pfSense

A bit of relevant discussion at http://forum.pfsense.org/index.php/topic,66300.0.html

I just ran into this problem, and I'd consider it a bug that needs to be fixed, not a feature request. I was using an alias to contain a list of hosts (given as FQDNs) to block (coincidentally, exactly the example given at https://doc.pfsense.org/index.php/Aliases). I needed to unblock a host, so I removed it from the alias, and clicked the button to update the rules. I thought I might have to wait a while for the update to take effect, but a half hour later, it was pretty clear that it wasn't going to happen. So I started poking around and found that 'pfctl -T show -t Blocked' still had all the original IPs in it, even though /var/etc/filterdns.conf had been updated.

Clearly I'm running into the same "feature" described above, but from my perspective it sure seems like plain old brokenness. I didn't want to file a separate bug report right away though, since the issue is already recorded here.

I just double-checked this now that 2.1-RELEASE has been out an running for ages. I have a table of the IPs of all my organisation offices, which are dynamic and the ISPs concerned seem to reset things regularly, so the dynamic public IPs change often. There will be 15 real current public IPs, so I would like the table to have 15 entries, but the table has now accumulated 1084 IP address entries on a router that has been up for 30 days. So 2.1-RELEASE is definitely accumulating addresses into the table and not removing old ones.
I'm not sure that this behaviour is strictly a bug, since there is no requirement or design spec that I know of that defines what it is required to do :)

Thanks for the confirmation. Sorry, forgot to mention that I'm running 2.1-RELEASE as well.

It seems like a bug to me because, (1) even if the spec doesn't specifically say that removing an FQDN from the alias in the GUI also removes it from the corresponding pf table, the fact that it doesn't is totally counterintuitive that you'd think it would be documented if it were intended, and (2) if you use IPs rather than FQDNs, removing an entry from an alias does remove it from the table (afaict), and other than the five-minute delay for running through DNS, there's no documentation or reasonable expectation that aliases would have such radically different behavior depending on whether you use IPs or FQDNs.

Normally this will be fixed when filterdns supports reloading with TTL of the DNS record.
This will come soon.

I don't see any reason to accumulate addresses at all. DNS A records for an FQDN return all valid addresses at once. It's up to the client to choose which one, usually choosing the first one. The server only mixes up the order each time thus creating a round robin effect since the client almost always uses the first address.

Basically you should wipe out all existing addresses each time you requery.