pfblockerng-dev restarts unbound but DNSBL is disabled


  • Hi there,

    I am trying to avoid pfblockerng-dev on my pfSense to restart my unbound resolver. I deactivated DNSBL in pfblockerng (I did not enable the DNSBL feature). My pfblockerng executes the CRON job at 6 am every morning and it always restarts unbound even tho it is not supposed to do that. Does anybody know how to prevent pfblockerng from restarting Unbound? Manually executing Update/CRON/Reload also causes Unbound to restart.

    Any help greatly appreciated!

    Cheers!

    Henry


  • @elmnts Version of pfsense ? pfblockerng? logs?


  • @ronpfs pfSense is running version 2.4.5. pfblockerng-dev is version 3.0.0_8. Which logs would you like to see?

    Cheers!


  • @elmnts Maybe inspect pfblockerng.log, system / resolver / dhcp logs. If nothing obvious is found, then try :

    Enable DNSBL, save settings, disable DNSBL, Save settings, Force Update, Force Reload ALL. It shouldn't compile any DNSBL data. The wait for cron update to see what happens.


  • @ronpfs Hi! Thanks for getting back. DHCP option „ Enable registration of DHCP client names in DNS“ is not set. I unchecked all settings in my DNSBL config. I disabled all DNSBL Groups.

    This is the log when force an update:

    
    UPDATE PROCESS START [ v3.0.0_8 ] [ 01/09/21 02:15:53 ]
    
    ===[  DNSBL Process  ]================================================
    
    Clearing all DNSBL Feeds
    Stopping Unbound Resolver.
    Unbound stopped in 2 sec.
    Additional mounts:
      No changes required.
    Starting Unbound Resolver... completed [ 01/09/21 02:15:54 ]
    DNSBL is disabled
    
    
    ===[  GeoIP Process  ]============================================
    
    [ pfB_Europe_v4 ]		 exists.
    
    ===[  IPv4 Process  ]=================================================
    
    [ Whitelist_custom_v4 ]		 exists.
    [ Abuse_Feodo_C2_v4 ]		 exists.
    [ Abuse_SSLBL_v4 ]		 exists.
    [ CINS_army_v4 ]		 exists.
    [ ET_Block_v4 ]			 exists.
    [ ET_Comp_v4 ]			 exists.
    [ ISC_1000_30_v4 ]		 exists.
    [ ISC_Block_v4 ]		 exists.
    [ Spamhaus_Drop_v4 ]		 exists.
    [ Spamhaus_eDrop_v4 ]		 exists.
    [ BlockListDE_Apache_v4 ]	 exists.
    [ BlockListDE_Asterisk_v4 ]	 exists.
    [ BlockListDE_Bots_v4 ]		 exists.
    [ BlockListDE_Brute_v4 ]	 exists.
    [ BlockListDE_Email_v4 ]	 exists.
    [ BlockListDE_FTP_v4 ]		 exists.
    [ BlockListDE_FTPD_v4 ]		 exists.
    [ BlockListDE_IMAP_v4 ]		 exists.
    [ BlockListDE_IRC_v4 ]		 exists.
    [ BlockListDE_Mail_v4 ]		 exists.
    [ BlockListDE_POP3_v4 ]		 exists.
    [ BlockListDE_Postfix_v4 ]	 exists.
    [ BlockListDE_SIP_v4 ]		 exists.
    [ BlockListDE_SSH_v4 ]		 exists.
    [ BlockListDE_Strong_v4 ]	 exists.
    [ BDS_Ban_v4 ]			 exists.
    [ BlockListDE_All_v4 ]		 exists.
    [ MS_1_v4 ]			 exists.
    
    ===[  Aliastables / Rules  ]==========================================
    
    No changes to Firewall rules, skipping Filter Reload
    No Changes to Aliases, Skipping pfctl Update
    
    ===[  Kill States  ]==================================================
    
    Firewall state(s) validation for [ 103 ] IPv4 address(es)...
    No matching states found
    
    ======================================================================
    
     UPDATE PROCESS ENDED [ 01/09/21 02:15:56 ]
    
    

  • @elmnts Now there shouldn't be anything about pfblockerNG in DNS Resolver / General Settings : Custom options

    Wait for next Cron Update to see if it restart unbound.


