pfBlockerNG 3.2.8_1 does not rebuild IP tables correctly after feed changes

RKoser

Hello,

I would like to report what appears to be an inconsistency during IP list rebuilding. I'm not sure if this is a bug or expected behavior, so I would appreciate your feedback.

Environment
pfSense CE
pfBlockerNG 3.2.8_1
Scenario

I have:

one custom blacklist (Bad_list_custom_v4)
one custom whitelist (1_IPs_WhiteList_v4)

Both are downloaded from HTTPS URLs hosted on my own server.

The whitelist contains:

178.104.49.141/32

The blacklist originally contained:

178.104.0.0/16
178.105.0.0/16

which pfBlockerNG correctly aggregates into:

178.104.0.0/15
Investigation performed

I verified every processing stage.

Remote feeds

Both URLs returned the expected contents.

Original files
/var/db/pfblockerng/original/Bad_list_custom_v4.orig

and

/var/db/pfblockerng/original/1_IPs_WhiteList_v4.orig

contained the expected data.

Generated files
/var/db/pfblockerng/deny/Bad_list_custom_v4.txt

and

/var/db/pfblockerng/permit/1_IPs_WhiteList_v4.txt

were also generated correctly.

PF tables

The whitelist table correctly contained the host:

pfctl -t pfB_White_web_v4 -T test 178.104.49.141

returned:

1/1 addresses match

The blacklist table contained:

178.104.0.0/15
178.105.0.0/16

which is expected after CIDR aggregation.

Problem observed

The destination IP was still being blocked by:

pfB_Bad_list_v4

although the same IP was already present in:

pfB_White_web_v4

The Alerts page showed repeated blocks like:

pfB_Bad_list_v4
178.104.49.141:25
Bad_list_custom_v4
178.104.0.0/15

Later, the Permit log started showing:

pfB_White_web_v4
178.104.49.141
1_IPs_WhiteList_v4

indicating that the whitelist was loaded correctly.

What finally solved the problem

The issue only disappeared after manually deleting the generated files:

rm -f /var/db/pfblockerng/original/Bad_list_custom_v4.orig
rm -f /var/db/pfblockerng/deny/Bad_list_custom_v4.txt
rm -f /var/db/pfblockerng/masterfile

rm -f /var/db/pfblockerng/original/1_IPs_WhiteList_v4.orig
rm -f /var/db/pfblockerng/permit/1_IPs_WhiteList_v4.txt

and then running a Force Update.

After those files were rebuilt, the behavior returned to normal.

My question

Is this expected behavior?

Should a normal Force Update always rebuild these internal files automatically?

Or could there be a situation where the generated files remain inconsistent until they are manually removed?

During the investigation I verified:

remote feeds
original files
generated deny/permit files
PF tables
pfctl output
Force Update logs

Everything appeared consistent except that the problem only disappeared after manually deleting the generated files and forcing a complete rebuild.

Any guidance would be appreciated.

Thank you.