Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Filterdns has stopped resolving hostnames in firewall aliases

    Scheduled Pinned Locked Moved DHCP and DNS
    31 Posts 7 Posters 2.7k Views 7 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • O Offline
      ohbobva @SteveITS
      last edited by

      @SteveITS This has been an issue for me for YEARS. But it only crops up every so often (like today). It's long enough apart that I forget about the filterdns issue and waste several hours looking at the wrong things.

      Maybe I just need to set up a cron job to kill and restart filterdns every hour? Would that work? Break something else?

      S 1 Reply Last reply Reply Quote 0
      • S SteveITS referenced this topic on
      • S SteveITS referenced this topic
      • S Offline
        SteveITS Galactic Empire @ohbobva
        last edited by

        I ran across https://redmine.pfsense.org/issues/14734 which sounds like a possible cause...the IP is incorrectly removed if an FQDN resolving to it changes IPs.

        Also per https://forum.netgate.com/topic/199152/unexpected-alias-behaviour-two-ranges/ aliases that contain IPs and an FQDN may fail to populate all the IPs.

        Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
        When upgrading, allow 10-15 minutes to reboot, or more depending on packages, CPU, and/or disk speed.
        Upvote 👍 helpful posts!

        S 1 Reply Last reply Reply Quote 0
        • S Offline
          SteveITS Galactic Empire @SteveITS
          last edited by

          14734 was marked as a duplicate of https://redmine.pfsense.org/issues/13792.

          I am trying to think of a way around that...have a separate alias+rule for FQDNs that might ever overlap, say for each laptop...?

          Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to reboot, or more depending on packages, CPU, and/or disk speed.
          Upvote 👍 helpful posts!

          P 1 Reply Last reply Reply Quote 0
          • P Offline
            Patch @SteveITS
            last edited by Patch

            Agree
            That bug really does make alias much less useful. Two example I currently use aliases for which will fail with this bug

            White list for remote access to work server from periheral sites. The laptops will roam between sites

            • Peripheral site DDNS FQDN
            • Peripheral site relatively static IPv4 addresses
            • Laptop 1 DDNS FQDN
            • Laptop 1 DDNS FQDN

            White list from a VoIP supplier with redundant servers in multiple cities. During fault conditions the supplier redirects traffic to better functioning servers in another city

            • city1.Voipsuppler.com
            • city2.Voipsuppler.com
            • city3.Voipsuppler.com
            • city4.Voipsuppler.com
            • city5.Voipsuppler.com
            • city6.Voipsuppler.com
            • city7.Voipsuppler.com
            • city8.Voipsuppler.com

            Imo
            The variable FQDN component of an alias should be completely recalculated from scratch then combined with the constant (explicitly specified) IPs each time. After which only changes from the current IP addressees written to filterdns to update the firewall filtering.

            1 Reply Last reply Reply Quote 0
            • N Offline
              NWOSwamp
              last edited by

              Having this issue and follows symptoms already mentioned.

              Use DNS in aliases for access in FW rules. Access to a remote site drops. The Source IP is hitting Default Deny rule at the remote end. Remote end Tables doesn't have the IP for the DNS name, not sure if a DNS issue or filterdns stalls.

              None of the reload suggestions found worked /etc/rc.update_urltables, /etc/rc.update_urltables now forceupdate and /etc/rc.update_alias_url_data. The IP never returned in Tables following those commands. Maybe because filterdns appeared stalled - process still running and was not exiting.

              Also noticed:

              • DNS resolution was working after the issue started and no issues were noticed before
              • This occurred twice seemingly sporadically, both were after 1am. pfBlocker update does not run at that time.
              • First time noticed occurred after an ISP modem outage/reboot. Didn't figure out the Tables issue then. Rebooting the ISP modem again resolved the issue. Apparently, manually deleting an IP from the table, followed by downing the WAN interface caused pfSense to repopulate the IP in the table.
              • Second time there was no modem outage. Restarting unbound service did not resolve the issue. Saw filterdns in the process table still running. Did resolve with a suggestion above

              killall filterdns then Status -> Filter Reload

              pfSense is 2.8.1 - packages: frr, mtr, nut, pfBlockerNG, Service_Watchdog (watching OpenVPN), and System_Patches

              S 1 Reply Last reply Reply Quote 0
              • S Offline
                SteveITS Galactic Empire @NWOSwamp
                last edited by

                @NWOSwamp Due to the above mentioned bugs, AFAIK the workarounds are:

                • any FQDNs that might ever overlap (same IP) need to be in their own alias (therefore, rule)
                • avoid mixing IP ranges and FQDNs in the same alias

                Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to reboot, or more depending on packages, CPU, and/or disk speed.
                Upvote 👍 helpful posts!