  • @ronpfs Yes, the entry „server:include: /var/unbound/pfb_dnsbl.*conf“ is not in the Unbound custom options anymore. I will wait till the CRON runs automatically and get back to you.

    Thanks for your help!

  • Moderator

    @elmnts Are you on v3.0.0_7?


  • @bbcan177 Hi! I am running pfblockerNG-dev version 3.0.0_8


  • @ronpfs Hi! The CRON job was executed automatically at 6 am this morning. Unfortunatly it restarted Unbound again. Do you have any other idea what might cause the problem?

    I dont know if it makes a difference but I used the DNSBL feature for quiet some time. I just wanted to deactivate it because I dont want to use the DNSBL feature from pfblockerng anymore. I also want to use Unbounds cache. I also tried the the "Rresolver cache" feature (which is enabled by default but I still checked it). Unbound restarted und I checked the cache entries before manually execute the CRON job and after executing it. Cache entries which have been in the Unbound cache before were cleared after. So automatically reloading the cache after pfblockerng restarts Unbound doesnt seem to work either.

    Jan 9 06:00:25 	unbound 	54051:0 	info: start of service (unbound 1.10.1).
    Jan 9 06:00:25 	unbound 	54051:0 	notice: init module 0: iterator
    Jan 9 06:00:24 	unbound 	6659:0 	info: 4.000000 8.000000 1
    Jan 9 06:00:24 	unbound 	6659:0 	info: 2.000000 4.000000 6
    Jan 9 06:00:24 	unbound 	6659:0 	info: 1.000000 2.000000 11
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.524288 1.000000 15
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.262144 0.524288 34
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.131072 0.262144 154
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.065536 0.131072 188
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.032768 0.065536 370
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.016384 0.032768 365
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.008192 0.016384 138
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.002048 0.004096 2
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.000512 0.001024 1
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.000000 0.000001 79
    Jan 9 06:00:24 	unbound 	6659:0 	info: lower(secs) upper(secs) recursions
    Jan 9 06:00:24 	unbound 	6659:0 	info: [25%]=0.0218154 median[50%]=0.0413585 [75%]=0.0892405
    Jan 9 06:00:24 	unbound 	6659:0 	info: histogram of recursion processing times
    Jan 9 06:00:24 	unbound 	6659:0 	info: average recursion processing time 0.093712 sec
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 3: requestlist max 8 avg 0.26685 exceeded 0 jostled 0
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 3: 2526 queries, 1162 answers from cache, 1364 recursions, 90 prefetch, 0 rejected by ip ratelimiting
    Jan 9 06:00:24 	unbound 	6659:0 	info: 2.000000 4.000000 3
    Jan 9 06:00:24 	unbound 	6659:0 	info: 1.000000 2.000000 3
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.524288 1.000000 11
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.262144 0.524288 5
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.131072 0.262144 47
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.065536 0.131072 51
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.032768 0.065536 66
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.016384 0.032768 94
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.008192 0.016384 39
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.000000 0.000001 19
