SG-1100 LAN Rules / Aliases missing, control buttons replaced by error messages
-
I have a home setup using a NetGate SG-1100 with PFSense+ (23.05.1-RELEASE (arm64) built on Wed Jun 28 03:57:42 UTC 2023 FreeBSD 14.0-CURRENT). My network connects to the Internet via a PIA VPN and I have bypass rules to allow some network nodes if needed, to connect without VPN.
Attempting to look at those bypass rules in Firewall / Rules / LAN, I noticed that they were missing – also the coloured buttons (Add, Delete, Toggle, etc) were absent, with “CsrfMagic.end()” message present instead. Note that the VPN was still working OK, nodes connected using private VPN IP address.
Searching on the net, I found this page https://www.reddit.com/r/PFSENSE/comments/u0vvan/csrfmagicend_in_firewall_rules_after_upgrade_to/
I edited /usr/local/www/guiconfig.inc, commenting the line “$content .= alias_idn_to_utf8($ap);” Then rebooted.I now have my rules back, but if I go to Firewall / Aliases. I see the following
Name = ASUS_RYZEN (one of my aliases)
Values = Fatal error: Uncaught Error: Call to undefined function idn_to_utf8() in /etc/inc/util.inc:3998 Stack trace: #0 [internal function]: alias_idn_to_utf8('10.1.1.210') #1 /usr/local/www/firewall_aliases.php(164): array_map('alias_idn_to_ut...', Array) #2 {main} thrown in /etc/inc/util.inc on line 3998 PHP ERROR: Type: 1, File: /etc/inc/util.inc, Line: 3998, Message: Uncaught Error: Call to undefined function idn_to_utf8() in /etc/inc/util.inc:3998 Stack trace: #0 [internal function]: alias_idn_to_utf8('10.1.1.210') #1 /usr/local/www/firewall_aliases.php(164): array_map('alias_idn_to_ut...', Array) #2 {main} thrownAll other aliases are absent, no way to delete the bad entry, no other buttons shown
Please advise, thanks
-
@SidTheSalamander I haven’t seen that error so it’s not a normal problem. Have you installed the System Patches package? Or, just upgrade to a more current version of pfSense…?
-
@SidTheSalamander said in SG-100 LAN Rules / Aliases missing, control buttons replaced by error messages:
https://www.reddit.com/r/PFSENSE/comments/u0vvan/csrfmagicend_in_firewall_rules_after_upgrade_to/
You checked the icu package as shown in that thread?
You should just upgrade to the current pfSense+ version though.
-
Thanks for the responses…
I opened a command prompt and tried running pkg upgrade -yf icu – this gave a response ending with:
Number of packages to be reinstalled: 1
[1/1] Reinstalling icu-73.2,1...
[1/1] Extracting icu-73.2,1: .......... done
Followed by reboot, check Firewall / Aliases – no changeAs for pFSense upgrade – my Status / Dashboard page states:
23.05.1-RELEASE (arm64)
built on Wed Jun 28 03:57:42 UTC 2023
FreeBSD 14.0-CURRENT
Version 23.09.1 is available.
Version information updated at Tue Feb 18 14:43:39 UTC 2025If I hit the download icon it whirrs away for a few moments then reports current and latest base version both 23.09.1 Up to date
Thinking I may need to re-image the unit – I once did that about 2 years ago when a software update bricked it, and Netgate gave me a link to a file which I still have, pfSense-plus-compat-recovery-23.01-RELEASE-aarch64.img.gz. I do have an XML backup made a day or two later after I’d laboriously rebuilt my config…
…though I’m no BSD expert, find this prospect a bit scary -
Yup, you certainly can reinstall clean and restore that.
But you should be able to upgrade. Try upgrading at the command line (the real CLI not the gui page) with
pfSense-upgrade -d. That will show you what's happening and any errors preventing it. -
@SidTheSalamander 23.01 would be going backwards and your config file is now a later version. If you can't fix the issue per above, I would just install current.
https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/reinstall-pfsense.html
The procedure looks far more complicated than it is. Just follow the directions.
pfSense-upgrtade -d
pfSense-upgrade -d
:)
-
Doh!
