Hello everyone, I just want to share my experience for those on the fence about upgrading. Everything appears to be running smoothly so far.

I logged into pfSense via SSH and the ran the following command from the shell:

fetch -qo - https://pkg.pfblockerng.com/install.sh | sh -s -- --channel stable

A few things I noticed after upgrading and a few questions.

1. I had to run a Force Reload to rebuild the DNSBL database so that it will function correctly.

2. If you go to System->Package Manager in pfSense, pfBlockerNG is not listed under Installed Packages, which is to be expected. pfBlockerNG-devel is the only version available under Available Packages. Which is also to be expected. I do have 1 question, assuming I wanted to for some reason, how would moving back to the Netgate repo work? I didn't see any instructions on the Github or the pfBlockerNG: IP blocklists, GeoIP and DNSBL for pfSense website. I am pretty sure I just overlooked it.

3. I got this error in the pfBlockerNG widget on the homepage: Unbound control [ status ] FAILED (exit 1) [ 10/16/26 23:06:38 ]...Is this safe to ignore/delete? Unbound appears to be working just fine after I ran a Force Reload. So, I am not sure if there is something I still need to do.

4. Is proper ABP syntax supported in this version or is that a version 4 only feature?

Here is the output of the initial install command. I am posting this because it looks like process ran without issues and sometimes, it's just good to see what the log should look like for comparisons sake. Hopefully, it's helpful for someone.

==> Installed boot-time generator hook to /usr/local/etc/rc.d/pfblockerng_repo_generate.sh
==> Running the generator hook to resolve the conf now
[pfblockerng_repo_generate] INFO: regenerated /usr/local/etc/pkg/repos/pfb-candidate.i98fOC -> http://pkg.pfblockerng.com/stable/ce-2.9
==> Probing http://pkg.pfblockerng.com/stable/ce-2.9/meta.conf
==> Conf resolved:
    url: "http://pkg.pfblockerng.com/stable/ce-2.9",
==> pkg update -f -r pfblockerng-stable (refreshing the pfBlockerNG catalog)
Updating pfblockerng-stable repository catalogue...
Fetching meta.conf: 100%     168 B   0.2 kB/s    00:01
Fetching data: 100%    1743 B   1.7 kB/s    00:01
Processing entries: 100%
pfblockerng-stable repository update completed. 1 packages processed.
pfblockerng-stable is up to date.
==> Target: pfSense-pkg-pfBlockerNG-3.3.11 (repo pfblockerng-stable)
==> Installed: pfSense-pkg-pfBlockerNG-3.2.17_1 (from repo pfSense)
==> Reinstalling pfSense-pkg-pfBlockerNG from pfblockerng-stable
Updating pfSense-core repository catalogue...
Fetching meta.conf: . done
Fetching data: . done
Processing entries: . done
pfSense-core repository update completed. 4 packages processed.
Updating pfSense repository catalogue...
Fetching meta.conf: . done
Fetching data: .......... done
Processing entries: .......... done
pfSense repository update completed. 575 packages processed.
Updating pfblockerng-stable repository catalogue...
pfblockerng-stable repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be UPGRADED:
        pfSense-pkg-pfBlockerNG: 3.2.17_1 -> 3.3.11 [pfblockerng-stable]

Number of packages to be upgraded: 1

2 MiB to be downloaded.
[1/1] Fetching pfSense-pkg-pfBlockerNG-3.3.11: .......... done
Checking integrity... done (0 conflicting)
[1/1] Upgrading pfSense-pkg-pfBlockerNG from 3.2.17_1 to 3.3.11...
[1/1] Extracting pfSense-pkg-pfBlockerNG-3.3.11: .......... done
Removing pfBlockerNG components...
Menu items... done.
Services... done.
Loading package instructions...
Removing pfBlockerNG...pfctl: Table does not exist.
pfctl: Table does not exist.
 All customizations/data will be retained... done.
Saving updated package information...
overwrite!
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Executing custom_php_install_command()...
Rebuilding GeoIP tabs... done.
Creating Firewall filter service... done.
Renew Firewall filter executables... done.
Starting Firewall filter Service... done.