    Jan 9 06:00:24 	unbound 	6659:0 	info: lower(secs) upper(secs) recursions
    Jan 9 06:00:24 	unbound 	6659:0 	info: [25%]=0.0210029 median[50%]=0.0412082 [75%]=0.111154
    Jan 9 06:00:24 	unbound 	6659:0 	info: histogram of recursion processing times
    Jan 9 06:00:24 	unbound 	6659:0 	info: average recursion processing time 0.114524 sec
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 2: requestlist max 0 avg 0 exceeded 0 jostled 0
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 2: 697 queries, 359 answers from cache, 338 recursions, 35 prefetch, 0 rejected by ip ratelimiting
    Jan 9 06:00:24 	unbound 	6659:0 	info: 2.000000 4.000000 1
    Jan 9 06:00:24 	unbound 	6659:0 	info: 1.000000 2.000000 5
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.524288 1.000000 13
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.262144 0.524288 24
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.131072 0.262144 141
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.065536 0.131072 156
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.032768 0.065536 259
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.016384 0.032768 320
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.008192 0.016384 108
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.004096 0.008192 1
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.000000 0.000001 57
    Jan 9 06:00:24 	unbound 	6659:0 	info: lower(secs) upper(secs) recursions
    Jan 9 06:00:24 	unbound 	6659:0 	info: [25%]=0.0217728 median[50%]=0.0399162 [75%]=0.0944181
    Jan 9 06:00:24 	unbound 	6659:0 	info: histogram of recursion processing times
    Jan 9 06:00:24 	unbound 	6659:0 	info: average recursion processing time 0.079556 sec
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 1: requestlist max 7 avg 0.208007 exceeded 0 jostled 0
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 1: 2101 queries, 1016 answers from cache, 1085 recursions, 64 prefetch, 0 rejected by ip ratelimiting
    Jan 9 06:00:24 	unbound 	6659:0 	info: 2.000000 4.000000 3
    Jan 9 06:00:24 	unbound 	6659:0 	info: 1.000000 2.000000 1
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.524288 1.000000 12
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.262144 0.524288 18
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.131072 0.262144 84
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.065536 0.131072 101
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.032768 0.065536 161
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.016384 0.032768 187
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.008192 0.016384 80
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.004096 0.008192 1
    Jan 9 06:00:24 	unbound 	6659:0 	info: 0.000000 0.000001 37
    Jan 9 06:00:24 	unbound 	6659:0 	info: lower(secs) upper(secs) recursions
    Jan 9 06:00:24 	unbound 	6659:0 	info: [25%]=0.0210495 median[50%]=0.0404003 [75%]=0.0965196
    Jan 9 06:00:24 	unbound 	6659:0 	info: histogram of recursion processing times
    Jan 9 06:00:24 	unbound 	6659:0 	info: average recursion processing time 0.087468 sec
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 0: requestlist max 3 avg 0.0557823 exceeded 0 jostled 0
    Jan 9 06:00:24 	unbound 	6659:0 	info: server stats for thread 0: 1289 queries, 604 answers from cache, 685 recursions, 50 prefetch, 0 rejected by ip ratelimiting
    Jan 9 06:00:24 	unbound 	6659:0 	info: service stopped (unbound 1.10.1). 
    

