Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1.2.3 to 2.0 errors

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    12 Posts 3 Posters 4.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • pttP
      ptt Rebel Alliance
      last edited by

      have you checked your config with "Pre-2.0 Upgrade Check" package before upgrade ?

      http://doc.pfsense.org/index.php/Upgrade_Guide

      1 Reply Last reply Reply Quote 0
      • B
        biggsy
        last edited by

        @ptt:

        have you checked your config with "Pre-2.0 Upgrade Check" package before upgrade ?

        http://doc.pfsense.org/index.php/Upgrade_Guide

        I uninstalled Open-VM-Tools but completely missed the pre-upgrade package thing as I skipped the international/special characters stuff as "not applicable here".  It's easy to redo the upgrade.  Gotta love virtual machines.

        My fault for being too eager (OK, impatient) but perhaps the mention of the pre-upgrade package could be a bit more prominent in the guide.

        Thanks

        1 Reply Last reply Reply Quote 0
        • B
          biggsy
          last edited by

          Cloned again, removed the VMware Tools package and ran the pre-upgrade check.  It returned "OK".

          Ran the upgrade again.  Same error:

          Sep 20 21:50:37         php: : There were error(s) loading the rules: /tmp/rules.debug:52: 24\. is not a number /tmp/rules.debug:53: 24\. is not a number /tmp/rules.debug:55: 24\. is not a number /tmp/rules.debug:56: 24\. is not a number /tmp/rules.debug:63: 24\. is not a number pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [52]: nat on $WAN from $tonatsubnets port 500 to any port 500 -> 121.209.162.208/32 port 500
Sep 20 21:50:37         php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:52: 24\. is not a number /tmp/rules.debug:53: 24\. is not a number /tmp/rules.debug:55: 24\. is not a number /tmp/rules.debug:56: 24\. is not a number /tmp/rules.debug:63: 24\. is not a number pfctl: Syntax error in config file: pf rules not loaded The line in question reads [52]: nat on $WAN from $tonatsubnets port 500 to any port 500 -> 121.209.162.208/32 port 500
Sep 20 21:50:37         php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:52: 24\. is not a number /tmp/rules.debug:53: 24\. is not a number /tmp/rules.debug:55: 24\. is not a number /tmp/rules.debug:56: 24\. is not a number /tmp/rules.debug:63: 24\. is not a number pfctl: Syntax error in config file: pf rules not loaded'
Sep 20 21:50:37         php: : The gateway: opt2 is invalid or unknown, not using it.

          Relevant section from rules.debug:

          # Outbound NAT rules

# Subnets to NAT
tonatsubnets    = "{ 192.168.111.0/24 192.168.11.0/24 172.23.23.0/24\. 127.0.0.0/8  }"
nat on $WAN  from $tonatsubnets port 500 to any port 500 -> [My WAN IP]/32 port 500
nat on $WAN  from $tonatsubnets to any -> [My WAN IP]/32 port 1024:65535

nat on $DSL  from $tonatsubnets port 500 to any port 500 -> 192.168.1.2/32 port 500
nat on $DSL  from $tonatsubnets to any -> 192.168.1.2/32 port 1024:65535

          Is "port 500" something to do with IPsec - which I've never used?

          Where to from here?

          1 Reply Last reply Reply Quote 0
          • W
            wallabybob
            last edited by

            @biggsy:

            Is "port 500" something to do with IPsec - which I've never used?

            And never configured?

            I suspect the "port 500" is not a useful clue. On my system the similar section of /tmp/rules.debug reads like:

            Outbound NAT rules

            Subnets to NAT

            tonatsubnets    = "{ 192.168.xyz.0/24 192.168.uvw.0/24 127.0.0.0/8  }"
            nat on $WAN  from $tonatsubnets port 500 to any port 500 -> 192.168.abc.def/32 port 500 
            nat on $WAN  from $tonatsubnets to any -> 192.168.abc.def/32 port 1024:65535

            Load balancing anchor

            rdr-anchor "relayd/*"

            Perhaps the problem is not the port 500 but the [My WAN IP] (which is definitely not a number!). Does the string My WAN IP occur in your configuration file (/conf/config.xml)? If so, please show a couple of lines before and after each occurrence.

