Updating pfBlockerNG-devel on 23.09 caused instability. Upgrading to 23.09.1 (w/ 3.2.0_8) solved it.

Gertjan

@GPinzone said in Updating pfBlockerNG-devel on 23.09 caused instability. Upgrading to 23.09.1 (w/ 3.2.0_8) solved it.:

(I did not get an alert that 23.09.1 was available.)

Make this a top priority job : Activate the RSS feed in the pfSense dashboard :

Also : Same source : https://www.netgate.com/blog/tag/pfsense
And on the forum the upgrade of 23.09 -> 24.03 was mentioned a couple of zillion times.

pfSense not proposing 24.03 as an upgrade : check here Home pfSense Software Problems Installing or Upgrading pfSense Software : very first pinned post, or have a look at the several forum posts over there.

Be aware of the golden rule : Never ever update or upgrade or install packages before you have made sure your are on the latest pfSense version.

And probably most important right now : don't go to pfBlockerng 3.2.0_15 yet .... check out the forum first.

sepp_huber

Hi,

the same for me :-((
The webfrontend is unresponsible but i can login via ssh.
How can i upgrade to 23.09.1 via console?
If I select " 13) Update from console" it reports everything is up to date.

"pkg remove pfSense-pkg-pfBlockerNG-devel" hangs as well to "Loading Package instructions"
Any ideas?

Gertjan

@sepp_huber

See here.

sepp_huber

@Gertjan Thx, this saved my a... ;-)

Strange thing
Btw. I am on a 2.7.2-RELEASE with everything up to date ... and the package upgrade notification has reported:
"
09:30:08 The following updates are available and can be installed using System > Package Manager:

pfBlockerNG-devel: 3.2.0_8 ==> 3.2.0_15
"

I think the problem was the DEVEL version of the package, we are running this for years without any issues.

GPinzone

Point of clarification to my OP that I just figured out: I installed pfBlockerNG-devel 3.2.0_15 when using 23.09. Installing 23.09.1 rolled it back to 3.2.0_8.

@Gertjan said in Updating pfBlockerNG-devel on 23.09 caused instability. Upgrading to 23.09.1 (w/ 3.2.0_8) solved it.:

And on the forum the upgrade of 23.09 -> 24.03 was mentioned a couple of zillion times.

pfSense not proposing 24.03 as an upgrade : check here Home pfSense Software Problems Installing or Upgrading pfSense Software : very first pinned post, or have a look at the several forum posts over there.

I checked the pinned posts and don't see any warnings about installing 24.03. I see it offered on my System Update, but I'm afraid to touch anything right now.

Gertjan

@GPinzone said in Updating pfBlockerNG-devel on 23.09 caused instability. Upgrading to 23.09.1 (w/ 3.2.0_8) solved it.:

any warnings about installing 24.03.

There are no "warnings about 24.03".
If there were, it's more like this "you use 23.09 ? Then upgrade to 24.03 asap".

When you see this :

you know when (a couple of minutes ago) the last check was made and that it was successful.

This setting :

should be set (and kept on !) "Current stable".
If you pin-point it to 23.09 (after 24.03 came out) then you will stay on "23.09" and it will show : "up to date".

GPinzone

@Gertjan said in Updating pfBlockerNG-devel on 23.09 caused instability. Upgrading to 23.09.1 (w/ 3.2.0_8) solved it.:

There are no "warnings about 24.03".
If there were, it's more like this "you use 23.09 ? Then upgrade to 24.03 asap".

I thought you were referring to the threads where people who upgraded to 24.03 were having issues and were told to wait until 23.08. None of the pinned threads warn against installing 24.03 (which is now 24.03_1).

Raffi_

I ran into this same exact issue with pfblockerNG-devel update hanging and then the GUI also hanging.

I was able to solve this via SSH. Make sure you close your browser.

ran

pkg delete pfSense-pkg-pfblockerNG-devel

It complained another process was holding it up.

kill <whatever process ID # it complained about>

ran this again

pkg delete pfSense-pkg-pfblockerNG-devel

It got stuck loading something or other like the GUI update.

Opened a second SSH session.

top -aSH

kill <process ID # of the php-fpm process(es) which are at or near 100% CPU usage>

I had three of them I had to kill.

ran this one more time to confirm it was removed.

pkg delete pfSense-pkg-pfblockerNG-devel

If it complains again about a process holding it, kill that again.

