wpad Question

yorke

Never use to get wpad prompt but now For the past weeks
I have been getting popups from security software
install on the local computers, computers requesting to connect to wpad
listed under pfsense System General Setup System Domain
with the PfblockerNG ip address, when I look into the Firewall pfBlockerNG Alerts Unified log
wpad connections is listed as the pfsense domain address
I have not install or setup wpad on pfsense anyone know why
pfsense might start sending out wpad address thanks.

stephenw10

Seems more like something on your local machines is trying to pull it and it doesn't exist.

What exactly does the error show?

Steve

yorke

@stephenw10
I never use to see the wpad prompt but it suddenly started the only thing that change was a pfblockerNG update

Below is the log entry

Feb 15 00:41:07 127.0.0.1 Internal.private... resolver AAAA | NSEC Unk ff00 NXDOMAIN unk
Feb 15 00:41:07 127.0.0.1 Internal.private... resolver AAAA | NSEC Unk ff00 NXDOMAIN unk
Feb 15 00:41:07 127.0.0.1 Internal.private... resolver A | Unknown 16449... ff00 NXDOMAIN unk

Feb 15 00:41:07 127.0.0.1 Internal.private... resolver AAAA | SOA 3301 ff00.Internal.private SOA unk
Feb 15 00:41:07 127.0.0.1 Internal.private... resolver AAAA | SOA 3301 ff00.Internal.private SOA unk
Feb 15 00:41:07 127.0.0.1 Internal.private... resolver A | Unknown 16449... ff00.Internal.private NXDOMAIN unk

stephenw10

Hmm, where are you seeing that log?

ff00.Internal.private is the pfSense host name?

Are you handing Internal.private to clients via DHCP to use as a domain?

That's clients requesting the wpad file for their domain. Unless you have set it up specifically it won't be on pfSense. It looks like pfBlocker DNS-BL blocking those lookups maybe?

Steve