Creating DNSBL service... done.
Renew DNSBL lighttpd executable... done.
Creating DNSBL web server config ... done.
Creating DNSBL Certificate... done.
Starting DNSBL Service... done.

Upgrading previous settings:
 Adv. Inbound firewall rule settings... no changes required ... done.
 OpenVPN/IPSec interface selections... no changes required ... done.
 Proofpoint/ET IQRisk settings... no changes required ... done.
 General Tab -> IP Tab settings... no changes required ... done.
 pfBlockerNGSuppress Alias -> IPv4 Suppression Customlist... saving new changes ... done.
 Upgrading previous EasyLists to new format... no changes required ... done.
 Upgrading previous Firefox DoH to new format... no changes required ... done.
 MaxMind License Key configuration setting... no changes required ... done.
 Validating Widget cron settings... no changes required ... done.
Upgrading... done

Custom commands completed ... done.
Executing custom_php_resync_config_command()...pfctl: Table does not exist.
pfctl: Table does not exist.
done.
Menu items... done.
Services... done.
Writing configuration... done.
==> Done — pfSense-pkg-pfBlockerNG-3.3.11 installed from pfblockerng-stable (stable channel).

Although, they are a bit dated, I usually follow Lawrence Systems tutorials on pfSense, including the couple he has on setting up pfBlocker.
I haven't seen any of his tutorials mention the python option in pfBlocker so I have some questions about it. Do you use it?
I have read it helps with memory but increases latency a bit and introduces some issues with openVPN.

Should I enable it? although I am not sure what the use case is for it

Reading some conflicting information I think. I am running pfSense 2.9.0.
I see pfBlockerNG 3.2.17_1 and pfBlockerNG-devel 3.2.17_1

I can't find a blocklist that blocks anonymous viewers or social media scraping sites.

Example: picuki, inflact, inviziogram, anonyIG, boostbluence, save-free, instapv dumpor, peekviewer, etc...

Could you help me?

There is an error that is preventing the pfb_dnsbl pfBlockerNG DNSBL service to start. Error from log:

ERROR [pfBlockerNG] DNSBL missing python script - forced reload required

This is a reposting of my post over in the pfsense sub as I couldn't get it to crosspost here for whatever reason.

PFSense Specs: I'm running pfsense CE 2.9 and pfblockerng 3.3.8 with no other major packages (just apcupsd and wireguard).

I run pfsense on a bare metal box (a protectli FW6B) that has an i3-7100U and 8GB of RAM so it should have plenty of power. RAM is never above 20% and CPU usually hovers around 10% >.

The issue: about once every 7-10 days following pfblockerng's 1AM cron run

/usr/local/bin/php /usr/local/www/pfblockerng/pfblockerng.php cron >> /var/log/pfblockerng/pfblockerng.log 2>&1

unbound is unable to restart and gets hung up leading to it's LAN queues overflowing and dropping connections. My LAN network is the only one pfblockerng is active on which I assume is why none of the others are affected.

Sep 13 14:37:05 pfSense php-fpm[45310]: /widgets/widgets/pfblockerng.widget.php: Session timed out for user 'admin' from: 192.168.1.25 (Local Database)
Sep 14 01:00:00 pfSense php[75627]: NOTICE [pfBlockerNG] Starting cron process.
Sep 14 01:41:14 pfSense kernel: sonewconn: pcb 0xfffff800214e0000 (192.168.1.1:53 (proto 6)): Listen queue overflow: 385 already in queue awaiting acceptance (1 occurrences), euid 0, rgid 0, jail 0


root: netstat -Lan | grep "\.53"
tcp6      0/0/256                          ::1.53                 
tcp4      0/0/256                          127.0.0.1.53           
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp6      0/0/256                          fe80::2e0:67ff:f.53    
tcp4      0/0/256                          10.254.0.1.53          
tcp4      0/0/256                          10.252.0.1.53          
tcp4      0/0/256                          10.251.0.1.53          
tcp4      0/0/256                          192.168.10.1.53        
tcp6      385/0/256                        2600:1700:10b0:d.53    
tcp4      385/0/256                        192.168.1.1.53       

