pfblocker shows after one day only, thousand of connections to netgate, wondering whats goin on?
-
First, Im on CE 2.9.0, and so far very happy with it, but ->
pfblocker shows, after one day only, thousand of connections to netgate, wondering whats going on?
I vist nearly daily, our netgate forum here...but can all this be then accumulate to 1811 connections?
Shouldnt it connect only in case of backup, or if I use Package Manager?
Does somebody have a clue, or is this normal?
Thanks!
-
@TommyMoo well off the top of my head netgate.com has a very short ttl
;netgate.com. IN A ;; ANSWER SECTION: netgate.com. 60 IN A 199.60.103.104 netgate.com. 60 IN A 199.60.103.4That is going to generate quite a few queries.. I don't think it phones home on its own unless you have the gui open?
I personally don't like things that do that, so I set a min ttl of 3600 seconds in unbound.
To be honest I have zero idea why they would set such a low ttl..
Same with the forum
;; QUESTION SECTION: ;forum.netgate.com. IN A ;; ANSWER SECTION: forum.netgate.com. 60 IN A 208.123.73.77Personally IMHO that is borked setup.. For what possible reason does it make sense to have such a low ttl..
And even their NS records
;; QUESTION SECTION: ;netgate.com. IN NS ;; ANSWER SECTION: netgate.com. 3600 IN NS ns2.netgate.com. netgate.com. 3600 IN NS ns1.netgate.com. netgate.com. 3600 IN NS ns3.netgate.com. ;; ADDITIONAL SECTION: ns1.netgate.com. 3600 IN A 208.123.73.80 ns2.netgate.com. 60 IN A 208.123.73.90 ns3.netgate.com. 60 IN A 34.197.184.5 ns1.netgate.com. 3600 IN AAAA 2610:160:11:11::80 ns2.netgate.com. 60 IN AAAA 2610:160:11:11::90 ns3.netgate.com. 60 IN AAAA 2600:1f10:4c5e:6701:e4b2:c059:13c5:64fbWhy do ns2 and ns3 only have 60 second ttls? This is going to generate nothing but extra traffic.. I just don't get it.
And ns3 isn't even working
$ dig @ns3.netgate.com netgate.com ns ; <<>> DiG 9.16.50 <<>> @ns3.netgate.com netgate.com ns ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 27280 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 1232 ; COOKIE: f53ab355f54020d9010000006a9b3b8986188a9bc4d42f4c (good) ;; QUESTION SECTION: ;netgate.com. IN NS ;; Query time: 46 msec ;; SERVER: 34.197.184.5#53(34.197.184.5) ;; WHEN: Fri Sep 04 16:43:37 Central Daylight Time 2026Someone should seriously look at this setup. Maybe @stephenw10 could get someone to look into it.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 26.07 | Lab VMs 2.9.0, 26.07 -
Looking.....
Are you blocking that traffic so it keeps trying perhaps?
Interestingly I don't get that page on my edge device. Hmm, must be something that needs to be enabled.
Edit: Oh requires python mode -
@stephenw10 Hello Stephen, no, I did not block anything regarding netgate... I only saw, that all these queries came from the firewall itself, aka 127.0.0.1
Yes, I used Python Mode in pfBlocker
I have, and that crossed my mind later, after thinking some about it: I have disabled all IPv6, in my LAN and aswell to my four VPN tunels, all runing IPv4 only, maybe it tries over and over again to reach netgate via IPv6... and so, fills up the Top Reply Domain list..., hope ist not my fault or a setup error by myself..must find out..somehow
Maybe johnpoz is right, and I should increase TTL to 3600 in unbound, Thanks for this Tip!
-
@TommyMoo I have been running a min 3600 til for years and years - and have never ran into any sort of issue with it.
You could for sure do that - there are many other domains that run what amounts to insanely low ttls. The only time such low ttls would make sense is with dynamic stuff that changes all the time and you need/want to minimize switch over when that changes.
or you are in the process of changing a record to a new IP, etc..
