pfBlockerNG with RAM Disk

anthonys

I am considering implementing RAM Disk on an existing environment that includes pfBlockerNG.

I have never tried RAM Disk, and in reading my very first thoughts are:

Should pfblockerng be installed before, or after, RAM Disk is enabled?
Once set up, are there any issues with rebooting pfsense? (note, I have UPS, so power failure shouldn't be an issue).

I have done an inital test, and I have a good idea of the RAM Disk size required (for the lists I use), but I plan to experiment and test in more depth in a non-prod environment. Asking here for any insight or experiences from others on the above or any other issues or gotchas that await.

provels

@anthonys Used to be that the pfB lists were lost on a reboot and a reload had to be manually run when the system came up again, but I think that now all of /var is written to disk before shutdown/reboot. I'm using RAM disks and running very large lists like the porn categories without issue, but I also have 16GB. As far as when to create the RAM disks, the system doesn't care ("put /var here, put /var there, I don't care").
HTH

EDIT - I may be mistaken about /var being written to disk. I just rebooted, /var size went way down, then rose after manually running a pfB reload.

SteveITS

@anthonys I know the "adult" (UT1?) list in pfB takes more than 1 GB of space to download and process, because I added it to help someone in the forums and it overran the RAM disk.

Other than that, no issues using pfB. pfSense handles what to copy where.

In recent versions the RAM disk size is not preallocated, it's a maximum RAM usage depending on the space actually used. A RAM disk does need a reboot to enable or change sizes.

provels

@SteveITS said in pfBlockerNG with RAM Disk:

In recent versions the RAM disk size is not preallocated, it's a maximum RAM usage depending on the space actually used.

So the RAM disks are "thin provisioned" like in a virtual environment? If so, I did not realize that.

SteveITS

@provels They changed the method a couple versions ago. It isn't really documented as such but that's a feature of tmpfs. (I suggested that doc change but it was declined because it could use all the allocated RAM)

https://docs.netgate.com/pfsense/en/latest/releases/22-01_2-6-0.html#operating-system
Changed: Convert RAM disks to tmpfs #12145

edit: https://www.reddit.com/r/linuxquestions/comments/fjxiv2/does_tmpfs_ramdisk_use_up_allocated_ram_even_when/