pfBlockerNG, can't disable caching or purge certain cache entries?

ipandast

Hello,

I have enabled DNSBL with some categories. And I noticed that there's no way to disable caching ( because I have other local forwarders ), nor can I use the command line shell to purge certain cache entries.

unbound-control returns an error saying "remote control is set to no", but setting it in the custom options won't work because those options weren't loaded at all.

Is there a way to either completely disable caching for pfBlockerNG either via pfblockerNG or unbound or use the command line shell? pfBlockerNG seems to take over the control when DNSBL is enabled.

Thanks.

Gertjan

@ipandast said in pfBlockerNG, can't disable caching or purge certain cache entries?:

unbound-control returns an error saying "remote control is set to no"

unbound-control works just fine (pfBlockerrng is using it ^^) : you have to use the config file, so it knows how to talk to unbound :

[26.03.1-RELEASE][root@pfSense.bhf.tld]/root: unbound-control -c /var/unbound/unbound.conf status
version: 1.25.2
verbosity: 1
threads: 2
modules: 3 [ python validator iterator ]
uptime: 55712 seconds
options: control(ssl)
unbound (pid 73469) is running...

@ipandast said in pfBlockerNG, can't disable caching or purge certain cache entries?:

Is there a way to either completely disable caching for pfBlockerNG either via pfblockerNG

How to say these carefully : pfBlockerng doesn't handle DNS traffic ( ! )

Example : I've a windows PC, a device on the pfSense LAN.
A long story short : when you activate / add DNSBL files, these are loaded, sorted and then prepared as a list that are handed over to 'unbound' the DNS resolver. pfBblockerng itself doesn't to do any 'DNS' related, and has no cache.

To flush my local DNS cache, I type (sorry, no GUI equivalent available ):

C:\Users\Gauche>ipconfig /flushdns

Configuration IP de Windows

Cache de résolution DNS vidé.

Wiping unbounds cache ?

unbound-control -c /var/unbound/unbound.conf

and pick whatever you think is right ^^ (probably nothing)
Important info : DNSBL info won't get flushed ...
The ubound's cache info you can flush is the info it got from 'the outside world'.

ipandast

@Gertjan
Hello Gertjan,

Thanks for your reply and clarification.

I know that on local computer, there are command to flush dns caches. However, my observation is that if the entry is still cached on pfsense, and the record is wrong, then when client devices query that record again, it still returns the wrong one.

Thanks for your information on the relationship between pfblockerNG and unbound. What I meant was that the default location of config files seems to be changed and now controlled by pfBlockerNG.

Now you reminded me that I have to (can) specify the config path (/var/unbound/unbound.conf) and then check caches, and purge certain entries or all entries.

Now I have what I need.

Thank you very much.
Ian

Gertjan

@ipandast said in pfBlockerNG, can't disable caching or purge certain cache entries?:

I know that on local computer, there are command to flush dns caches. However, my observation is that if the entry is still cached on pfsense, and the record is wrong, then when client devices query that record again, it still returns the wrong one.

Can you give an example of what host name is 'wrong' ?
Is it a local device ?
A internet host that you control like a DynDNS host name ? => Make the TTL lower, like 60 seconds !

When I want to block myself a host like :

by hitting the red padlock, that entry, "a-ring.msedge.net" will get entered into the unbound cache with a 'null' solution (something like ::0 because its an IPv6) and that will update an existing entry.
As the popup states when pressing the red padlock : unbound's cache (pfSense) will be ok, but your local OS or browser cache will need to be flushed.

My point in short : I never had to flush the pfSense DNS cache. Not that I recall.

ipandast

@Gertjan

Hi Gertjan,

Thanks a lot for your information.

I'm using pfsense in an environment where certain domains are blocked by returning wrong IPs, just like how pfBlockerNG can return a VIP to the client if a domain is blocked and then direct all the traffic to that site to the VIP interface.

With that said, I have dns rules on another local dns forwarder to bypass the blocking of some domains. But sometimes, the rules are not perfect, so there's still a chance that pfsense will get the wrong ip for one of those blocked domains and then it would be cached and served to many users.

Since the configuration file is located in /var/unbound/unbound.conf, I may still want to see if it's possible to completely disable the caching.

Sorry if I wasn't wording it correctly and left you the impression that pfBlockerNG is returning the wrong address or causing the issue.

Actually, the reason why I still want pfBlockerNG to be in the DNS path instead of not using pfBlockerNG for DNS is that I like the predefined sets and filtering features to protect LAN users.

Therefore, if I can disable caching of unbound, it will be much easier to debug and correct the polluted DNS records.

SteveITS

@ipandast If I'm understanding, you can just restart the DNS Resolver service to clear the cache.

Each client (e.g. Windows) may cache answers as well.