pfBlockerNG sync not working

planedrop

@IT_Luke I'd recommend swapping over to the non devel version, which does have the fix applied like @SteveITS mentioned.

I did want to note something though, for me the fix had to both be applied by updating pfBlocker, and then I also had to reinstall pfBlocker on both HA nodes to get the sync to work again (keeping settings so it really was just clicking the reinstall button in the package manager). Been perfect ever since but a little odd it required that.

IT_Luke

@planedrop I think I'll wait until the Redmine gets processed/picked up - I have no problems after manually patching the .inc (again), my HA installs sync fine after so no worries. In the event of another pfBlockerNG-devel update I know what to check so it's not a big deal, it's a very fast manual fix. If in the end the devel branch gets "left behind" I will uninstall and reinstall the "normal" branch. Cheers anyhow!

planedrop

@IT_Luke Totally get ya on this. If it's useful, I was running devel and reinstalled non-devel on about 8 firewalls and it went super smooth, settings were kept, basically didn't even know it changed. Not as encouragement to do so, just that if you come to the conclusion you need to, should be pretty simple/fast/easy.

shabsta

subbed to the thread in the hopes that an update will be posted here when this has been resolved.

planedrop

@shabsta The issue is resolved in the latest pfB release, you'll have to do a reinstall of the package on all HA nodes for the fix to actually work though.

shabsta

@planedrop said in pfBlockerNG sync not working:

ou'll have to do a reinstall of the package

I disabled and reinstalled pfBlockerNG on second pfsense server and this resolved the issue, thank you.

SteveITS

I ran into a sync issue today.

23.05.1, pfB 3.2.0_5 - found changes didn't sync, or at least show in the GUI, with the patch, without the typo.
Restarted router2, same.

Upgraded both to 23.09.1, pfB 3.2.0_7. As part of that, uninstalled pfB and reinstalled after.
Same, a description wouldn't sync.

Reinstalled the package on router2 (via the button on the Installed Packages page), no sync.

I ran a Force Reload on router1 which then got the changes to show on router2.

In hindsight this sounds more like linked issue https://redmine.pfsense.org/issues/12918 (pfBlockerNG-devel changes from xmlrpc sync do not take effect immediately ...until cron job is run on router2).

planedrop

@SteveITS I thought this delay was normal, my understanding was we had to wait for a reload to happen before things would sync to the other side, maybe I'm wrong?

SteveITS

@planedrop That would be very unlike all the other package config syncs. Given the Redmine which labels it a regression, it seems like it’s just not been working. IOW the sync ought to trigger a reload if anything changes. Otherwise a failover could, say, cut off admin access because an alias doesn’t exist.

IT_Luke

@SteveITS @planedrop From my experience with pfB, I have always triggered a force reload whenever a major change has occurred on the master node (interface changes or similar in config) - this always ensured the secondary has all the changes. I then verify on the slave node if this is the case. Whenever there is a pfB update or a release update I trigger a reload (not necessarily forced) as the pfB state appears often yellow and that sorts it. I see "config replicas" being pushed only at cron update time or manual update. As the pfB XML sync is triggered hourly I don't see how any interim config change would immediately trigger a sync to the slave - it has never happened in my case at least and I believe this to be the normal behavior as this sync is handled in a complete seperate and indipendent way than the HA sync which does get automatically pushed at every config change. If you do make a modification to any list or rule in pfB and the node goes down before the hourly trigger, that list mod is not replicated to the slave(s). In any case, after any release update or pfB update, I always have issued a forced reload as pfB is reported in a "yellow" state. Regarding the typo patch, I have had to uninstall and reinstall pfB-devel and force reload after again patching on the master node to get it to sync to the slave again as somehow it was not picking up the config change (?!) - but this happened only on one HA pair.

On an additional note regarding the CARP interface selection in pfB which I have stated elsewhere too: when selecting the CARP interface in pfB (so not the default VIP), it is configured as a /32 IP. BSD does not really like this as the iface is not really "up" until you reboot - only then it appears listed properly in the CARP ifaces (else it neither is master nor slave, it's a ghost). However if you manually set the iface as a /29 for ex, it immediately goes up and is properly reported. However on every pfB hourly trigger it reverts to a /32 as this is what is specified in the .inc file (yes I did edit it and that works too). It is not a major issue as after a reboot once it goes up as a /32 it stays up, but maybe it is probably better to assign it a /30 or /29 subnet (how many nodes can one have?) so BSD is happy (being a CARP iface it is advertised as such and it's state is seen by the other node...).

SteveITS

I had to rediscover this today. Non-devel version, 3.2.0_7.

For me:
Force Reload on router1 does sync.
Force Update on router1 does not sync.

and
The XMLRPC timeout won't save if it's set to a value over 150 (it reverts it to 150): https://redmine.pfsense.org/issues/15158

and
The XMLRPC Replication Target is required even if not using it: https://redmine.pfsense.org/issues/15159

planedrop

@SteveITS This is good info to have, thanks.

And meant to respond to your original thing from a month ago, my bad.

Agreed it a sync should trigger the reload if there are changes, seems pretty critical.

IT_Luke

@SteveITS It was my understandng that only the force reload would sync to secondary (and of course the hourly cron event), at least that's how it has been behaving for me for the last few years. A Force update would never sync. This was in fact an abnormal behavior in my opinion due to exactly what you pointed out, but I thought it was like that "by design" (and initially got me baffled).

fmroeira86

I'm on 3.2.0_7 pfBlockerNG-devel

Do we still need to apply the fix on the "patcher"?

It looks like it won't sync without it...

juliokele

@fmroeira86 on 3.2.0_7 pfBlockerNG-devel: yes

planedrop

@fmroeira86 Yes you do, probably best to swap to non devel though.

fmroeira86

@planedrop

Are there currently differences between the devel version and the normal version? I recall there were some years ago. If I decide to switch to the normal version, what procedure should I follow to ensure the continuity of settings?

Thank you so much!

SteveITS

@fmroeira86 AFAIK the only difference right now is the typo fix mentioned above.

You can just uninstall devel and install normal to change.

https://docs.netgate.com/pfsense/en/latest/releases/23-01.html
“The pfBlockerNG package has been updated to match pfBlockerNG-devel. After upgrade it is safe to uninstall pfBlockerNG-devel (keeping settings) and install pfBlockerNG instead.”

fmroeira86

@fmroeira86 said in pfBlockerNG sync not working:

@planedrop

Are there currently differences between the devel version and the normal version? I recall there were some years ago. If I decide to switch to the normal version, what procedure should I follow to ensure the continuity of settings?

Thank you so much!

Thank you!

Just swaped to the regular version without any problem only by installing it.

It did uninstall the devel version and all configurations remained untouched :)

Cheers!

planedrop

@SteveITS Just wanted to note I finally got around to testing this in regards to syncing and learned the following:

Update and Cron on Firewall 1 does not sync
Update, Cron, and Reload on Firewall 2 does not sync
Reload on Firewall 1 does sync

So, basically as you said, a force reload must happen on Firewall 1 to get the sync to happen.