I just started dnstop on pfsense listening on 127.0.0.1 - so the only queries this should see is the ones pfsense makes itself, or possible some redirections I am doing - but I would have to double check if I even have any of those setup still. And stuff that pfsense might be looking for in aliases that update every 5 minutes. I started this like 6:13 and then loaded the web gui, and did see like 3 queries for netgate.com
I will let it run until say tmrw morning.. And see where the counters are at.
Queries: 0 new, 27 total Fri Sep 4 18:40:06 2026 Query Name Count % cum% --------------------- --------- ------ ------ netgate.com 9 33.3 33.3 ips.hetrixtools.com 4 14.8 48.1 ms-acdc.office.com 4 14.8 63.0 www.netgate.com 3 11.1 74.1 5.123.in-addr.arpa 1 3.7 77.8 212.185.in-addr.arpa 1 3.7 81.5 118.177.in-addr.arpa 1 3.7 85.2 36.177.in-addr.arpa 1 3.7 88.9 167.116.in-addr.arpa 1 3.7 92.6 netgate.com.home.arpa 1 3.7 96.3 177.45.in-addr.arpa 1 3.7 100.0The counters for netgate.com do seem to be going up - and I do not have the gui open, only a ssh session to the box. Wonder if its checking because I have rss feed setup?
Also netgate could be asking unbound, which unbound has it cached - so wouldn't be an actual external query for me unless the min ttl I have set expired. Cuz the os wouldn't actually cache that - and it would have to ask dns for it. Not sure if what your showing is just queries to unbound, or external queries that unbound has made after a client asked it for something it did not have in its cache.
I would have to track actual external queries, cuz number for netgate.com is up to 12 now.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 26.07 | Lab VMs 2.9.0, 26.07 -
@johnpoz said:
To be honest I have zero idea why they would set such a low ttl..
Only circumstance I can think of is during the process of an isp or data center migration. Otherwise, not a good idea.
-
@johnpoz I confess, I never touched the TTL in unbound, now, I checked it, and it had 84XXX <- (Dont remember now the exact value) -> must be standard setting, as I never touched it, but now, I changed it to TTL 3600, Ill monitor it too...Thanks for your help!
Maybe, Im just clueless...lol..and its normal...but I think, I havent seen so many connections in the past...2.8.1 and below.. -
@TommyMoo said in pfblocker shows after one day only, thousand of connections to netgate, wondering whats goin on?:
now, I checked it, and it had 84XXX <- (Dont remember now the exact value)
The value was likely
86400(which is the default value, equal to 1 day). Like Denny, I've been using3600for years and that seems like a sensible value. I would not set it any lower than that. On a larger/busier network, I would probably use14400(4 hours) or larger to avoid too much wasted DNS traffic. -
Yeah not sure why anyone would want drive traffic to their dns like that.. I mean how many installs of pfsense do you think there are globally? 100k, 500k, 1m, multiple million?
Sure you can drastically reduce the queries to their actual name servers because dns services like google and quad would reduce the actual number of queries to their ns by their cache..
But pfsense out of the box resolves.. So in theory every single of instance pfsense would be doing queries to their name servers with a ttl of 60 secs - why??
So far from my dnstop pfsense has wanted to know the ips of netgate.com 123 times in like 3 hours. If I didn't have that cached locally with a ttl of 1 hour that would be 123 queries to their name servers.. Now multiple that by how many thousands and thousands of installs of pfsense..
I just don't get why that would be done on purpose.. I mean a single dns query isn't a lot of traffic by itself - but multiple that by the 100s of thousands of pfsense that are out there and it starts to add up. I just don't get it to be honest.
-
@TommyMoo said in pfblocker shows after one day only, thousand of connections to netgate, wondering whats goin on?:
I never touched the TTL in unbound, now, I checked it, and it had 84XXX
where are you looking at that? I am talking the min ttl value, not the max value
What this means if you look up something and the ttl the owner has set is like 60 seconds, 300, 600 seconds unbound will cache it for 3600 seconds, vs some insane low value.
Max is vs say caching something for a week, the max would be 1 day.
I mean you should adhere to what the owner of a record is setting - but not if they are going to use insane low values.
