PSA: Domain name based aliases (filterdns) can fail silently, use pfBlockerNG instead

[byakka]

I've noticed some of my firewall rules are unreliable: they work right after I set them up, but after a while they stop matching, and then later start working again.

All of the failing rules rely on domain name based host aliases:

• Firewall → Aliases → IP
• Type: Host(s)
• Address: some FQDN (e.g., example.com)

When the rules fail, I can see that the corresponding tables (Diagnostics → Tables) are empty or only partially populated.

I'm running pfSense CE 2.8.1 (amd64) using my local AdGuard Home as the only DNS Server. It's a small home environment with only a few rules.

Trying to debug this, I checked /var/log/resolver.log and found the following filterdns error popping up every so often:

failed to resolve host ... will retry later again.

I increased debug output by restarting filterdns with -d 30, and noticed that whenever filterdns can't resolve a name, it removes the existing addresses from the table.

The error is defined in filterdns.c and it looks like it means getaddrinfo() failed to resolve the name. What's odd is that each time this happened, I could still resolve the same name from another SSH session using getaddrinfo command (or dig for that matter) without any issues.

I couldn't debug it further, so I decided to stop relying on filterdns for DNS-based tables. As a workaround, I moved all DNS-based aliases over to pfBlockerNG, which (so far) has been a reliable way to maintain hostname-based tables.

Workaround: build a hostname-based alias via pfBlockerNG

1. Install the pfBlockerNG package.
2. Go to Firewall → pfBlockerNG → IP → IPv4
3. Click Add
4. Under IPv4 Source Definitions, add one hostname as the "Source" entry
   • Format: Whois
   • State: ON
   • Source: example.com
5. Under Settings:
   • Action: Alias Native
   • States Removal: Enabled
6. Under IPv4 Custom_List:
   • Enable Domain/AS
   • Add the rest of your hostnames, one per line
   • Save
7. Force an update:
   • Firewall → pfBlockerNG → Update
   • Select 'Force' option: Reload
   • Select 'Reload' option: IP
8. Use the resulting alias (e.g. pfB_<name>_v4) in your firewall rules.

Hopefully this helps anyone having issues with random host alias failures.

[Patch]

Firewall → pfBlockerNG → IP → IPv4 -> IPv4 Custom_List

Requires "1. IPv4 addresses entered directly into the custom list, as per the required format."

What is the "required format"?

The reason I ask is

• 123.123.123.0/24 -> Customlist: Invalid Domain name entry: [ 123.123.123.0/24 ]
• 123.123.123.123 -> nothing added to Alias

So my guess at the "required format" appears to be wrong

[FireOdo]

@Patch said in PSA: Domain name based aliases (filterdns) can fail silently, use pfBlockerNG instead:

123.123.123.123 -> nothing added to Alias

Try 123.123.123.123/32 (for single IP)

PS. Maybe a "Force Reload" is also necessary ...

[byakka]

@Patch

The Note under the IPv4 Custom_List heading says:

Note: Custom List can be used in ONE of two ways:

1. IPv4 addresses entered directly into the custom list, as per the required format.
2. Domain names or AS numbers, which will be converted into their respective IPv4 addresses.

Your error message Customlist: Invalid Domain name suggests you have Enable Domain/AS checked.

If you need both IPs and DNS names, my guess is that you'll have to use separate lists.

[Patch]

@byakka
While you are almost certainly correct, I do not like the answer / consequences.

I'm indeed trying to create an alias with both directly specified IPv4 values and FQDN such as:

123.123.123.123
forum.netgate.com

So my initial reading was that was within the supported options. But your reading is pfBlockerNG supports option 1. or option 2. but not both at one time.

Looks like it's back to the drawing board :(

@fireodo said in PSA: Domain name based aliases (filterdns) can fail silently, use pfBlockerNG instead:

Try 123.123.123.123/32 (for single IP)

Fair call but I tried that first and got errors (the same error as above).

[Patch]

@byakka
You were correct.

The solution for mixed aliases is

• Enter all FQDN in "IPv4 Source Definitions" as separate Format: Whois, State: On. As described in the OP

• Enter all explicit IPv4 addresses in the "IPv4 Custom_List" custom list section. Ensure "Enable Domain/AS" is not checked.