  • @elmnts Maybe post the pfblockng.log so we can see what it does during Cron Update.


  • @ronpfs I attached the pfblockerng.log. I change the execution time for the cron job to 7:15 pm tho.

    CRON  PROCESS  START [ v3.0.0_8 ] [ 01/09/21 19:15:00 ]
    [ Abuse_Feodo_C2_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 18:10:03 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:25:03 GMT	Update found
    [ Abuse_SSLBL_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 18:10:02 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:25:03 GMT	Update found
    [ CINS_army_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:18:44 GMT
      Local  timestamp: Sat, 09 Jan 2021 16:18:42 GMT	Update found
    [ ET_Block_v4 ]
      Remote timestamp: Fri, 08 Jan 2021 23:18:59 GMT
      Local  timestamp: Fri, 08 Jan 2021 05:30:02 GMT	Update found
    [ ET_Comp_v4 ] [ 01/09/21 19:15:01 ]
      Remote timestamp: Fri, 08 Jan 2021 23:18:24 GMT
      Local  timestamp: Fri, 08 Jan 2021 05:30:23 GMT	Update found
    [ ISC_1000_30_v4 ] [ 01/09/21 19:15:02 ]
      Remote timestamp: Sat, 09 Jan 2021 18:14:03 GMT
      Local  timestamp: Sat, 09 Jan 2021 15:13:22 GMT	Update found
    [ ISC_Block_v4 ] [ 01/09/21 19:15:03 ]
      Remote timestamp: Sat, 09 Jan 2021 18:14:03 GMT
      Local  timestamp: Sat, 09 Jan 2021 16:00:06 GMT	Update found
    [ Spamhaus_Drop_v4 ] [ 01/09/21 19:15:04 ]
      Remote timestamp: Sat, 09 Jan 2021 00:28:34 GMT
      Local  timestamp: Sat, 09 Jan 2021 00:28:34 GMT	Update not required
    [ Spamhaus_eDrop_v4 ]
      Remote timestamp: Wed, 30 Dec 2020 21:14:18 GMT
      Local  timestamp: Wed, 30 Dec 2020 21:14:18 GMT	Update not required
    [ BlockListDE_Apache_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:29 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:05 GMT	Update found
    [ BlockListDE_Asterisk_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:38 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:13 GMT	Update found
    [ BlockListDE_Bots_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:38 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:13 GMT	Update found
    [ BlockListDE_Brute_v4 ] [ 01/09/21 19:15:05 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:44 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:24 GMT	Update found
    [ BlockListDE_Email_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:24 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:01 GMT	Update found
    [ BlockListDE_FTP_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:37 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:12 GMT	Update found
    [ BlockListDE_FTPD_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:37 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:12 GMT	Update found
    [ BlockListDE_IMAP_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:36 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:11 GMT	Update found
    [ BlockListDE_IRC_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:40 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:19 GMT	Update found
    [ BlockListDE_Mail_v4 ] [ 01/09/21 19:15:06 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:24 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:01 GMT	Update found
    [ BlockListDE_POP3_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:36 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:11 GMT	Update found
    [ BlockListDE_Postfix_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:24 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:01 GMT	Update found
    [ BlockListDE_SIP_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:38 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:13 GMT	Update found
    [ BlockListDE_SSH_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:19 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:08:59 GMT	Update found
    [ BlockListDE_Strong_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:39 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:09:16 GMT	Update found
    [ BDS_Ban_v4 ]
      Remote timestamp: Sat, 09 Jan 2021 17:34:01 GMT
      Local  timestamp: Sat, 09 Jan 2021 16:34:00 GMT	Update found
    [ BlockListDE_All_v4 ] [ 01/09/21 19:15:07 ]
      Remote timestamp: Sat, 09 Jan 2021 17:50:05 GMT
      Local  timestamp: Sat, 09 Jan 2021 17:08:46 GMT	Update found
    [ MS_1_v4 ]
    				( md5 feed )		. 200 OK
    				( md5 unchanged )	Update not required
     UPDATE PROCESS START [ v3.0.0_8 ] [ 01/09/21 19:15:08 ]
    
    ===[  DNSBL Process  ]================================================
    
    Clearing all DNSBL Feeds
    Stopping Unbound Resolver.
    Unbound stopped in 2 sec.
    Additional mounts:
      No changes required.
    Starting Unbound Resolver... completed [ 01/09/21 19:15:09 ]
    DNSBL is disabled
    
    
    ===[  GeoIP Process  ]============================================
    
    [ pfB_Europe_v4 ]		 exists.
    
    ===[  IPv4 Process  ]=================================================
    
    [ Whitelist_custom_v4 ]		 exists.
    [ Abuse_Feodo_C2_v4 ]		 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      1412     1412       1412        [ Pass ] 
      -----------------------------------------------------------------
    
    [ Abuse_SSLBL_v4 ]		 Downloading update [ 01/09/21 19:15:10 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      129      100        100         [ Pass ] 
      -----------------------------------------------------------------
    
    [ CINS_army_v4 ]		 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      15000    14450      14450       [ Pass ] 
      -----------------------------------------------------------------
    
    [ ET_Block_v4 ]			 Downloading update [ 01/09/21 19:15:11 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      2377     1009       1009        [ Pass ] 
      -----------------------------------------------------------------
    
    [ ET_Comp_v4 ]			 Downloading update [ 01/09/21 19:15:12 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      4227     3971       3971        [ Pass ] 
      -----------------------------------------------------------------
    
    [ ISC_1000_30_v4 ]		 Downloading update [ 01/09/21 19:15:13 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      8003     787        787         [ Pass ] 
      -----------------------------------------------------------------
    
    [ ISC_Block_v4 ]		 Downloading update [ 01/09/21 19:15:14 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      21       14         14          [ Pass ] 
      -----------------------------------------------------------------
    
