state counters, firewall rules resetting?

jdeloach

This post is deleted!

tman222

@bigsy said in state counters, firewall rules resetting?:

@johnpoz Do you have the patch for redmine #14016 applied?

I had a problem on 23.01 with pfBlocker IP counters resetting overnight until I applied this. I didn't notice the firewall counters. Something in the default cron jobs must have been resetting it?

Thanks @bigsy for calling out this patch. I have been running into the same issue (pfBlockerNG IP counters resetting overnight) and then noticed similar to @johnpoz that my traffic counters didn't make sense. Applied the patch and will monitor to see if that has hopefully fixed it.

Relevant thread:
https://forum.netgate.com/topic/178107/23-01-periodic-scripts-have-been-re-enabled-and-are-broken/5

johnpoz

@bigsy I think you might of found it, I do have 2 patches installed for state issues

https://github.com/pfsense/pfsense/commit/d9fa4584e3fb63d6051e9f1db7655f931cb1be19.patch

and one I manually applied

diff --git a/blah/usr/local/www/rrd_fetch_json.php b/blah/usr/local/www/rrd_fetch_json.php
index df0401f96e89..4d7574819ac9 100644
--- a/blah/usr/local/www/rrd_fetch_json.php
+++ b/blah/usr/local/www/rrd_fetch_json.php
@@ -226,7 +226,8 @@ foreach ($side as $settings) {
                                $ds = "state changes";
                                break;
                        case "pfnat":
-                               $ignore = true;
+                               $unit_acronym = "";
+                               $ds = "NAT states";
                                break;
                        case "inpass":
                                $ninetyfifth = true;

Looking into the details now.

edit: ok applied ff715efce5e6c65b3d49dc2da7e1bdc437ecbf12 lets see if resets tonight or next couple of days.

stephenw10

Same here. Let's see....

Gertjan

@johnpoz said in state counters, firewall rules resetting?:

edit: ok applied ff715efce5e6c65b3d49dc2da7e1bdc437ecbf12

I had that one already active.
My counter are still good / plausible.

johnpoz

@gertjan nope reset...

WTF???

bigsy

@johnpoz Did you reboot or trigger a rewrite of the cron config after applying the patch per this link?

johnpoz

@bigsy valid point - I did not reboot.. That is the only way to redo the crons? Got to be a better way ;)

ok - I went in and did a save on couple crons, without changing anything... This should of kicked them in, but no I didn't do that after apply the patch. Did that now.. Lets see..

Gertjan

@johnpoz

You have (default I guess) :

I have

Which says : ones a day, at minute 15.
as I'm not trying to update my single DNSBL (ADs_basic) that often - it's actually set to 'Weekly'.

Which means my pfBlockerng tries to actually update my single list ones a week.

I'll do a force update .... nothing changed.

Btw : take note : I have no IP feeds so no pfBlockerng firewall rules what so ever. My floating pane is empty.

johnpoz

@gertjan said in state counters, firewall rules resetting?:

Which says : ones a day, at minute 15.

No not minute - that is hour.

15 is 3pm for non 24 hour clock people ;)

Something lost in translation with the cron setting in pfblocker it seems..

Gertjan

@johnpoz said in state counters, firewall rules resetting?:

non 24 hour clock people ;)

By any chance, are these flat-earthers related ?
I was told a day has 24 hours.

Anyway :

What I make of it : "15 minutes after midnight".
If it's something else : fine to me

bingo600

I just applied the patch

This is my Crontab after applying the patch , but nothing else

Pre-Reroot

/root: vi /etc/crontab

# /etc/crontab - root's crontab for FreeBSD
#
# $FreeBSD$
#
SHELL=/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
#
15      4       *       *       6       root    periodic weekly
30      5       1       *       *       root    periodic monthly
#
# Adjust the time zone if the CMOS clock keeps local time, as opposed to
#
# pfSense specific crontab entries
# Created: March 10, 2023, 7:06 am
#

1,31    0-5     *       *       *       root    /usr/bin/nice -n20 adjkerntz -a
1       3       1       *       *       root    /usr/bin/nice -n20 /etc/rc.update_bogons.sh
1       1       *       *       *       root    /usr/bin/nice -n20 /etc/rc.dyndns.update
*/60    *       *       *       *       root    /usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot
30      12      *       *       *       root    /usr/bin/nice -n20 /etc/rc.update_urltables
1       0       *       *       *       root    /usr/bin/nice -n20 /etc/rc.update_pkg_metadata
*/1     *       *       *       *       root    /usr/sbin/newsyslog
1       3       *       *       *       root    /etc/rc.periodic daily
15      4       *       *       6       root    /etc/rc.periodic weekly
30      5       1       *       *       root    /etc/rc.periodic monthly
*/1     *       *       *       *       root    /usr/local/pkg/servicewatchdog_cron.php
#
# If possible do not add items to this file manually.
# If done so, this file must be terminated with a blank line (e.g. new line)
#

:q!