-
OK, so I tried running pfSense-upgrade -d. The response appeared to be prompting for a y to continue (y/N) and defaulted to No. Checked the syntax and tried pfSense-upgrade -dy which got a verbose response listing 10 packages to be installed, 57 upgraded, then a bunch more info ending with:
Removing unnecessary packages...
Checking integrity... done (0 conflicting)
Nothing to do.
Activating boot environment default... done.
System is going to be upgraded. Rebooting in 10 seconds.
.: cannot open /etc/rc.ramdisk_functions.sh: No such file or directoryNo indication that a reboot took place …and I’m not inclined to do one if it’s going to fail due to a ramdisk issue. Moreover, I have a working firewall (apart from the ability to use my bypass rules) and home network, I am inclined to not do anything in too much of a hurry if it risks needing a long recovery process.
Appreciate all the comments, including any that follow. Thinking it might be best to do my research (thanks for the reinstall link) and preparation, setting aside some time to deal with this, rather than racing ahead.
-
You should have just been able to answer 'Y' to the question when it asks. You ran that at the CLI?
It should have rebooted. If you're running ZFS and there's an issue after the reboot it should just revert to the previous snapshot. And you can always select an old BE manually at boot.
-
Note: I am a bit of a dabbler, in no way an expert in this subject …also, I set up this firewall about 3 years ago, and haven’t significantly messed with it since. My knowledge is both sketchy and rusty.
You should have just been able to answer 'Y' to the question when it asks. You ran that at the CLI?
When I choose Diagnostics / Command Prompt, I’m presented with a page that offers 4 sections – Execute Command Shell / Download / Upload / Execute PHP. I paste in commands and press Execute – so it’s not an interactive command prompt, and I can’t respond with a “y” -it seems to auto-select the default which is “N“.
It should have rebooted. If you're running ZFS and there's an issue after the reboot it should just revert to the previous snapshot. And you can always select an old BE manually at boot.
Sounds to me like I will need to set up a USB emulated serial connection using PuTTY before I attempt reboot and hope the Boot Environment selection is sufficiently newbie-proof such that I can get it right.
Thanks for taking the time - sorry if I'm being a dumb noob in a scary unfamiliar world
-
@SidTheSalamander See https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/connect-to-console.html
It's just saying the file is missing but it should be there. Maybe the restart errors out at that point?
I would get the current Netgate Installer file (and directions) and try to restart it.
-
@stephenw10 said in SG-1100 LAN Rules / Aliases missing, control buttons replaced by error messages:
Try upgrading at the command line (the real CLI not the gui page)
Ah, that's why I specified using the real command line not that page.
Yes, I would make sure you have a working console connection first. You would need that to reinstall anyway.
https://docs.netgate.com/pfsense/en/latest/solutions/sg-1100/connect-to-console.html -
=== RESOLVED ===
OK, the preceding comments made me realise noob error – I was using Diagnostics / Command Prompt instead of a console. I have used that procedure before, saved the details on a sticky note – so got that going easily.
Tried running pfSense-upgrade -d which spat out a bunch of blurb ending “nothing to do” (presumably because of my previous half-assed efforts) then rebooted – bingo. I have a pfSense system that shows my rules and my aliases, no incomprehensible errors.
Big THANK YOU to all the commenters who helped me navigate my way through this.
-
@SidTheSalamander Nice. Is it on 24.11 now?
-
Front page reports:
23.09.1-RELEASE (arm64)
built on Fri Jan 10 15:07:00 UTC 2025
FreeBSD 14.0-CURRENT -
You should be able to upgrade directly to 24.11 from there.
You might need to refresh the update to see it available. Or wait 24hrs!
-
Yes I was offered 24.11-RELEASE (arm64) after a short delay
All done - thanks again!