    [ Spamhaus_Drop_v4 ]		 exists. [ 01/09/21 19:15:15 ]
    [ Spamhaus_eDrop_v4 ]		 exists.
    [ BlockListDE_Apache_v4 ]	 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      9985     1991       1991        [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_Asterisk_v4 ]	 Downloading update [ 01/09/21 19:15:16 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      500      173        173         [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_Bots_v4 ]		 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      37       32         32          [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_Brute_v4 ]	 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      1919     1          1           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_Email_v4 ]	 Downloading update [ 01/09/21 19:15:17 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      12766    4498       4498        [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_FTP_v4 ]		 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      112      109        109         [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_FTPD_v4 ]		 Downloading update [ 01/09/21 19:15:18 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      112      0          0           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_IMAP_v4 ]		 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      2823     0          0           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_IRC_v4 ]		 Downloading update .. 200 OK. completed ..
      Empty file, Adding '127.1.7.7' to avoid download failure.
      ------------------------------
      Original Master     Final     
      ------------------------------
      0        1          1           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_Mail_v4 ]		 Downloading update [ 01/09/21 19:15:19 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      12766    0          0           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_POP3_v4 ]		 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      2823     0          0           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_Postfix_v4 ]	 Downloading update [ 01/09/21 19:15:20 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      12766    0          0           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_SIP_v4 ]		 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      500      2          2           [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_SSH_v4 ]		 Downloading update [ 01/09/21 19:15:21 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      32325    29489      29489       [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_Strong_v4 ]	 Downloading update .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      1293     103        103         [ Pass ] 
      -----------------------------------------------------------------
    
    [ BDS_Ban_v4 ]			 Downloading update [ 01/09/21 19:15:22 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      1437     926        926         [ Pass ] 
      -----------------------------------------------------------------
    
    [ BlockListDE_All_v4 ]		 Downloading update [ 01/09/21 19:15:23 ] .. 200 OK. completed ..
      ------------------------------
      Original Master     Final     
      ------------------------------
      47763    771        771         [ Pass ] 
      -----------------------------------------------------------------
    
    [ MS_1_v4 ]			 exists.
    ===[ Suppression Stats ]===================================
    
    List                 Pre        Suppress   Master    
    -----------------------------------------------------------
    Abuse_Feodo_C2_v4    1412       1412       62681     
    Abuse_SSLBL_v4       100        100        62681     
    CINS_army_v4         14450      14450      62681     
    ET_Block_v4          1009       1009       62681     
    ET_Comp_v4           3971       3971       62681     
    ISC_1000_30_v4       787        787        62681     
    ISC_Block_v4         14         14         62681     
    Spamhaus_Drop_v4     1          1          62681     
    Spamhaus_eDrop_v4    78         78         62681     
    BlockListDE_Apache_v4 1991       1991       62681     
    BlockListDE_Asterisk_v4 173        173        62681     
    BlockListDE_Bots_v4  32         32         62681     
    BlockListDE_Brute_v4 1          1          62681     
    BlockListDE_Email_v4 4498       4498       62681     
    BlockListDE_FTP_v4   109        109        62681     
    BlockListDE_FTPD_v4  1          1          62681     
    BlockListDE_IMAP_v4  1          1          62681     
    BlockListDE_IRC_v4   1          1          62681     
    BlockListDE_Mail_v4  1          1          62681     
    BlockListDE_POP3_v4  1          1          62681     
    BlockListDE_Postfix_v4 1          1          62681     
    BlockListDE_SIP_v4   2          2          62681     
    BlockListDE_SSH_v4   29489      29489      62681     
    BlockListDE_Strong_v4 103        103        62681     
    BDS_Ban_v4           926        926        62681     
    BlockListDE_All_v4   771        771        62681     
    
    
    ===[  Aliastables / Rules  ]==========================================
    
    No changes to Firewall rules, skipping Filter Reload
    
     Updating: pfB_PRI1_v4
    200 addresses added.220 addresses deleted.
     Updating: pfB_BlockListDE_v4
    401 addresses added.275 addresses deleted.
     Updating: pfB_PRI4_v4
    17 addresses added.2 addresses deleted.
     Updating: pfB_PRI3_v4
    12 addresses added.
    
