pfSense 2.6 issues

pando85

Hello,

I updated to 2.6.0 and now I cannot access GUI or ssh. Also, other services that I had exposed cannot be accessible now.

It seems that my firewall rules are gone :(

pando85

@pando85 said in pfSense 2.6 issues:

Hello,

I updated to 2.6.0 and now I cannot access GUI or ssh. Also, other services that I had exposed cannot be accessible now.

It seems that my firewall rules are gone :(

Ok, my problem was related with a clean up that I did last week removing "unused" groups. I removed wheel group and that broke my upgrade: nginx coudn't start and I don't know why but ssh was not working either.
I fixed it recreating the group manually, restarting webConfigurator and php and then creating again the group via GUI.

For creating the group again:

pw groupadd wheel

All is up and running again.

UmbraAtrox

One minor issue i had was ending up unable to enter the correct password for ZFS.

I did a reinstall for ZFS, i set the correct keymap and tested it by entering the intended password and trying if Z and Y are in the correct place which they were but on first boot i couldn't enter the correct password probably because keymap, the password wasn't hugely complicated so i am certain i entered it correct but it had symbols in it. I workarounded it by not using encryption.

Would be nice if there was a failsafe where on X wrong attempts you get the option to enter a line which does get echoed so one can verify the keymap and pressing Enter returns the user back to the password prompt.

Enter boot password:
Password wrong do you want to test keymap (y/n): y
Press keys to echo, press Enter to return to password prompt: fh"!fg$u/s
Enter boot password:

I don't know if that's possible or even safe but would have helped.

johnpoz

@umbraatrox said in pfSense 2.6 issues:

not using encryption.

Using encryption to be able to even boot your firewall seems like an overall just bad idea to me - if you have power issue, internet is down until someone can console on the firewall and put in a password.. This seems pretty counter productive to me..

Jaltus

Hello,
Upgrade Backup member of cluster 2.5.2 to 2.6.0 seems ok but connexion to gui failed
services seems to be up.
After pfctl -d can connect to gui.
Restore backup config doesn't change anything.

Package : Acme, Snort, service-watchdog, open-vm-tools, zabbix-agent5
No upgrade of package before upgrade to 2.6.0

So I stop upgrade of cluster until this problem is corrected.

Is there someone with the same issue?

stephenw10

You see any errors? If you can't access it but disabling the firewall completely allows it that implies the rules are not loading as expected.

Steve

Jaltus

@stephenw10
hello,
no errors, and no response. seems request are just drop
when firewall is off, I can see all rules.
Which process load rules is there a log of this ?

stephenw10

At the console try manually loading the rules with:

pfctl -f /tmp/rules.debug

Any errors will be shown.

Do you see your own traffic blocked in the firewall log? What rule was blocking it?

Steve

Jaltus

@stephenw10
Hello,
Thanks for your help.
Rules load with no errors.
Traffic is blocked by default rules.
HA Sync doesn't work, but with primary in 2.5.2 and backup in 2.6.0. perhaps it's normal. I use LAN interface for this not a dedicated one.

I can access WEBGUI, if I define a rule for incoming on LAN int.

Before in 2.5.2, I have just one rule on OPT1 for "admin PC" on OPT1 --> "pfsense IP" on LAN 443
I can access pfsense on his 2 IP (opt1 and LAN)
Now, I can only connect to opt1 IP (same subnet). I also need a rule on LAN interface ("admin PC" on OPT1 --> "pfsense IP" LAN 443) to connect to LAN IP

Is there any change on this with upgrade ?

Best regards

stephenw10

That's expected, config sync will not work between different versions.

There have been no changes to how the rules are applied. If you are connecting from a client on the OPT1 interface you would only need a rule on OPT1 to allow that.

What might have changed is the interface ordering. Perhaps you have a NIC that wasn't supported in 2.5.2 and now is in 2.6.
Make sure your admin client is actually getting an IP in the OPT1 subnet.

Steve

Jaltus

@stephenw10
After upgrade of master, everything is ok.
After review screenshot of number in pfsync node, PF was not well synchronize before upgrade.

Thanks a lot for your help

KpuCko

Hmmm, to be honest I really don't know where to start...

Ok, let's not complain about some missing files, probably this can be ignored safely, but - DEINSTALL script failed, IMO is a problem, because I expect to have some left overs from the last stable version, anyway.

The device rebooted successfully, so I had a hope, unfortunately my hope disappeared almost immediately when I logged to the dashboard, I started getting errors:

When I checked the logs I saw such errors appear over and over again:

/rc.filter_configure_sync: The command '/sbin/pfctl -Of /tmp/rules.limits' returned exit code '1', the output was 'pfctl: DIOCSETSYNCOOKIES'

This made me a bit angry, I really got angry when I noticed that I'm unable to go to the internet anymore. The appliance is able to connect to the Internet, but all of the networks are unable, so this is a problem in the core firewall function.... really sad

Beside that I also noticed that my CPU hardware crypto support simply disappeared:

Then with non working production firewall, I had no choices - I decided to go back to the old version. When I went to update tab and selected the old stable branch, the check said - you are using newer version, so no way back, really?!!

My last option was to try to go upper - 2.7.0-devel but I just wanted to see if the issues about the internet has fixed. Well, not really:

There were error(s) loading the rules: pfctl: pfctl_rules - The line in question reads [0]: @ 2022-03-19 16:11:15

stephenw10

Those errors during the upgrade are expected and not an issue.

Re-installing is the only (supported) way to go back to 2.5.2.

What is in /tmp/rules.limits though?

Steve

KpuCko

@stephenw10 I don't know, and can't check because I already reverted back to 2.5.2

I suppose it is something related to pfBlockerNG but who knows.

I tried to remove the package, but this haven't resolved the issue.

stephenw10

What's in the file 2.5.2 then?

I'm not aware of anything than would have changed there but you might have something obscure set.

Steve

KpuCko

@stephenw10 said in pfSense 2.6 issues:

What's in the file 2.5.2 then?

I'm not aware of anything than would have changed there but you might have something obscure set.

Steve

stephenw10

Did you set that state table size or just have a lot of ram?

KpuCko

@stephenw10 said in pfSense 2.6 issues:

Did you set that state table size or just have a lot of ram?

I have 16g of ram

KpuCko

So guys, how to make it more official?
I mean, look at the big post I have created, I have few issues mentioned in there.

Do I need to file a bug report, or as I'm a free user, someone else has to do that?

stephenw10

Anyone can open a bug report: https://redmine.pfsense.org/

We need clear steps to recreate it though and I don't think we have that yet. I've updated numerous devices from 2.5.2 to 2.6 and never hit this and I don't see and other reports of it. There must be something unusual in your ruleset that it hitting an issue.

Can we see your ruleset? (/tmp/rules.debug)

If not can you generate another ruleset that still hits this?

Are you using any obscure features?

Steve