An intelligent man is sometimes forced to be drunk to spend time with his fools
If you get confused: Listen to the Music Play
Please don't Chat/PM me for help, unless mod related
SG-4860 26.07 | Lab VMs 2.9.0, 26.07 -
@johnpoz said in pfblocker shows after one day only, thousand of connections to netgate, wondering whats goin on?:
I mean you should adhere to what the owner of a record is setting - but not if they are going to use insane low values.
But what's "insane"? There is a use-case for very short TTLs when the domain is prepping for an address change and they want to be sure that the change propagates PDQ after they pull the trigger. So overriding that setting isn't really good practice on the receiving end: you're just hurting your own ability to track the impending change. But to leave TTL set low when things are stable is, frankly, admin incompetence that hurts everybody. netgate should be ashamed.
-
@tgl said in pfblocker shows after one day only, thousand of connections to netgate, wondering whats goin on?:
TTL set low when things are stable is, frankly, admin incompetence
No in big tech it's data harvesting
-
@Patch said in pfblocker shows after one day only, thousand of connections to netgate, wondering whats goin on?:
No it's data harvesting
Try to rein in your paranoia. If netgate want to track who's using them, once-a-minute is not better than once-a-day.
-
@tgl said in pfblocker shows after one day only, thousand of connections to netgate, wondering whats goin on?:
So overriding that setting isn't really good practice on the receiving end:
Oh no - some site I visit now and then I might have the wrong IP for an hour. But yes when moving a site sure low ttls are valid.. I would have to look back - but pretty sure I have brought up low ttls before for netgate.
If I did have an issue with some site - checking dns would be one of the first things I would do anyway. But I have been running this for YEARS, maybe even a decade or more and never had an issue.
so quick query found this same thing about low ttl come up over a year ago
-
Hello johnpoz, yes, I have it setup like you now ->
and here, and updated view of Top reply Domains, after approx 16h, including sleep time ->
Im now arround 5 minutes, on my Mac, checking it out, and its now, after 20 mins has increased to from 11111 to 1114, I think...thats OK, dont know what you specialist, think ->
Thanks for all the support and replys to each of you!
-
@luckman212 Thank you, yes, of course 86400, I must apologize, I stayed awake and posted this, like 3 AM in the morning, thinking about it, and it got so late..that my eyes and brain just been to tired, to remember that 86400 is exactly one day. That can happen, if you 63 years old and stay longer awake after a normal work day. Sorry
My Network is ridiculus small, I only have a MacStudio M4, an iPhone, Laserprinter, and a ubuntu server VM(-> for SMB, RADIUS and other neat things) and two more VMs that run standalone with each running -> (AriaNG and qbittorrent). 6 devices hahahha
-
Hmm, do you have any aliases that include netgate.com? Those are frequently resolved.
-
@stephenw10 I am almost positive I don't have any.. And with no gui open.. just ssh to it - it sure seems to be looking for netgate.com a lot ?
Query Name Count % cum% ------------------------------- --------- ------ ------ netgate.com 588 25.5 25.5 ips.hetrixtools.com 380 16.5 41.9 ms-acdc.office.com 380 16.5 58.4So I do have those other 2 in an alias.. This is about 10 hours after I started dnstop..
Now my curiosity cat is really meowing at me on why so many queries.. No gui open, so why would it be looking for updates like it does when you first load the page.. And even if so - why does it need to check so often? I would think like once a day should be fine.
-
My resolver gets hammered obnoxiously all day long with tab/s left open to this site.
-
@tinfoilmatt yeah I just don't get it - why would any company want to drive traffic to their dns - I am at a loss to the benefit of increasing traffic to me.. Sure when someone loads the gui - hey check if there is an update to let the user opening the page know about - if there is.
I am at a loss here - love to see an official response to be honest.
So the dnstop I started like 22 hours ago shows.
Query Name Count % cum% ------------------------------- --------- ------ ------ netgate.com 798 25.0 25.0I just don't get it.. If you want to count your installs ok - why would not once every 24 hours not do that?
I have been playing with dns for since dns has been around to be honest, and I have gotten paid to run dns for a fortune 100 company in my career - and I just don't see why any company would want to drive increased traffic to their name servers.
Privacy Policy · Cookie Policy