While pfBlocker updates interface rules pfSense ignores floating rules

[Ellingson]

Very interesting thing is happening.

I noticed that when pfBlocker is running its hourly cron to get updated feeds, pfSense seems to ignore the floating rules while the interface rules are being updated. To simplify things...

I use floating rules (pass, quick) to allow my private DNS resolver (AdGuard on a Raspberry Pi) to access Quad 9 DNS servers via TCP 443, and 853.

I use pfBlocker to manage interface rules to block everyone from accessing any DNS service other than my private resolver.

This works fantastic, except for about 90 seconds every hour when the cron for pfBlocker runs. After the updated IP lists are downloaded, it applies the changes to the interface rules. While those are being updated, it seems the floating rules are ignored and my private DNS resolver is blocked. Again... for just that 90 seconds or so. Then it works as normal.

Crazy, eh?

[SteveITS]

@Ellingson How long does a filter reload take? Status > Filter Reload, and the Reload Filter button (arrows).

[Ellingson]

@SteveITS It is nearly instant. Think it has to do with writing to the aliases?

[Ellingson]

I changed the feeds to be once daily, but just like clockwork, at 20 or so seconds after the hour, every hour - for 90 seconds the floating rules are ignored. Continuing to see what could cause this. Open to ideas.