    ===[  Kill States  ]==================================================
    
    Firewall state(s) validation for [ 94 ] IPv4 address(es)...
    No matching states found
    
    ======================================================================
    
    ===[ FINAL Processing ]=====================================
    
       [ Original IP count   ]  [ 194619 ]
    
       [ Final IP Count  ]  [ 62681 ]
    
    
    ===[ Permit List IP Counts ]=========================
    
       19594 total
       19593 /var/db/pfblockerng/permit/pfB_Europe_v4.txt
           1 /var/db/pfblockerng/permit/Whitelist_custom_v4.txt
    
    ===[ Deny List IP Counts ]===========================
    
       62687 total
       29489 /var/db/pfblockerng/deny/BlockListDE_SSH_v4.txt
       14450 /var/db/pfblockerng/deny/CINS_army_v4.txt
        4498 /var/db/pfblockerng/deny/BlockListDE_Email_v4.txt
        3971 /var/db/pfblockerng/deny/ET_Comp_v4.txt
        2764 /var/db/pfblockerng/deny/MS_1_v4.txt
        1991 /var/db/pfblockerng/deny/BlockListDE_Apache_v4.txt
        1412 /var/db/pfblockerng/deny/Abuse_Feodo_C2_v4.txt
        1009 /var/db/pfblockerng/deny/ET_Block_v4.txt
         926 /var/db/pfblockerng/deny/BDS_Ban_v4.txt
         787 /var/db/pfblockerng/deny/ISC_1000_30_v4.txt
         771 /var/db/pfblockerng/deny/BlockListDE_All_v4.txt
         173 /var/db/pfblockerng/deny/BlockListDE_Asterisk_v4.txt
         109 /var/db/pfblockerng/deny/BlockListDE_FTP_v4.txt
         103 /var/db/pfblockerng/deny/BlockListDE_Strong_v4.txt
         100 /var/db/pfblockerng/deny/Abuse_SSLBL_v4.txt
          78 /var/db/pfblockerng/deny/Spamhaus_eDrop_v4.txt
          32 /var/db/pfblockerng/deny/BlockListDE_Bots_v4.txt
          14 /var/db/pfblockerng/deny/ISC_Block_v4.txt
           2 /var/db/pfblockerng/deny/BlockListDE_SIP_v4.txt
           1 /var/db/pfblockerng/deny/Spamhaus_Drop_v4.txt
           1 /var/db/pfblockerng/deny/BlockListDE_Postfix_v4.txt
           1 /var/db/pfblockerng/deny/BlockListDE_POP3_v4.txt
           1 /var/db/pfblockerng/deny/BlockListDE_Mail_v4.txt
           1 /var/db/pfblockerng/deny/BlockListDE_IRC_v4.txt
           1 /var/db/pfblockerng/deny/BlockListDE_IMAP_v4.txt
           1 /var/db/pfblockerng/deny/BlockListDE_FTPD_v4.txt
           1 /var/db/pfblockerng/deny/BlockListDE_Brute_v4.txt
    
    ====================[ Empty Lists w/127.1.7.7 ]==================
    
    BlockListDE_FTPD_v4.txt
    BlockListDE_IMAP_v4.txt
    BlockListDE_IRC_v4.txt
    BlockListDE_Mail_v4.txt
    BlockListDE_POP3_v4.txt
    BlockListDE_Postfix_v4.txt
    Spamhaus_Drop_v4.txt
    
    ====================[ IPv4/6 Last Updated List Summary ]==============
    
    Apr 30	2020	MS_1_v4
    Dec 30	22:14	Spamhaus_eDrop_v4
    Jan 8	17:11	pfB_Europe_v4
    Jan 8	17:11	Whitelist_custom_v4
    Jan 9	00:18	ET_Comp_v4
    Jan 9	00:18	ET_Block_v4
    Jan 9	01:28	Spamhaus_Drop_v4
    Jan 9	15:28	ISC_1000_30_v4
    Jan 9	16:28	ISC_Block_v4
    Jan 9	18:18	CINS_army_v4
    Jan 9	18:34	BDS_Ban_v4
    Jan 9	18:50	BlockListDE_All_v4
    Jan 9	18:50	BlockListDE_SSH_v4
    Jan 9	18:50	BlockListDE_Postfix_v4
    Jan 9	18:50	BlockListDE_Mail_v4
    Jan 9	18:50	BlockListDE_Email_v4
    Jan 9	18:50	BlockListDE_Apache_v4
    Jan 9	18:50	BlockListDE_POP3_v4
    Jan 9	18:50	BlockListDE_IMAP_v4
    Jan 9	18:50	BlockListDE_FTP_v4
    Jan 9	18:50	BlockListDE_FTPD_v4
    Jan 9	18:50	BlockListDE_SIP_v4
    Jan 9	18:50	BlockListDE_Bots_v4
    Jan 9	18:50	BlockListDE_Asterisk_v4
    Jan 9	18:50	BlockListDE_Strong_v4
    Jan 9	18:50	BlockListDE_IRC_v4
    Jan 9	18:50	BlockListDE_Brute_v4
    Jan 9	19:10	Abuse_SSLBL_v4
    Jan 9	19:10	Abuse_Feodo_C2_v4
    
