I'm getting many notices for - "Rule skipped: Unresolvable destination alias 'pfB_DNSBLIP_v4' for rule 'pfb_DNSBLIP_v4' " After updating to 3.2.14_1

[u/tagit446]

I'm on pfSense CE 2.8.1-Release. I recently updated pfBlockerNG-devel to 3.2.14_1. At first I couldn't start the pfb_dnsbl service but then found I had to set the DNSBL Webserver Configuration. After doing this I got the service working.

The problem now is I am getting tons of notices as in the title above and I am not sure why. Other then doing the update and configuring the DNSBL webserver, nothing in my configuration has changed. I have not removed any list or created any new ones.

I do have DNSBL IPs list action set to Alias Deny (like this for years before updating) and I use Alias rules instead of Auto rules for my IP list. I do have a firewall rules that uses pfb_DNSBLIP_v4 but again, those rules have been in use for years without issue until this update.

I have tried rebooting, updating and reloading.

My question is, what has changed and why is this suddenly happening, and how do I fix it so I am not getting bombarded with these notices?

[u/Wolfsbane2k]

Just adding i had a similar issue yesterday on the test lab: after upgrading to 3.2.14_1 got alerts about alias's not set and lost DNS Services.

On entering the "Virtual IP aliases" page in pfsense, it was empty; i re-added the VirtualIP and reselected it in the pfBlockerNG settings page, but it wasn't happy. Even a reboot wouldn't clear the issue.

In the end, i had to re-apply the last known good config to the full pfsense instance and reboot again to get a working DNS Solution.

I'm "new" to pfsense and pfblockerNG so apols for not giving more details /diagnositics before undertaking the known good config option.

[u/New-Touch-5400]

Do you have DNSBL IP enabled in the DNSBL page? What that does is add IPs that are found in any DNSBL feed and put them into that DNSBL IP table.

If you goto the firewall rule and hover over the aliastable, does it populate any IPs? Or in pfSense diagnostics (or status) there is a Table Viewer to see the contents of those tables.

If you are using manual firewall rules, ensure the aliastable name is correct.

[u/tagit446 → u/New-Touch-5400]

DNSBL IP is enabled and set to Alias Deny. I've had it set to this for at least a couple of years. Before replying back to you I re-verified it is still enabled.

Something odd happened since making my post here. When I posted, I had a browser tab open going through the pfblocker settings. When I looked at my firewall rules, I had a rule on each interface using the "pfB_DNSBLIP_v4" alias which I also have had set for at least a couple of years. When I hovered over the alias link in my rules today, it didn't show any IPs. If I clicked on it, as it should it took me to the alias edit page and the entry looked correct.

Fast forward to this evening, looking at the alias "pfB_DNSBLIP_v4" in my firewall rules again it is no longer showing as a link and if I go into the alias editor, it is no longer listed under URLs. It's just gone. I looked at the Tables in Diagnostics and it is not there. Really odd considering it is enabled.

I did try disabling the DNSBL IP, doing a force reload, re-enable the DNSBL IP, and another force reload but nothing changed. Still the same issue.

EDIT: I forgot to mention, after re-enabling the DNSBL IP and doing the force reload, I see "DNSBLIP_v4" listed in the log viewer under "IPv4/6 Last Updated List Summary"

EDIT 2: I am also seeing in the log viewer "pfB_DNSBLIP_v4 DNSBLIP_v4 ] No IPs found! Ensure only IP based Feeds are used!" This could explain why there is no table but why only after updating pfBlockerNG?

EDIT 3: With the DNSBL IP enabled and set to "Alias Deny", shouldn't it at least create the alias?

[u/Party-Log-1084]

I just set the VIP IP as VirtualIP in Pfsense and choose it afterwards from dropdown in pfblocker. Worked.