Unbound custom options no longer working since update to 2.9.0
-
Hi there,
I am using pfSense Community Edition with pfBlockerNG-devel in a school environment, and essentially only with DNSBL.
Last week, I upgraded to pfSense 2.9.0. At first, I did not notice anything unusual, and everything seemed to work as expected. Then I needed to add an entry to the whitelist for a colleague. When applying the changes, I noticed that the VIP entry apparently now has to be created manually, and it also seemed that a forced update of pfBlockerNG to 3.2.17_1 had been triggered. I added the VIP, applied the changes, and then performed a force update.
During that process, I noticed that the pfBlockerNG update to 3.2.17_1 had apparently reset the TLD limit to 3,000,000, which prevented the update from completing successfully. I therefore increased the maximum value back to 6,000,000.
In case this comes up: I am using Unbound mode because it allows me to exclude entire networks from DNSBL via the resolver's custom options. As far as I know, this is not possible in Python mode.
And that is now my biggest problem: after all these updates, the custom options seem to be ignored, and pfBlockerNG is simply blocking traffic on all of my networks. I have restarted the resolver several times, but unfortunately without success.
Does anyone have an idea how I can fix this? Is there perhaps a way to upgrade to 2.9.0 without forcing a pfBlockerNG update?
For the time being, I have reverted to an old 2.8.1 backup, where everything is working perfectly again.
Thanks for your help!
Markus
-
@trainapollo said in Unbound custom options no longer working since update to 2.9.0:
During that process, I noticed that the pfBlockerNG update to 3.2.17_1 had apparently reset the TLD limit to 3,000,000, which prevented the update from completing successfully. I therefore increased the maximum value back to 6,000,000.
In case this comes up: I am using Unbound mode because it allows me to exclude entire networks from DNSBL via the resolver's custom options. As far as I know, this is not possible in Python mode.
And that is now my biggest problem: after all these updates, the custom options seem to be ignored, and pfBlockerNG is simply blocking traffic on all of my networks. I have restarted the resolver several times, but unfortunately without success.
Consider this as 'plain' bad.
The unbound method exists for special cases, "yet to be found"
. It was replaced by the way better 'python' method.
Read this :
The "Unbound method" does not only use 'way more memory', it will flat out 'fail' when you ask it do a lot (remember : PHP is used to do the DNSBL file handling, and is very slow .... ).
Do a manual "all forced reload and observe the reload page, the log. How much time did it take ?
It should take some/several seconds, and if it take way longer then that, you have an issue, as DNS is unavailable during that time.
Adding 'many' DNSBL and reloading takes 'ages', and this is a bad situation.If this :
@trainapollo said in Unbound custom options no longer working since update to 2.9.0:TLD limit to 3,000,000
isn't enough for you, even if you have a big Xeon xx Ghz processor, and loads of memory (32++ Gbytes) I still strongly advice you not to use "millions of TLDs".
Yes, you can do it.
No, you can't as you create an unstable system.Btw :
Custom options :
and it still works.
I can see these instructions at the bottom of the /var/unbound/unbound.conf file :
Btw : the slights 'syntax' error made in the Custom config text box will create a fail during reload, and the config won't be taken into account.
edit :
The main TLD file ( see GUI info : /usr/local/pkg/pfblockerng/dnsbl_tld ) is rather small, a bit less then 100 Kbytes in size, with 7700+ entries (lines).
If you want this file, the 7700+ entries, cross checked with all your DNSBL entries (how many ? 1 000 000 + ?) the you have to multiply these two to get the number of search/match operations. -
@trainapollo The VIP is “normal”…those on Plus went through that a year or so ago.
Packages are always updated during an upgrade, or config restore. The new pfSense/PHP/OS may demand different code.
I’ve not heard of any options being changed during a package update. Maybe a bug? Not sure many have that set that high?
Re custom options, I would look at the unbound log file entries.
-
Thanks for your answers. I am totally aware that the unbound way I chose with the huge lists is not ideal. But for our school environment it was a fast and sensible way to block adult content (through the Toulouse list). And: so far it had worked like a charm. Memory usage was never higher than 40% on the VM I am running pfSense on. I am not a pro but I know that there are better solutions and ways.
Anyhow, I just didn't understand why the custom options in unbound stopped working. I was also thinking about a bug first.
Once again I chose this way of using DNSBL because back then there was no option to exclude whole networks in unbound python mode (which I had tried first). Of course I could add hundreds of single IPs to the exclusion list in python mode, too. But when I first tried that in December 2025 it didn't work reliably. Maybe things have changed and it works better now and switching to python mode would be an option now.
For now I am running 2.8.1. again but will try 2.9.0 again with the latest pfblockerng package as soon as we have some days off at school in autumn.
Thanks again for your help.
Privacy Policy · Cookie Policy