireodo
                last edited by

                @fireodo your right, I changed it back to unbound mode and i can now see the source IP being logged.

                M 1 Reply Last reply Reply Quote 0
                • M
                  mind12 @Mr_JinX
                  last edited by

                  @mr_jinx you can also leave python mode enabled and tick this to have alerts

                  98cf032f-469e-4b4c-b086-082df69fb7b6-image.png

                  P 1 Reply Last reply Reply Quote 1
                  • P
                    Paint @mind12
                    last edited by Paint

                    @mind12 said in pfBlockerNG-devel 3.0.0_3 DNSBL alerts no longer showing source IP:

                    @mr_jinx you can also leave python mode enabled and tick this to have alerts

                    98cf032f-469e-4b4c-b086-082df69fb7b6-image.png

                    I have DNSBL Event Logging enabled with the pfBlockerNG python module filtering enabled. It seems like this fixes the issue for HTTP requests, but HTTPS requests still show up as unknown.

                    Is there anyway to fix this while still using the pfBlockerNG python module?

                    How do we change the SSL certificate used for pfBlockerNG with the python module? Perhaps that is the issue since the machines on my LAN show all DNSBL rejections/redirects as an invalid SSL certificate

                    pfSense i5-4590
                    940/880 mbit Fiber Internet from FiOS
                    BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                    Netgear R8000 AP (DD-WRT)

                    P 1 Reply Last reply Reply Quote 0
                    • P
                      Paint @Paint
                      last edited by

                      I am running Version 2.4.5-RELEASE-p1 and pfBlocker DEVEL 3.0.0_3

                      pfSense i5-4590
                      940/880 mbit Fiber Internet from FiOS
                      BROCADE ICX6450 48Port L3-Managed Switch w/4x 10GB ports
                      Netgear R8000 AP (DD-WRT)

                      1 Reply Last reply Reply Quote 0
                      • First post
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.