pfBlocker not logging after 2.5.2 pfSense upgrade

Gertjan

@maddy_in65 said in pfBlocker not logging after 2.5.2 pfSense upgrade:

28242 unbound 2 20 0 383M 367M kqread 0 0:36 0.00% unbound

I have

55688 unbound       2  20    0   105M    82M kqread   1   2:57   0.00% unbound

The difference is probably tour DNSBL usage (pfBlockerNG).

Still, these values are ok.

Btw : i'm not trying to block "everybody", as many and/or huge DNSBL/IP feeds do impact the system.
I'm just using the minimal :

marcosm

Using the latest pfBlockerNG-devel, IP stats won't work unless using auto rules. If using only the "Alias" actions, i.e. custom rules, the package is not able to keep track of the rule matches. I imagine this is the intended behavior.

Note: I've only tested on 21.05.

RonpfS

@marcos-ng From the under Action it says :

Note:

When manually creating 'Alias' type firewall rules, Prefix the Firewall rule Description with pfb_ .
This will ensure that that Dashboard widget reports those statistics correctly. 

Do not prefix with (pfB_) as those Rules will be auto-removed by package when 'Auto' rules are defined.

marcosm

@ronpfs
I missed that, thanks. I suppose then this should be confirmed by whomever reports that it's not working.

n3xus_x3

Hello,
today i updated the latest version of pfsense (2.5.2) , and i have the same problem . In the DNSBL configuration , i changed to localhost , i uninstalled pfblockerNG-devel,reinstalled , I have updated the lists , but i still have the same problem .
Someone solved it?

Gertjan

@n3xus_x3 said in pfBlocker not logging after 2.5.2 pfSense upgrade:

Someone solved it?

The initial issue was : pfBlockerNG stopped blocking.
Thus is stops logging.
I tend to say that's quiet normal.

Here are the 'pfBlockerNG' files :

ls -al /var/unbound/var/log/pfblockerng/

You means these files are not growing in size for you ?

Your stats say : it blocks things, as numbers are shown in the "Packet" column.

@n3xus_x3 said in pfBlocker not logging after 2.5.2 pfSense upgrade:

, i changed to localhost

Changed what ? Where ?

'localhost' is the default, and works :

Or I do not understand what you mean by "i changed to localhost".

n3xus_x3

Thanks for replay
in pfblockerng/alerts/Reports , i noticed that after pfsense update, the contents are not blocked like before , in the Deny section it seems that everything works

The problem is on DNSBL Block , it seems to me that the lists work randomly , I'm sure they should be a lot more

these are my DNS settings

I don't use Python mode in DNSBL

Gertjan

@n3xus_x3

I advise you look up why this so called Python mode was introduced.
There are some reddit posts where the author explains it.

To make a long story short :
To make DNSBL work better, info is needed that unbound won't log in detail.
Or worse, won't make available any more.
But, recently, the latest unbound versions, could interface with 'plugins' written in Python.

So, thre solution was : this python mode.
Unbound has to be used as a resolver of course - not as a forwarder as you do.

SillieWous

@gertjan

The initial issue was : pfBlockerNG stopped blocking.

Not sure what you're referring to here. The topic of this thread is 'stopped logging' not stopped blocking.

So, thre solution was : this python mode.

As long as that isn't fully compatible with the rest of pfSense e.g. Python DNSBL mode is not compatable with the DNS Resolver DHCP Registration option (Unbound will Crash)! that advise doesn't hold up. I'd gladly switch to python mode, however I can't.

vjizzle

@silliewous Hi! I solved this problem by disabling dnsbl mode in pfblocker and moving that functionality over to a rpi4 with adguard home. Pfblocker with dnsbl was giving me all kinds of crazy behavior and in the end I just need my internet to work while wfh.

n3xus_x3

I changed to python mode in DNSBL settings , it works a little better, I mean more content is blocked ,but i think to go back to the previous version of pfsense,I've never had any problems and all the lists I have are working fine

vjizzle

@n3xus_x3 Be aware that older versions of pfsense cannot run the latest version of pfblockerng which have a lot of fixes compared to older versions. For the time being pfblockerng looks death and is not actively being worked on, from what I can see at least.

Gertjan

@MG85

Here is my regex.
It's more test-of-proof sample for me. I remember finding it somewhere on Reddit.

^(.+[_.-])?adse?rv(er?|ice)?s?[0-9]*[_.-] #Regex RGX1
^(.+[_.-])?telemetry[_.-] #Regex RGX2
^ad([sxv]?[0-9]*|system)[_.-]([^.[:space:]]+\.){1,}|[_.-]ad([sxv]?[0-9]*|system)[_.-] #test RGX3
^adim(age|g)s?[0-9]*[_.-] #Regex RGX4
^adtrack(er|ing)?[0-9]*[_.-] #Regex RGX5
^advert(s|is(ing|ements?))?[0-9]*[_.-] #Regex RGX6
^aff(iliat(es?|ion))?[_.-] #Regex RGX7
^analytics?[_.-] #Regex RGX8
^banners?[_.-] #Regex RGX9
^beacons?[0-9]*[_.-] #Regex RGX10
^count(ers?)?[0-9]*[_.-] #Regex RGX11
^mads\. #Regex RGX12
^pixels?[-.] #Regex RGX13
^stat(s|istics)?[0-9]*[_.-] #Regex RGX14

Keep in mind : the ending
"Space # text string" needs to be unique.