pfSense » pfSense Packages

If you can easily reproduce this, try the following patch (path strip=1):

diff --git a/usr/local/pkg/pfblockerng/pfblockerng.inc b/usr/local/pkg/pfblockerng/pfblockerng.inc
index 1f5aceef7ee6..b3e9b11989ff 100644
--- a/usr/local/pkg/pfblockerng/pfblockerng.inc
+++ b/usr/local/pkg/pfblockerng/pfblockerng.inc
@@ -171,7 +171,13 @@ $pfb['curl_defaults'] = array(  CURLOPT_USERAGENT  => 'pfSense/pfBlockerNG cURL d
                                CURLOPT_FRESH_CONNECT   => true,
                                CURLOPT_FILETIME        => true,
                                CURLOPT_TCP_NODELAY     => true,
-                               CURLOPT_CONNECTTIMEOUT  => 15
+                               CURLOPT_CONNECTTIMEOUT  => 15,
+                               CURLOPT_AUTOREFERER     => true,
+                               CURLOPT_MAXREDIRS       => 10,
+                               CURLOPT_HTTP_VERSION    => CURL_HTTP_VERSION_NONE,
+                               CURLOPT_FORBID_REUSE    => true,
+                               CURLOPT_SSL_ENABLE_ALPN => true,
+                               CURLOPT_SSL_ENABLE_NPN  => true,
                                );

 // RFC7231 HTTP response codes

Jim,

With your patch applied the download completes in about 5 seconds, so it solves the issue. But note that there are additional cURL options specified in /usr/local/www/pfblockerng/pfblockerng.php (starting at line 361). I haven't had time to parse the code there to see if the changes in the patch will conflict with any of the additional cURL options specified there, but with respect to the MaxMind download specifically it works fine.

Steve Wilson wrote in #note-2:

Jim,

With your patch applied the download completes in about 5 seconds, so it solves the issue. But note that there are additional cURL options specified in /usr/local/www/pfblockerng/pfblockerng.php (starting at line 361). I haven't had time to parse the code there to see if the changes in the patch will conflict with any of the additional cURL options specified there, but with respect to the MaxMind download specifically it works fine.

The way that pfblockerng.php sets its options, it applies the defaults first and then sets its own. I don't see anything in there that would conflict, and even so, it would overwrite the "default" option with its own the way it's coded there. So if it works I'll go ahead and commit it for now since it's affecting quite a few people. Can always back it out if need be.

This change fixed two issues I have seen with pfB since moving to 23.01: 1) slow MaxMind downloads; 2) slow block list downloads. Thanks!