Unknown User defined feeds
-
Hello all, I noticed a legit website being blocked so I started to dig into my pfblocker setup- turned out to be the pfB_PRI1_v4 feed (pfblocker IP not dnsbl).
Buuuuut, while in there I noticed in the logs some DNSBL activity from a feed “Cameleon”. I saw it blocking an API I actually didn’t want blocked/dropped/blackholed. So I wend to feeds to disable it and I can’t. Its at the bottom of feeds found with a number of other feeds in an “Unknown user defined Feeds” panel- there are no controls to disable or delete them. Maybe a reelect from an older pfblocker install?
How can I go about purging these lists out? I imagine somewhere in an SSH session there is a path I can nuke?
I think I might have found the path, some of the files here are in this unknown user defined feeds, but not all of them. I don’t want to rm -rf without knowing more.
-
@token Those URLs were removed from the Feeds tab because they are offline, discontinued, etc.
Click on the Alias/Group name and it will open the appropriate Alias/Group tab. Delete the URL, Save Settings, when done, run a Force Update, that should remove the feed from the db/pfblockerng folder. Inspect the logs, to find more problems.
-
@ronpfs said in Unknown User defined feeds:
@token Those URLs were removed from the Feeds tab because they are offline, discontinued, etc.
Click on the Alias/Group name and it will open the appropriate Alias/Group tab. Delete the URL, Save Settings, when done, run a Force Update, that should remove the feed from the db/pfblockerng folder. Inspect the logs, to find more problems.
Thank you!
-
Hi following you instructions I can delete the links... but I wan't to delete the entire group
Abuse_PS, how can i do that?
-
@ruicaramalho You can not delete the last URL in a Group.
You could disable the Group or you can delete de Group from the IPv4 tab. -
Hi @RonpfS thanks for your answer.
I do not now how to delete the entire IPV4 Group
Abuse_PS, that is my objective. -
@ruicaramalho said in Unknown User defined feeds:
I do not now how to delete the entire IPV4 Group
On the Firewall/pfBlockerNG/IP/IPv4 page click the trash can icon on the far right, for that line.
-
Hi fellows,
sorry to bring up this old post but its topic is exactly what I was looking for.
I have set up some IP blocklists [Firewall > pfBlockerNG > IP > IPv4] and some DNSBL Groups [Firewall > pfBlockerNG > DNSBL > DNSBL Groups]
After reloading both the IP and DNSBL [Firewall > pfBlockerNG > Update] I always get some Feeds in the Unknown List.
Most of that links are updated and yet mantained, and I can even get some drops caused by them (so pfBlocker actively uses them).
What is the meaning of getting them in the "Unknown User defined feed" list?
-
@MaxFactor-0 said in Unknown User defined feeds:
get some Feeds in the Unknown List.
If memory serves that can happen if the feed is no longer in pfB’s feed page. IIRC they are sorted to the bottom there as well…?
-
@SteveITS Somewhere above @token reports that "Those URLs were removed from the Feeds tab because they are offline, discontinued, etc."
In my case I'm sure they are not offline/discontinued and also sure that they are actually actively used by the pfBL engine (Reports show that clearly). Hence the question, why they are said to be Unknown? I thought to remove them, until I found they are actually blocking the ips or urls they list.
-
@MaxFactor-0 I suspect something isn't matching. Did the name or the URL change? Maybe the old URL is being redirected?
As long as the file exists on disk pfB should use it as is. It doesn't mean it's being updated. And being Unknown doesn't mean the feed isn't downloading it just means it's not recognized in the predefined list.