Microsoft Updates Not Progressing
-
Good morning, I am having an issue with a new setup I am working on. I have setup a new Netgate 6100 , running the latest software and with Snort and PfblockerNG. I am just going thru some final stages to ensure the Vlans are working, the interfaces are set correctly and just overall functionality. One thing I discovered are the PC's that I have connected as my simulated users, they are struggling trying to get their windows updates.
Basically when I run the Windows updater , it picks up if there are indeed updates but it doesn't move off 0%, I have tried 3 PC's now and all are having the same issue. I have run speed tests just to see how each PC is receiving WAN speeds and they are right on track, great numbers. This is my very first experience with pfsense so still trying to figure out my way around and how to troubleshoot these types of issues. My rules are basically a standard Allow All rule as my base, then I have various blocking rules to other VLAN network and have setup DNS over SSL that only allows the network devices to get DNS through Pfsense. Any idea as to where I should start, I did have my DNS resolver set to cloudflare servers but changes those to google as a test but no difference. Any guidance would be great, thank you.
-
@stormgate Tried disabling pfBlockerNG ?
-
@nogbadthebad Oh sorry, yes I had disabled pfblockerng and turned off snort, same issue after a reboot. I should have included that info. Thank you.
-
How did you have Snort / pfBlocker configured?
I would guess there is still something applied there. Most likely would be DNS-BL with something preventing the clients resolve the actual download servers.
Also disabling Snort does not clear the blocked hosts lists so if you had it enabled in blocking mode that would still apply. Go to Diag > Tables and check the snort2c table.
Steve
-
@stephenw10 Ahh really, let me VPN in and have a look, thank you.
-
If that's a possibility then I strongly suggest leaving Snort in non-blocking mode for at least a few weeks whilst you tune it to ignore false positives from your network. Only move to blocking mode when you're confident it's not alerting on traffic you need.
With it enabled you can view and clear the blocks from the Snort package config.Steve
-
@stephenw10 So the snort table had 4 entries, 3 resolved back to Google and the 4th to Stackpath-CDN in Texas so nothing in regards to Microsoft itself.
-
-
Mmm, well I'd still remove those and retest. The fact that it showed any entries makes it my number 1 suspect!
-
@stephenw10 I just went to and they are now gone, I guess they purge on their own after a period of time I take it.
-
Yes, they do. You can set that timeout though and it can be disabled entirely.
https://docs.netgate.com/pfsense/en/latest/packages/snort/setup.html#managing-blocked-hosts
-
@stephenw10 Onething I have noticed with this 6100 is it's dead slow when reloading pfblockerNG lists. I made some changes and reloaded "All" and so far 38 minutes to run that CRON job. I expected a bit better performance overall.
-
Hmm, yeah, something not right there. That should take a few minutes at most. Something is probably blocking access to the lists and has to timeout. I would expect to see a bunch of errors in the update log.
-
Just don't.
PHP is parsing that file. PHP isn't the tool you want to parse such a file.I've activated that DNSBL_UT1 on my 4100-MAX : even the restart of unbound took 30 seconds to start.
When you see things like this in the pfblokcerng 'update' log, you know you should back of.
TLD analysis........xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx completed [ 09/12/22 17:13:06 ]
** TLD Domain count exceeded. [ 800000 ] All subsequent Domains listed as-is **
Anyway .... a list with 4+ million DNSBL ...... and only 4 hits ?
[ Force Reload Task - All ] UPDATE PROCESS START [ v3.1.0_4 ] [ 09/12/22 17:07:16 ] ..... UPDATE PROCESS ENDED [ 09/12/22 17:16:27 ]Yep, 10 minutes, as it needed 6 minutes to download this U1 file.
And now I have to deal with :
so using this U1 feed is a no-go for 4 Gbytes.
-
@gertjan I'll go have a look thank you.
-
@gertjan Looks like the "Adult" category is the large database.
-
-
-
@gertjan That helped. it now took 2 min 49 seconds to "Reload All" which took almost 40minutes with the adult list added. To help with adult site, I simply changed my cloudflare setting to 1.1.1.3 and 1.0.0.3. Thanks
-
That with python mode enabled?