            1 Reply Last reply Reply Quote 0
            • B
              biggsy
              last edited by

              Security by obscurity.

              [My Wan IP] just replaced the real thing, which was there and was accurate.

              Cheers

              1 Reply Last reply Reply Quote 0
              • W
                wallabybob
                last edited by

                I think I've figured it out:

                @biggsy:

                Ran the upgrade again.  Same error:

                Sep 20 21:50:37         php: : There were error(s) loading the rules: /tmp/rules.debug:52: 24\. is not a number /tmp/rules.debug:53: 24\. is not a number /tmp/rules.debug:55: 24\. is not a number /tmp/rules.debug:56: 24\. is not a number /tmp/rules.debug:63: 24\. is not a number pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [52]: nat on $WAN from $tonatsubnets port 500 to any port 500 -> 121.209.162.208/32 port 500
Sep 20 21:50:37         php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:52: 24\. is not a number /tmp/rules.debug:53: 24\. is not a number /tmp/rules.debug:55: 24\. is not a number /tmp/rules.debug:56: 24\. is not a number /tmp/rules.debug:63: 24\. is not a number pfctl: Syntax error in config file: pf rules not loaded The line in question reads [52]: nat on $WAN from $tonatsubnets port 500 to any port 500 -> 121.209.162.208/32 port 500
Sep 20 21:50:37         php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:52: 24\. is not a number /tmp/rules.debug:53: 24\. is not a number /tmp/rules.debug:55: 24\. is not a number /tmp/rules.debug:56: 24\. is not a number /tmp/rules.debug:63: 24\. is not a number pfctl: Syntax error in config file: pf rules not loaded'
Sep 20 21:50:37         php: : The gateway: opt2 is invalid or unknown, not using it.

                The problem seems to be "24. is not a number". The quoted line includes the macro tonatsubnets which includes "24." on the third network (172.23.23.0/24.) At first I thought the trailing "." was a dust spot on my screen.

                I don't know why the network mask is "24." rather than "24".

                1 Reply Last reply Reply Quote 0
                • B
                  biggsy
                  last edited by

                  Well spotted.  I see it now as well, despite looking at it more than a few times.

                  Just wonder where it came from.

                  1 Reply Last reply Reply Quote 0
                  • W
                    wallabybob
                    last edited by

                    @biggsy:

                    Just wonder where it came from.

                    Please post the output of the pfSense shell command grep 24 /conf/config.xml
                    Maybe the 24. is in the pfSense configuration file.

                    1 Reply Last reply Reply Quote 0
                    • B
                      biggsy
                      last edited by

                      First thing I checked when I got home.  Checked a backup config from last night and there's the culprit:

                      <openvpnserver><config><disable><protocol>UDP</protocol>
                      <dynamic_ip>on</dynamic_ip>
                      <local_port>1194</local_port>
                      <addresspool>172.23.23.0/24.</addresspool>
                      <nopool><local_network>192.168.111.0/24</local_network>
                      <remote_network><client2client><crypto>BF-CBC</crypto>
                      <auth_method>pki</auth_method>
                      <shared_key>Safe enough to just delete it?</shared_key></client2client></remote_network></nopool></disable></config></openvpnserver>

                      1 Reply Last reply Reply Quote 0
                      • W
                        wallabybob
                        last edited by

                        @biggsy:

                        Safe enough to just delete it?

                        Delete the "." in 172.23.23.0/24.?
                        Delete the 172.23.23.0/24.?
                        Delete the Openvpnserver section?

                        I'd try the first, then (if necessary) second, then third if I wasn't prepared to delete the whole section and reconfigure OpenVPN server.

                        1 Reply Last reply Reply Quote 0
                        • B
                          biggsy
                          last edited by

                          wallabybob and ptt,

                          Thanks to you both for helping find the problem.

                          I dropped the dot, restored the config and upgraded to 2.0 without a problem.

                          It's been an interesting month  - pfSense 2.0 and ESXi 5.0.  Sincere thanks and congratulations to the devs for the former.

                          Cheers,
                          biggsy

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.