You can see below that most days the cron run goes off without a hitch but once every 7-10 days unbound refuses to restart cleanly:

grep -E 'Syncing|Reloading|Unbound|CRON' /var/log/pfblockerng/pfblockerng.log

CRON  PROCESS  START [ v3.3.4 ] [ 09/1/26 01:00:00 ]
Reloading Unbound Resolver (DNSBL python).
Stopping Unbound Resolver.
Unbound stopped in 2 sec.
Starting Unbound Resolver... completed [ 09/1/26 01:00:05 ]
 CRON  PROCESS  START [ v3.3.7 ] [ 09/2/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.7 ] [ 09/3/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.7 ] [ 09/4/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.7 ] [ 09/5/26 01:00:00 ]
Reloading Unbound Resolver (DNSBL python).
Stopping Unbound Resolver..............................
Starting Unbound Resolver.
Stopping Unbound Resolver..............................
Starting Unbound Resolver. CRON  PROCESS  START [ v3.3.7 ] [ 09/6/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.7 ] [ 09/7/26 01:00:00 ]
Reloading Unbound Resolver (DNSBL python).
Stopping Unbound Resolver.
Unbound stopped in 2 sec.
Starting Unbound Resolver... completed [ 09/7/26 01:00:04 ]
 CRON  PROCESS  START [ v3.3.8 ] [ 09/8/26 01:00:00 ]
Reloading Unbound Resolver (DNSBL python).
Stopping Unbound Resolver.
Unbound stopped in 2 sec.
Starting Unbound Resolver... completed [ 09/8/26 01:00:05 ]
 CRON  PROCESS  START [ v3.3.8 ] [ 09/9/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.8 ] [ 09/10/26 01:00:00 ]
Reloading Unbound Resolver (DNSBL python).
Stopping Unbound Resolver.
Unbound stopped in 2 sec.
Starting Unbound Resolver... completed [ 09/10/26 01:00:05 ]
 CRON  PROCESS  START [ v3.3.8 ] [ 09/11/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.8 ] [ 09/12/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.8 ] [ 09/13/26 01:00:00 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.8 ] [ 09/14/26 01:00:00 ]
Reloading Unbound Resolver (DNSBL python).
Stopping Unbound Resolver..............................
Starting Unbound Resolver.
Stopping Unbound Resolver..............................
Starting Unbound Resolver. CRON  PROCESS  START [ v3.3.8 ] [ 09/14/26 05:40:05 ]
 CRON  PROCESS  ENDED
 CRON  PROCESS  START [ v3.3.8 ] [ 09/14/26 05:52:05 ]
 CRON  PROCESS  ENDED

Leading to processes being stuck in a waiting state:

ps -o pid,state,wchan,%cpu,%mem,command -ax | grep '[u]nbound'
31413 I    sbwait     0.0  0.2 /usr/local/sbin/unbound-control -c /var/unbound/unbound.conf status
41507 Is   uwait      0.0  4.8 /usr/local/sbin/unbound -c /var/unbound/unbound.conf
47411 I    wait       0.0  0.0 /bin/sh /conf/kea4_scripts.d/kea2unbound.sh hook_load
47663 I    piperd     0.0  0.5 php /usr/local/bin/kea2unbound --kea-conf /usr/local/etc/kea/kea-dhcp4.conf --unbound-conf /var/unbound/unbound.conf --include-file /var/unbound/leases/l
68064 I    sbwait     0.0  0.2 /usr/local/sbin/unbound-control -c /var/unbound/unbound.conf fast_reload
78110 S    kqread     0.0  0.2 /usr/local/sbin/lighttpd_pfb -f /var/unbound/pfb_dnsbl_lighty.conf

which requires me to kill them and restart unbound manually:

killall -9 unbound-control php unbound
pfSsh.php playback svc restart unbound

This is a problem for me as I have scheduled jobs/tasks/etc that run overnight and rely on a functional DNS server to complete.