                N 1 Reply Last reply Reply Quote 1
                • N Offline
                  NWOSwamp @SteveITS
                  last edited by

                  @SteveITS I don't have either of these. I went and did an nslookup on all the FQDNs (including LAN IPs). Sorting and sorting for unique resulted in the same number of IPs, meaning no overlaps/none with the same IP. None of the FQDNs should have changed, but it also doesn't mean the wrong answer was returned by DNS when this happened. I don't have aliases with mixed IPs and FQDN.

                  I will keep these in mind specifically looking for them next time.

                  I do have:

                  • aliases referenced in other aliases
                  • the same FQDN in an alias and as the Remote Gateway for IPsec - these would end up in different rules, though.

                  Alias in Alias example:
                  Alias Name: location1_IP
                  FQDN: location1.foobar.com

                  Alias Name: allow_ping
                  FQDN: "location1_IP"
                  FQDN: anotherserver.foobar.com

                  Alias Name: OpenVPN_backup
                  FQDN: "location1_IP"
                  FQDN: mobiledevice.foobar.com

                  allow_ping and OpenVPN_backup would then be used as the source in separate WAN rules. IPs of location1.foobar.com, anotherserver.foobar.com and mobiledevice.foobar.com would never be the same under normal circumstances.

                  P 1 Reply Last reply Reply Quote 0
                  • P Offline
                    Patch @NWOSwamp
                    last edited by Patch

                    For me, pfsense removing transiently overlapping IP addresses make alias based IP filtering unreliable, so not a usable solution. The bug has been there for at least 3 years, and doesn't appears unlikely to be resolved in the near term.

                    I wonder if as a work around, it is possible to:

                    • use pfBlockerNG to generate/maintain these aliases.
                    • Store the "feed" for these work around alias locally
                    • Set their alias update frequency to hourly

                    Hopefully that would result in pfBlockerNG generating the aliases from scratch each time, including the associated duplicate removal. pfsense filterdns would then only see an IP being removed when it is duplicated zero times (actually removed from the alias), and so avoid the pfsense redmine bug 13792.

                    tinfoilmattT 1 Reply Last reply Reply Quote 0
                    • tinfoilmattT Offline
                      tinfoilmatt @Patch
                      last edited by

                      @Patch said in Filterdns has stopped resolving hostnames in firewall aliases:

                      I wonder if as a work around, it is possible to:

                      • use pfBlockerNG to generate/maintain these aliases.

                      Indeed it's possible—and pfBlockerNG additionally contains deduplication functionality for IP lists.

                      S 1 Reply Last reply Reply Quote 0
                      • S Offline
                        SteveITS Galactic Empire @tinfoilmatt
                        last edited by

                        @tinfoilmatt just be aware pfB dedupe has its own issues:
                        https://forum.netgate.com/topic/185901/pfblockerng-not-blocking-some-foreign-sites-using-geoip/8

                        Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                        When upgrading, allow 10-15 minutes to reboot, or more depending on packages, CPU, and/or disk speed.
                        Upvote 👍 helpful posts!

                        tinfoilmattT 1 Reply Last reply Reply Quote 0
                        • tinfoilmattT Offline
                          tinfoilmatt @SteveITS
                          last edited by

                          @SteveITS said in Filterdns has stopped resolving hostnames in firewall aliases:

                          https://forum.netgate.com/topic/185901/pfblockerng-not-blocking-some-foreign-sites-using-geoip/8

                          Was not aware. Thanks for the share.

                          Tangentially related—but as does CIDR aggregation when using a combination of IP blacklists (i.e., 'action' Deny) and whitelists (i.e., 'action' Permit).

                          1 Reply Last reply Reply Quote 0
                          • S SteveITS referenced this topic
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.