pfBlockerNG not logging anything by default?

Gertjan

Why would pfSense generate random host names / URLs ?

If it (unbound) has to resolve "otx.alienvault.com" then that was because it was asked to do so. The request came in by LAN, and was handled. And logged.

Shut down all LAN devices, and "DNS requests" will stop.
The ones still there will be 'Netgate' or 'time server' based.

@rasputinthegreatest said in pfBlockerNG not logging anything by default?:

https://otx.alienvault.com/indicator/ip/94.16.122.152

Where - what log - did you find that URL (DNS only deals with host names) ?

rasputinthegreatest

@Gertjan s7.vonderste.in resolves to 94.16.122.152. I just saw a dns request for that. In the whitelist on OTX Alienvault there is a timeserver: 3.de.pool.ntp.org
I just don't know why a timeserver runs on a TOR node and seems to be hosted by a private person.
Maybe pfblocker resolves it incorrectly becaues the time server is hosted on the same IP?
Anyway I see this coming from my ASUS router which is in Access Point mode. These weird domains always come up every hour and I think they are related to ntp on that ASUS router. Since I disconnected it it has stopped. Here is an example of what I see. Scanning these IPs shows nothing malicious but who knows.

93.122.215.85.in-addr.arpa,192.168.1.8,sonne.floppy.org,unk
94.244.38.46.in-addr.arpa,192.168.1.8,basilisk.mybb.de

What didn't stop was on my work computer these weird replies as mentioned above.

reply,A,NSEC,1081,domaincontroller-gPHvwjYS.local,192.168.1.86,NXDOMAIN,unk

But it only happend once today instead of multiple times like the days before.

@Gertjan said in pfBlockerNG not logging anything by default?:

Where - what log - did you find that URL (DNS only deals with host names) ?

I find them in pfblockerNG dns_reply log under Logs

EDIT: I just realized that it is kind of in the name pool.ntp.org
its made up of multiple sources so it does make sense that it resolves some of these weird private hosts?