Other relevant details I think would be useful:

• Without changing any settings this issue started when I upgraded from ce 2.8.1 to 2.9.
• I implemented a kernel tweak after this issue started to increase my unbound queue limits to no avail from this thread (bumped from 128 to 256 using kern.ipc.soacceptqueue = 1024.): https://www.reddit.com/r/pfBlockerNG/comments/1u399ba/what_is_the_ideal_setup_to_avoid_cpu_spikes_and/
• Unlike the above thread I don't have a large number of lists and/or clients. For DNSBL I only have Ads Basic and a single DOH list. I also have ip blocking with just two lists, an ipv4 and an ipv6 DOH block list. In total I'm only blocking about ~85K domains/addresses. I only have ~100 clients at most.
• My DNSBL settings: https://imgur.com/a/STz4MO1
• My IP settings: https://imgur.com/HEujixY
• I also added kern.threads.max_threads_per_proc = 4096 to the system tuneables just now thanks to a suggestion in my second /r/pfsense thread so we'll see if that has any effect on resolving it.

I have another pfsense box on 2.9 without pfblocker that doesn't have this issue so pfblocker seems to be the culprit but I couldn't say specifically what the problem is. Let me know if there are any additional settings I should check or adjustments I can make.

EDIT: Between the tweaks suggested here and my linked pfsense threads I believe this is resolved. I've made it past 10 days with no unbound hangups. Unless 3.3.9 also introduced code to fix this in which case props to the devs as well.

I am running the new 3.3.4 version and have a few questions for the developers, if I may:

1) Is there a changelog for these releases? If not, will there be at some point?

2) Does this version support the AdBlock-type syntax in block lists, or is that not coming until 4.0?

3) Are there plans to include Allow List support, as there is in Pi-hole?

Edit: Solved:

I tried again, following the instructions at https://pkg.pfblockerng.com/ for the Stable channel - and lo and behold: it works! 😄

--/-/--

Hello,

I was able to install pfBlockerNG 3.3.2 on pfSense Plus 26.07, but the certificate issue made the installation somewhat cumbersome.

Unfortunately, the same issue also affects checking for updates.

• Checking for pfBlockerNG updates through the pfSense webGUI does not work.

• I have to manually check for updates from the shell using:

  sh SSL_CA_CERT_PATH=/etc/ssl/certs pkg update -f -r pfblockerng-stable

This works, but obviously having to do this manually every time is not ideal.

Is there a way to fix the certificate/CA issue so that the Check now function under pfBlockerNG > Software works normally?

Thanks!

I am trying to install 3.3.2 from the new repo but it fails with certificate errors when I try. Any ideas how to fix this?

