Hi all,
I'm using pfsense as a DNS resolver and realised that after sometime the resolution stop working from the router and i find the DNS service stopped.
I cannot pinpoint it to a specific event but I do have pfblockerng installed.
Thanks
Posted Apr 27, 2019, 10:16 PM UTC
Which version of pfSense? Which version of pfBlockerNG? What hardware? Did you try pfBlockerNG Beta? The Beta version works best for me (running in production).
Interresting, thank. Do you have all your pfsense install in Beta or just this package?
No. Only this package.
APU2 is fine. Is this the 2 or 4 GB model?
You might want to check the 'SSL/TLS option' and the 'Use SSL/TLS for outgoing...' option and uncheck the 'DHCP Registration' option of the DNS Resolver.
Be sure to use DNS servers which support SSL/TLS like 1.1.1.1 and 8.8.8.8 and so on.
Do you have a proper setting for the 'firewall Maximum States' and 'Firewall Maximum Table Entries'? I did change that to '605000' for both at System > Advanced > Firewall & NAT.
Some additional settings which might improve some things:
System > Advanced > Networking: thick the box 'Disable hardware checksum offload'.
System > Advanced > Miscellaneous: Crypto & Thermal Hardware:
Oh... And be sure to thick the box 'Resolver Live Sync' [Firewall > pfBlockerNG > DNSNL: 'DNSBL Configuration']. That's a Beta option which is really helpful.
I have the 4g. Do you run one as well?
The beta is the "pfBlockerNG-devel" ? If so I have it installed already
Thanks you for the config tricks. What does the firewall max state changes in practices?
No. VDSL2+ (approximately 110 Mbps down and 35 Mbps up).
Yes. You are running the beta.
From https://docs.netgate.com/pfsense/en/latest/firewall/tables.html
Tables are used to hold a group of IPv4 and/or IPv6 addresses. Tables are ideal for storing large groups of addresses as the time required to lookup an address is only slightly more than a table containing a small amount of addresses.
pfBlockerNG adds quite some IPv4 addresses to several tables. At least for my config. There's one that has over 100000 records. So, pfSense will run into problems when their isn't enough room for storing it's tables.
The above is with regards to "tables".
The states however are for the actual connection. Every connection requires two states.
https://docs.netgate.com/pfsense/en/latest/firewall/increasing-the-state-table-size.html
So, "tables" and "states" are two different things, but I just keep the figures the same and make sure there is sufficient room to store tables and states.
My guess is that you haven't ticked the box "Resolver Live Sync" for pfBlockerNG?
I had to untick the option "DHCP Registration" of the DNS Resolver too.
I am hoping these two settings resolve your DNS issue.
Not a fix, but a possible workaround: install Service Watchdog from the package manager and have it watch the Unbound service.
Didn't know this existed. thanks !
Pfblockerng sometimes causes my unbound resolve to stop, and not allow manually restarting it unless I do a full reboot. Rarely if pfblocker hangs during an update I see unbound restart several times a minute and DNS queries time out while this is happening, again requiring a full reboot.
I can just restart the service from the panel, so that's fine. I'm thinking about a cron job to restart the DNS if a website doesn't resolve. But that's just a hacky solve.
eidt: I tried someting a tad nicer also via cron, will see over the week. If the problem is assumed to comes from pfblocker feed updates, maybe reducing the updates to once a day and before a daily reboot will mitigate it.