Hello community,
I am running pfsense on a proxmox VM.
Hardware:
CPU: i7-8700k (6+6 cores)
RAM: 32GB DDR4
MOBO: Asus Maximus Hero X (onboard lan disabled)
NIC: X550-T2
PFSENSE: latest version: 2.7.2-RELEASE (amd64)
Basic config:
2x Interfaces vtnet (X550-T2)
4x VLANs
Everything has been working fine and I managed to separate devices inside my network which was my goal.
Suricata:
I set it up using youtube videos like everything else. I initially setup suricata for each interface and vlan separatelly, just to test since my pc has only this VM running for testing (resources should not be a problem).
I selected all rules and let it only alert without blocking anything for a week.
After that period I started switching each interface to INLINE IPS and choosing rules to drop. Mostly every BAD IP REPUTATION rule. And they were dropping a lot of stuff.
Today I had 5 interfaces enabled with INLINE IPS (LAN, WAN, 3x Vlans). And I was very happy with the results.
Problem:
I was then trying to forward a port for a NAS in my network and the router stopped working. No internet, no connection to other users. Only proxmox was still reachable.
I went to console and saw this through proxmox:
1dab842e-2a9b-4ad1-9edc-41a311df0733-pfsense-crash.jpg
Failed to replenish seemed like a memory leak. I restarted the VM and watched it. I was thinking of restoring to a backup, but the error came very fast again. This time I saw a "swap_pager: out of swap space" before the "Failed to replenish" error took over the screen again:
67a8f57a-d8ac-4f05-92c2-a505311ceaad-pfsense-crash2.jpg
I read online on my cell phone and someone was talking about suricata using too much ram and filling swap. So I increased RAM to 30GB and gave 10 cores to pfsense. But the error still came every time after only a few seconds.
I managed to "Halt system" from the console after restart and it stopped suricata. I logged in and disabled all interfaces inside suricata.
If I start more than 1 again, the error comes really fast.
I tried monitoring "System Activity" when reproducing the error and swap was always at 1024M Total, 1024M Free. RAM was at 1,5GB Active and that is still very far from full.
This is what it looks like now without Suricata:
428161b6-e630-4157-aac4-126373c9f71c-image.png
I am suprised with the number of threads sleeping and waiting. Other than that I don't understand where the problem came from. And why it keeps happening.
I would appreciate any help at all, as well as any answers to the questions I have upfront.
How do I stop Suriticata from loading together with pfsense? When I restart pfsense I don't want it to run automatically.
What are commands that I can use to monitor the system while reproducing the error?
What kind of information can I provide more to help find the cause of the problem?
Why are there so many threads with the same PID and should I kill them? How?
17059e83-ee5b-472a-bdf1-87c2673afaf1-image.png
d8b451fc-497d-407c-9b8c-93dae187de0c-image.png
33384924-8173-4082-916d-a68b8c0848a1-image.png
Thanks in advance!
Bruno