    ====================[ DNSBL Last Updated List Summary ]==============
    
    Oct 22	2019	MDS_Immortal
    May 20	2020	Abuse_DOMBL
    May 20	2020	Abuse_URLBL
    May 20	2020	Spam404
    May 20	2020	MoneroMiner
    May 20	2020	NoCoin
    Jul 11	2020	D_Me_Malw
    Jul 11	2020	D_Me_Malv
    Aug 14	00:35	MDS
    Oct 10	05:00	SFS_Toxic_BD
    Nov 6	13:09	CoinBlocker_All
    Nov 6	13:09	CoinBlocker_Opt
    Nov 12	23:17	MDL
    Dec 14	06:01	MS_2
    Dec 15	09:07	MVPS
    Dec 21	05:06	SWC
    Dec 30	06:01	CCT_BD
    Jan 8	03:29	ISC_SDH
    Jan 8	06:00	UT1_phishing
    ===============================================================
    
    Database Sanity check [  PASSED  ]
    ------------------------
    Masterfile/Deny folder uniq check
    Deny folder/Masterfile uniq check
    
    Sync check (Pass=No IPs reported)
    ----------
    
    Alias table IP Counts
    -----------------------------
       82281 total
       36404 /var/db/aliastables/pfB_BlockListDE_v4.txt
       21822 /var/db/aliastables/pfB_PRI1_v4.txt
       19593 /var/db/aliastables/pfB_Europe_v4.txt
        2764 /var/db/aliastables/pfB_PRI5_v4.txt
         926 /var/db/aliastables/pfB_PRI4_v4.txt
         771 /var/db/aliastables/pfB_PRI3_v4.txt
           1 /var/db/aliastables/pfB_Whitelist_v4.txt
    
    pfSense Table Stats
    -------------------
    table-entries hard limit  2000000
    Table Usage Count         83667
    
     UPDATE PROCESS ENDED [ 01/09/21 19:15:28 ]
    
    

  • @elmnts said in pfblockerng-dev restarts unbound but DNSBL is disabled:

    CRON PROCESS START [ v3.0.0_8 ] [ 01/09/21 19:15:00 ]

    does not match

    @elmnts said in pfblockerng-dev restarts unbound but DNSBL is disabled:

    Jan 9 06:00:25 unbound 54051:0 info: start of service (unbound 1.10.1).

    The restart of unbound at 06h00 was not triggered by the cron task at 19h15.

    I presume you are using the new python mode, which means the the generic DNSBL file /var/unbound/pfb_dnsbl.conf" doesn't exist any more (present in the Resolver Custom option box).
    Yes, unbound is restart - or reloading.
    Keep in mind that the cache is dumped just before the restart, and loaded back in when started.
    This leans : minimal overhead, as your restart time - and mine, takes just one second - without cache loses.

    This is my reasoning :
    Unbound loads at startup also the python module that does all the DNSBL (and other) work. This python modules uses the probably updated /var/unbound/pfb_py_*.txt files.
    See it like this : if, during an cron update, unbound didn't needed to be restarted, it wouldn't get restarted ;)


  • @gertjan H! Thanks for your reply. I change the execution time of the cron job from 6:00 am to 7:15 pm (see my last post ... I mentioned it in there) so I get a "fresh" log output for my forum post. I am not using the Python Script.