[26.07-RELEASE][root@PFSENSE-A.home.arpa]/root: fetch -qo - https://pfblockerng.                      github.io/pkg/install.sh | sh -s -- --channel stable
==> Installed boot-time generator hook to /usr/local/etc/rc.d/pfblockerng_repo_g                      enerate.sh
==> Running the generator hook to resolve the conf now
[pfblockerng_repo_generate] INFO: regenerated /usr/local/etc/pkg/repos/pfblocker                      ng-stable.conf -> https://pfblockerng.github.io/pkg/stable/plus-26.07
==> Conf resolved:
    url: "https://pfblockerng.github.io/pkg/stable/plus-26.07",
==> pkg update -f -r pfblockerng-stable (refreshing the pfBlockerNG catalog)
Updating pfblockerng-stable repository catalogue...
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
pkg: https://pfblockerng.github.io/pkg/stable/plus-26.07/meta.txz: Authenticatio                      n error
repository pfblockerng-stable has no meta file, using default settings
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
pkg: https://pfblockerng.github.io/pkg/stable/plus-26.07/data.pkg: Authenticatio                      n error
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
pkg: https://pfblockerng.github.io/pkg/stable/plus-26.07/data.tzst: Authenticati                      on error
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
pkg: https://pfblockerng.github.io/pkg/stable/plus-26.07/packagesite.pkg: Authen                      tication error
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
Certificate verification failed for /C=US/O=ISRG/CN=Root YR
10B0463C8D230000:error:0A000086:SSL routines:tls_post_process_server_certificate                      :certificate verify failed:/var/jenkins/workspace/pfSense-Plus-snapshots-26_07-m                      ain/sources/FreeBSD-src-plus-RELENG_26_07/crypto/openssl/ssl/statem/statem_clnt.                      c:2125:
pkg: https://pfblockerng.github.io/pkg/stable/plus-26.07/packagesite.tzst: Authe                      ntication error
Unable to update repository pfblockerng-stable
Error updating repositories!
install.sh: /usr/local/sbin/pkg update -f -r pfblockerng-stable failed — the cat                      alog was not refreshed. Repo 'pfblockerng-stable' is unreachable or serving an u                      nreadable catalog. Inspect with: /usr/local/sbin/pkg -d update -r pfblockerng-st                      able

Threatgate is described as the evolution of pfblockerng. I am curious if bbcan was involved in this project, and what it means for pfblockerng with its unresolved issues.

Hi everyone,

I’m having a problem with the UT1 blacklist in pfBlockerNG-devel and I’m trying to understand if this is just affecting my setup or if the UT1 feed currently configured in pfBlockerNG is outdated.

My setup:

- pfSense CE 2.8.1

- pfBlockerNG-devel 3.2.14_2

- DNSBL Category enabled

- UT1 enabled

- Selected UT1 categories:

ddos

malware

phishing

publicite

redirector

The problem is that the UT1 download keeps failing.

This is what I’m currently seeing in /var/log/pfblockerng/extras.log

Download Process Starting [ 08/10/26 05:00:00 ]

/var/db/pfblockerng/ut1.tar.gz cURL Error: 67

Access denied: 530 Retry [1] in 5 seconds...

. /var/db/pfblockerng/ut1.tar.gz cURL Error: 67 [ 08/10/26 05:00:06 ]

Access denied: 530 Retry [2] in 5 seconds...

. /var/db/pfblockerng/ut1.tar.gz cURL Error: 67 [ 08/10/26 05:00:11 ]

Access denied: 530 |/var/db/pfblockerng/ut1.tar.gz|ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz| Retry [3] in 5 seconds...

.. Unknown Failure Code [530]

Failed to Download ut1.tar.gz

Download Process Ended [ 08/10/26 05:00:16 ]

The rest of pfBlockerNG seems to be working normally.

For example, the GeoIP/ASN downloads complete successfully with 200 OK, so this doesn’t look like a general connectivity problem on my pfSense box.

Looking further back in extras.log, this also doesn’t seem to be a one-time issue.

At the end of June I was already getting FTP 530 errors with UT1.

Then, for quite a while during July and early August, the UT1 scheduled job was ending with:

Unknown Failure Code [221]

and now it has gone back to the more explicit:

cURL Error: 67

Access denied: 530

The UT1 feed currently configured by pfBlockerNG on my system is:

ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz

I checked the current UT1 site and the blacklist service itself still appears to be alive.

They now provide the blacklist through HTTP/HTTPS, including:

https://dsi.ut-capitole.fr/blacklists/download/blacklists.tar.gz

So I’m wondering if the FTP URL still used by pfBlockerNG is simply outdated.

I also checked the current pfSense FreeBSD-ports source for pfBlockerNG-devel and, unless I’m missing something, even the newer package still seems to reference the old FTP URL.

