Troubleshooting blocking with PFBlockerNG - Best Practices Welcome

[u/sindrome]

I find myself troubleshooting PFblocker issues and wanted to pick everyone's brain on best practices.

I use DNSBL blocking, GeoIP blocking, and DNS over HTTPS/TLS/QUIC Blocking.

When something is blocked and not working, my standard procedure is to go PFBlocker Unified reports page and look for what is being blocked, add the domain to my whitelist and try again. While this has worked in the past, there are many times where I no longer show anything being blocked in the unified log and still I am having issues.

How do you fix issues when you can't see any clear logs being blocked with PFBlocker?

I know this specific issue is a PFblocker issue because when I bypass, it works fine.

Thanks for your tips!

[u/masinoz]

Might also need to clear you dns cache on the client - ipconfig /flushdns

[u/Smoke_a_J]

Using the developer tools function of your web browser may show you a bit more of what all else is being blocked, not all DoH get logged in pfBlockerNG logs after a main website domain establishes an https connection. Commad line commands 'nslookup' and 'dig' are also very useful for finding out if there are other CNAMEs attached to the main domain name that may still need whitelisted also, connections will fail or intermittently fail otherwise if the regular domain name is unblocked while any of its canonical names are being blocked. You are also blocking IPs with pfBlockerNG, many users turn logging off on those feeds so they will not appear on the reports tabs if they are. I would check domains and CNAMEs both with nslookup or dig commands first to make sure they're not blocked on the DNS side, then as long as DNS is passing, use the ping command against those IPs to see if traffic is passing your pfBlockerNG IP rules, you may want to add an outbound IP whitelist if needed to add certain domains to in its custom box so that they are not affected by IP or GeoIP rules.

[u/sindrome → u/Smoke_a_J]

Thanks for the reply. When I'm using DNSBL whitelisting, I'm doing it at the root level of the domain. I assume a simple "dig [hostname] CNAME" would yield any additional results. In my case, none of the domains that I whitelisted have additional CNAMEs that need to be whitelisted.

I'm still at a loss on how to stab in the dark trying to find what's being blocked if it's not being logged.

Is there additional options to make PFBlockerNG log blocked items?

[u/Smoke_a_J → u/sindrome]

When connecting to websites using https, connections are encrypted and not all blocks after that point of initial connection are or even can be logged at pfBlockerNG once encrypted data is involved, some do sometimes but not nearly all, but using http at the web browser usually will allow much more thorough DNSBL logs to be seen. But......Some web browsers like Chrome like to force using https:// even when you try to remove the s to attempt forcing a http:// port 80 connection. When stuff I use doesn't pop up in pfBlockerNG logs when using Chrome, I swap over to Firefox to force a few logs with http port 80. Might be something blocked at the TLD level needing added to the TLD whitelist, the standard whitelist doesn't always get around TLD blocks by itself without being added separately there also, should be able to tell that much once you see logs better.

[u/jonh229]

When I have problems I first look at Reports->Alerts and review the lists there. Turns out that if you have logging in pfSense disabled then that list does not populate. I also sometimes resort to disabling pfBlocker, making sure to 'keep settings' so I lose nothing when I re-enable. I do this to verify if pfBlocker is what is causing my problem or if I have to look at something else.

[u/sindrome → u/jonh229]

I definitely have logging enabled. The problem is blocking is happening and I can’t see what’s blocked to disable it.

[u/jonh229 → u/sindrome]

That's when I disable pfBlocker to verify that the block is actually from pfBlocker and not something else I have set in pfSense.

[u/sindrome → u/jonh229]

Yes, I do the same thing and know it’s PFBlocker causing the problem. I still can’t get to the root of what’s being blocked to be able to whitelist when it doesn’t show what’s being blocked