    Unbound ist restarting or reloading but it definitly does not dump the cache and reload it. I checked different cache entries before the cron job was executed and after it was executed.

    unbound-control -c /var/unbound/unbound.conf dump_cache | grep heise
    

    heise.de is an IT website here in Germany and it was in the cache before the cron job was executed but it was not in the cache after it finished. The entry did not expire. I also checked with other entries and they were all gone after the cron job finished.


  • @elmnts :

    I tested with the 'unbound' mode.
    Live sync was checked.
    DNSBL is activated :

    Force Update log :

    .....
    TLD finalize... completed [ 01/11/21 10:04:16 ]
    
    Saving DNSBL statistics... completed
     XXXX !pfb['dnsbl_py_blacklist'] is true
     XXXX pfb['dnsbl_sync'] is true
     XXXX !pfbpython is true
     XXXX file_exists /var/unbound/pfb_dnsbl.conf: Yes
    Resolver Live Sync analysis... completed [ 01/11/21 10:04:17 ]
    Resolver Live Sync finalizing:
    	Remove local-zone(s):		no changes
    	Remove local-data(s):		no changes
    	Add local-zone(s):		no changes
    	Add local-data(s):		no changes
    DNSBL update [ 44797 | PASSED  ]... completed
    ------------------------------------------------------------------------
    

    The XXXX lines are added by me, to see if all the conditions are met so a live sync is tried.
    It did, so no restart of unbound was needed.

    You do not use the DNSBL mode, like :

    53733ad8-033e-4b0b-8847-cd4dfad2ab89-image.png

    In that case, all I see when I 'force' a CRON update :

    CRON  PROCESS  START [ v3.0.0_8 ] [ 01/11/21 10:14:29 ]
    
     No Updates required.
    CRON  PROCESS  ENDED
    UPDATE PROCESS ENDED
    

    and unbound isn't restarted at all as pfBlockerNG doesn't work (care about) with host names so there s nothing to do for the resolver unbound - all blocking is IP based..

    What pfBlockerNG version are you using ?


  • @gertjan Hi! I am using pfblockerng-dev 3.0.0_8

    Here is a Screenshot of my setting:

    Bildschirmfoto 2021-01-11 um 10.34.38.jpg

  • Moderator

    @elmnts
    Thanks for the report, will address in the upcoming release.


  • Thanks everybody who tried to help me with this issue. Thanks to BBcan177 fpr providing a Patch so quickly! You guys are amazing!

    Cheers!

    Henry


  • Just a comment that I seem to have had much the same issue as the OP on this thread. I've been using pfblockerng-dev since last autumn upgrading as each new version comes out (I've been on the 2.4.5-p1 version of pfSense). Everything seemed to be working OK until relatively recently when I started having problems with my Roon (audio server) where internet radio streams would stop working at regular intervals. This turned out to correspond to the times when the cron job was running and unbound was being stopped and started. Examination of the Roon logs showed that it was getting a timeout. I tried using the python integration and while this reduced the time that unbound was "off" it didn't solve the problem. I also tried disabling the DNSBL part of pfblockerng but still found that unbound was being restarted on regular intervals.

    For the moment I have removed pfbockerng-dev completely. Interestingly, I needed to do a save on the DNS configuration settings to reset everything as there was something not quite right as "unbound-control" was no longer working. All is fine now with no unbound restarts, and it may be that some other odd networking artefacts that have appeared recently may be corrected.

    When I have time to experiment again, I will do a clean re-install of pfBlockerNG-dev, as I would like the added protection provided by it (although I only use a very restricted set of block lists, and at the moment with lockdown and only my partner and myself at home there is less risk of younger family members or visitors going places they shouldn't).


  • @stepheng Hey! BBcan177 said he would include the patch in the next pfblockerng-dev Update. Maybe wait till version 3.0.0_9 is out. Or ask him if he can provide the patch to you if it is urgent!

    Cheers!


  • @elmnts Yes, I'll certainly re-install when the next version appears, or soon after, probably on a day when I'm at home by myself, and I've got a few hours to do some testing without danger of upsetting my partner's television viewing or internet use!

    As I said, it isn't really urgent because I'm not running an environment where there is a particularly high risk of a user going somewhere they shouldn't or being hijacked, but it is nice to know the protection is there, particularly when life gets back to normal and we have visits from the younger family members who are all over social media!