There also seems to be some special handling in pfblockerng.php to rename the UT1 download to ut1.tar.gz, which is tied to the old FTP URL.

Before changing anything manually, I wanted to ask here.

Is anyone else currently seeing this problem with UT1?

And if so, is the correct fix simply to change the UT1 feed from the old FTP URL to the current HTTPS URL?

I was considering changing:

/usr/local/pkg/pfblockerng/ut1_global_usage

from:

ftp://ftp.ut-capitole.fr/pub/reseau/cache/squidguard_contrib/blacklists.tar.gz

to:

https://dsi.ut-capitole.fr/blacklists/download/blacklists.tar.gz

But I’m not sure if anything else needs to be changed because pfBlockerNG appears to expect the file to be called ut1.tar.gz.

I’d rather confirm the intended fix before modifying package files manually.

Thanks!

My HaGeZi_Pro feed in pfBlockerNG started failing recently.

Initially, it threw a 404 Not Found because the old direct URL structure (/domains/pro.txt) changed on GitHub.

After updating the URL to the new path, pfBlockerNG downloads the file (200 OK) but fails during compilation with:

I have the feed set to Auto format in DNSBL Source Definitions. Other Hagezi feeds are updating fine with Auto.

anywone know why its suddenly broken?

Android devices are showing this error. IOS doesn't seem affected, although I don't use them as much.

Any ideas on how to fix this? Searched but no solutions were found, just other users having the same issue.

TIA!

I'm not sure if it's a bug, but my ACME certs failed to update automatically (normally this works without issue)

I've found out that enabling DNSBL even with all feeds disabled will block the required domains completely. I've added them to the whitelist with no change as well.

example urls that are blocked when DNSBL is enabled: doh.pub cloudflare-dns.com dns.google

I did update to the latest pfblockerng package 3.2.14_1 running pfsense 2.8.1-RELEASE

I want to say that this is an issue only since updating to 3.2.14_1 a few weeks ago.

Hi,

I made some adjustments that I was already aware of, and the problem persists. Is there something obvious that I'm missing?

The relevant information follows below.

Problem: CPU spikes, queue overflow, name resolution delays, and overall performance drop when DNSBL is enabled.

Log msg: "Jun 10 12:15:12 kernel sonewconn: pcb 0xfffff800911cea80 (10.0.0.1:53 (proto 6)): Listen queue overflow: 385 already in queue awaiting acceptance (662 occurrences), euid 0, rgid 0, jail 0

• netstat -Lan | grep "\.53"

tcp4 0/0/256 127.0.0.1.53

tcp4 0/0/256 10.0.16.1.53

tcp4 385/0/256 10.0.0.1.53

The kernel queue adjustment was apparently not accepted by the Unbound service, as is the case with most other services.

Proto Listen Local Address

tcp4 0/0/1024 10.10.254.1.80

tcp4 0/0/1024 10.10.254.1.443

tcp4 0/0/256 127.0.0.1.953

tcp4 0/0/256 127.0.0.1.53

tcp4 0/0/256 10.0.16.1.53

tcp4 0/0/256 10.0.0.1.53

tcp4 0/0/1024 *.7445

tcp6 0/0/1024 *.7445

tcp4 0/0/1024 127.0.0.1.3128

tcp4 0/0/1024 10.0.16.1.3128

tcp4 0/0/1024 10.0.0.1.3128

tcp4 0/0/128 172.17.7.10.666

tcp6 0/0/1024 *.80

tcp4 0/0/1024 *.80

tcp6 0/0/1024 *.443

tcp4 0/0/1024 *.443

Environment:

• PfSense CE 2.8.0
• Runnning on VMWare ESXi 8.0
• 8 VCPUs
• 16 GB RAM
• Function: UTM fw, DHCP server, GW .... for until 3.000 mobyle wi-fi users

Kernel tunned variables:

kern.ipc.soacceptqueue=1024, kern.ipc.maxsockbuf=8388608

DNS Resolver Unbound custon options:

• msg-cache-size: 250
• rrset-cache-size: 500
• infra-cache-numhosts: 100000
• outgoing-range: 8192
• cache-min-ttl: 300
• prefetch: yes
• prefetch-key: yes
  
• serve-expired: yes
• serve-expired-ttl: 86400
  

pfBlockerNG-devel 3.2.8

IPV4 Summary : 07 IPV4 Group active group lists (PRI1-5). They do not affect performance.

