Re: blacklistd vs blocklistd
Doug Hardie <[email protected]>
| Newsgroups | gmane.os.freebsd.questions |
|---|---|
| Message-ID | <[email protected]> |
> On Feb 9, 2026, at 07:55, Dag-Erling Smørgrav <[email protected]> wrote: > > Doug Hardie <[email protected]> writes: >> I switched back to blocklistd, but the previous blacklistd entries >> show with blocklistctl, but pfctl only finds 5 entries whereas before >> there were over 800. Also, I previously was seeing around 80 new >> blocking entries added every hour. Now I am seeing 2 in the pf >> tables. > > Switching from one to the other changes the name of the pf anchor. Did > you update your pf.conf accordingly, and are you sure you're looking at > the correct anchor and table? For instance, if running blocklistd, you > would use the following command to see blocked IPs: > > sudo pfctl -a blocklistd/22 -t port22 -Ts The current values are: mail# pfctl -ablocklistd/587 -tport587 -Ts | wc -l 406 mail# pfctl -ablocklistd/25 -tport25 -Ts | wc -l 141 However, there are 900 entries in blocklists table. All of them are prior to switching to blocklist. Since then, everything is working properly. It's just that the preexisting entries never got put into pf even though I got hundreds of pf messages that I was adding an existing IP to the table. In about 9 hours, all of the missing entries will have been deleted from blocklist as they expire. -- Doug