Traffic from an Alias host FQDN starts being blocked after some time

[alirz]

I have an alias /32 FQDN hostname defined in pfsense e.g "ABC.mydomain.net", the host does have a static IP. When i add that alias, traffic from that host is allowed and i can reach the resources inside the LAN from that host.
However after a day or two the traffic starts being blocked by pfsense. firewall rule show "blockced by DEFAULT block rule" Note the host source IP is the same.
At this point if i reboot pfsense it starts working again for sometime but the problem eventually comes bac. I only have a total of 5 aliases defined in pfsense so its not even an extensive list, all are /32

[SteveITS]

@alirz Can Diagnostics/DNS Lookup resolve it? Perhaps, after it stops working?

[alirz]

@SteveITS i have not tried that yet however the last time it stopped working i did do a nslookup for that host from the pfsense CLI and it returned the correct IP but it still wasnt working.
As i write this post, the issue had been occurring for the past hour. Few minutes ago i just went in the Alias tab, edited the Aliases, but then came out without saving and now realize traffic is being allowed again.
confused lol

[SteveITS]

@alirz Alias hostnames are resolved every 5 minutes by default so it’s still likely some sort of DNS error. Maybe on the server end?
https://docs.netgate.com/pfsense/en/latest/firewall/aliases.html#using-hostnames-in-aliases
Brainstorming, write a batch file to do that DNS lookup every few minutes?

[JonathanLee]

@SteveITS I remember we use to be able to change the resolve time in the past. Is that not the case anymore?

[SteveITS]

@JonathanLee Per that doc page
"The default interval is 300 seconds (5 minutes), and can be changed by adjusting the value of Aliases Hostnames Resolve Interval on System > Advanced, Firewall & NAT tab. "
:)

[JonathanLee]

@SteveITS

Thanks I thought it use to be under system tuneables.

[alirz]

@SteveITS but even if the dns lookup failed for some reason,does pfsense not remember the previously resolved iP address for that Alias? It’s a static iP so isn’t really changing.

[SteveITS]

@alirz Not sure, but the alias should be in Diagnostics/Tables.