DNSBL

Mode: Unbound python mode

TLD: Enable

Lists: Torrent, Hagezi_Multi_Normal

Blacklist Category Enabled: UT1 Adult, Dangerous Kit, DDoS,

Gambling/Casino, Warez Downloads

Any suggestions?

Thank you.

Geovane

[edit] found a workaround.
1. horizontal scrolling works reliably when touching the heading row of the group list table.
2. Scrolling sometimes works when touching the body of the table if touching in-between the text/field data elements, and it’s a longer firm touch rather than a quick swipe.

Original Post:

I’m trying to edit a custom dnsbl group from my mobile device, however, the blocklist table format is too wide for the enclosing view and I cannot scroll to the right to expose the edit button control.

Is there any way around this without a laptop?

IOS 26.5
pfSense+ 26.03.1
pfBlockerNG-devel 3.2.16

I'm running pfSense 2.8.1-RELEASE community edition & I just installed pfBlockerNG 3.2.8. It says to go to somewhere I don't see to add the key.

I'm not sure what to do next.

I have a SuperMicro box from around 2010, an X7SPA-HF-D525. I believe this has an Atom D525 Processor (1.8GHz). I upgraded the RAM, I believe to 4GB, which is the max. I recently enabled pfBlocker and noticed webpages will take a long time to load. It is getting pretty frustrating. I am thinking I need to probably look into getting a new appliance for pfSense. I was needing at least 4 ports.

What appliance or hardware would you guys recommend for a small space where a tower or regular sized computer wouldn't fit.

Running VPN and pfBlocker

I am redirecting DNS look ups to external servers back to my pfSense instance, 127.0.0.1. My question is, do these redirected DNS look-ups bypass pfBlocker as they're being sent directly to Unbound , or get captured and filtered by pfBlocker?

So I realize I'm getting around to this late with Shallalist being long dead. Shallalist did not appear in the GUI for DNSBL Categories: Blacklist perhaps it was finally removed but I have a ghost. It is still trying and failing to load on every update. I tried executing the following commands one line at a time through the GUI Execute Shell Commands:

rm -rf /var/db/pfblockerng/shallalist
rm -rf /var/db/pfblockerng/dnsblorig/*shallalist*
rm -rf /var/db/pfblockerng/dnsbl/*shallalist*
rm -rf /var/db/pfblockerng/mastercat
rm -rf /var/db/pfblockerng/masterfile

Force Reload All:pfBlockerNG/Update/Reload/All: still trying to reload shallalist so then I executed the commands:

rm -f /var/db/pfblockerng/shallalist*
rm -rf /var/db/pfblockerng/original/shalla*

Force Reload All:pfBlockerNG/Update/Reload/All: and shallalist is still attempting to load just with a bunch of local file failures.

I have not SSH'd in and poke around to see how much of that was actually necessary. Or what remains but it seems like it might come to that. What is the filepath to the Blacklist database file? Any ideas/pointing in the right direction?

Hi, I am a Firefox user and have pfblocker setup with DNSBL and overall I think it's working as I expect it to, blocked domains resolve to the configured "Virtual IP Address" (ex: 10.10.10.1)

However, with a somewhat recent update to Firefox, when a website tries loading resources from a private IP, it gives me a permission prompt.

https://support.mozilla.org/en-US/kb/control-personal-device-local-network-permissions-firefox

These two features seem at odds with each other... tried using 0.0.0.0 as the IP, but that prevented the pfblocker local webserver from starting up. Any ideas?