Same contents after restarting Cron aka no change in the jobs

/root: /etc/rc.d/cron restart
Stopping cron.
Waiting for PIDS: 31184.

I did a "Reroot" , and didn't even loose my webradio stream

Post Reroot
#
# pfSense specific crontab entries
# Created: March 10, 2023, 11:59 am
#
SHELL=/bin/sh
PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin

1,31    0-5     *       *       *       root    /usr/bin/nice -n20 adjkerntz -a
1       3       1       *       *       root    /usr/bin/nice -n20 /etc/rc.update_bogons.sh
1       1       *       *       *       root    /usr/bin/nice -n20 /etc/rc.dyndns.update
*/60    *       *       *       *       root    /usr/bin/nice -n20 /usr/local/sbin/expiretable -v -t 3600 virusprot
30      12      *       *       *       root    /usr/bin/nice -n20 /etc/rc.update_urltables
1       0       *       *       *       root    /usr/bin/nice -n20 /etc/rc.update_pkg_metadata
*/1     *       *       *       *       root    /usr/sbin/newsyslog
1       3       *       *       *       root    /etc/rc.periodic daily
15      4       *       *       6       root    /etc/rc.periodic weekly
30      5       1       *       *       root    /etc/rc.periodic monthly
*/1     *       *       *       *       root    /usr/local/pkg/servicewatchdog_cron.php
#
# DO NOT EDIT THIS FILE MANUALLY!
# Use the cron package or create files in /etc/cron.d/.
#

That cleaned up the crontab file

Seems like this is taken out by the patch

#
15      4       *       *       6       root    periodic weekly
30      5       1       *       *       root    periodic monthly
#
# Adjust the time zone if the CMOS clock keeps local time, as opposed to
#

/Bingo

johnpoz

@gertjan said in state counters, firewall rules resetting?:

I was told a day has 24 hours.

It does 0 to 23 ;)

What version are you on - your cron package looks different than mine.

stephenw10

Ha, same! I can fail to follow instructions like any user.

You should just be able to remove those cron jobs and the patch would prevent them being re-added.

Steve

johnpoz

@stephenw10 haha - yeah I can not follow instructions with the best of them... Users have nothing on me when it comes to not paying attention or missing details that is for sure.

So ELI5 - why wouldn't the patch remove old crons if they are not needed.. So we are suppose to manually remove those daily, weekly, monthly crons?

I went in and saved cron job, and even restarted the cron services - I still how them in the cron package - am I suppose to delete them? And then restart cron?

Gertjan

@johnpoz said in state counters, firewall rules resetting?:

What version are you on - your cron package looks different than mine

On
23.01-RELEASE (amd64)
built on Fri Feb 10 20:06:33 UTC 2023
FreeBSD 14.0-CURRENT

Original pfSense theme.

edit :

This

is from the main pfBlockerng page.

johnpoz

@gertjan ah - not sure why your pfblocker is set to 15 minutes, while mine is set to 15 for the hour..

I think that was what was throwing me - you had 15 in the minute in your cron, but mine is on the hour..

tman222

@tman222 said in state counters, firewall rules resetting?:

@bigsy said in state counters, firewall rules resetting?:

@johnpoz Do you have the patch for redmine #14016 applied?

I had a problem on 23.01 with pfBlocker IP counters resetting overnight until I applied this. I didn't notice the firewall counters. Something in the default cron jobs must have been resetting it?

Thanks @bigsy for calling out this patch. I have been running into the same issue (pfBlockerNG IP counters resetting overnight) and then noticed similar to @johnpoz that my traffic counters didn't make sense. Applied the patch and will monitor to see if that has hopefully fixed it.

Relevant thread:
https://forum.netgate.com/topic/178107/23-01-periodic-scripts-have-been-re-enabled-and-are-broken/5

After a couple of days of monitoring, it looks like the patch did the trick. No more counter resets on pfBlockerNG and traffic totals also look more reasonable.

Gertjan

@gertjan

Partial reset : LAN :

edit : or a total reset of all counters, and IPv6 is 75 % of all outbound traffic