Then I was able to login to the GUI and install pfblockerNG-devel no problem.

I'm on 24.03. I checked to see if there was a pfsense update since this behavior is very similar to what happens when you update a package before updating pfsense. I am not seeing any pfsense updates available.

I ended up with the crash report below when I got back into the GUI.

[24-Sep-2024 11:10:26 America/New_York] PHP Fatal error:  Maximum execution time of 900 seconds exceeded in /etc/inc/util.inc on line 3733
[24-Sep-2024 11:12:31 America/New_York] PHP Fatal error:  Maximum execution time of 900 seconds exceeded in /etc/inc/util.inc on line 3733

jc1976

these are the clearest problems thus far on remedying this problem..

Thank you for providing them.

I had this issue last night, although i'm on ce 2.7.2. do you think that'll matter?

at the moment i get an nginx 502 error when i try to go to the pfsense gui. is that what you experienced as well?

Raffi_

@jc1976 yeah I had the same error. My steps fixed that.

stephenw10

The pfBlockerNG development pkg has now been updated to remove that issue. 3.2.0_17 is safe to upgrade to.

Raffi_

@stephenw10 thanks for the tip.
It seems like 3.2.0_17 is the version the GUI ended up installing after having all this trouble and going through the steps outlined.

jc1976

@Raffi_

THANK YOU THANK YOU THANK YOU!!

that worked.. took a bit of figuring out, dunno how you only had 3 php processes holding you up because I had 20+, but it worked!!

once i got into the gui i was able to go to the package manager and run the install of 3.2.0_17 and that went through without a hitch..

thankfully, all my configs were still there so when it installed, all came back without any interaction from me..

thanks again!

jc1976

@stephenw10

i have another firewall that i manage and it shows the update to 3.2.0_8..

obviously i want to skip that upgrade.. is it possible to upgrade directly to 3.2.0_17, bypassing 3.2.0_8 so I don't have to deal with it's problems?

stephenw10

3.2.0_8 is OK. That's the package version for the non-devel package.

The problem versions were _15 and _16 but that was only ever the development package. Neither of those should be available anywhere now. You should only see no update for non-dev or _17 for the devel.

jc1976

@stephenw10

I use the dev version on both firewalls. both firewalls have the same configuration and the one that blew up on me was for _8.

as of this moment, looking at installed packages, mine says it's on 3.2.0_8, with a prompt to update.
this was the same on my other firewall that i had to repair.

i don't see anything to indicate the update would be to 3.2.0_17.

am i reading this wrong? I always thought the version shown in the package manager is the version it would be updated to.

my fear is that being this is my firewall at my office that many others are dependent on, i can't risk the downtime so i just want to be sure that it will update to the latest repaired version without any issue.

thanks!!

stephenw10

Well the safest option is to do nothing. Just don't update it.

If you mouse-over the update symbol in the package manager it shows what version is available:

Screenshot from 2024-09-25 16-19-16.png

jc1976

@stephenw10

ahh, didn't know about the mousing-over part.. so yeah, i see it..

Thanks!!

Raffi_

@jc1976

my fear is that being this is my firewall at my office that many others are dependent on, i can't risk the downtime so i just want to be sure that it will update to the latest repaired version without any issue.

lol I had this issue on the office firewall when I first ran into it. I can assure you there was no downtime. Everything still worked as intended including my OpenVPN for remote access. Just the GUI access and the pfblocker update was an issue. I'm not entirely sure if pfblocker was still functional during this time, but that was really not a big deal if it was down for the few minutes it took me to resolve this issue. Pfblocker was back up after the update and then force reload.

tordini

@Raffi_ Thx, thx and thx for your advice, This saved my day. I didn't use ssh but the built in command promt. Killed every pid associating with "pkg delete yes pfSense-pkg-pfblockerNG-devel" and finally
I could use the dashboard again. What a relief, and the package was removed from package manager.
Now I installed the none dev version of pfblock. It's been two days of nervousness since my firewall is in a production environment. Many thx Raffi_, my command vas kill pid_nr & pkg delete --yes pfSense-pkg-pfblockerNG-devel. I created an account here on netgate only to express my gratitude.