PfBlocker
-
Personally I took mine up to a high value that would never be reached (something like 9999999999999999 or similar). I did this for several reasons.
No memory is allocated based on this number and it makes it easy to increase my table usage without trying to find a limit that will work. So it doesn't cost you anything and this ensures that no matter how many lists I use I won't run into any issue. Just in case someone is wondering my system only has 2GB of mem which is more than enough. -
I was trying to do it incrementally, but that is not working. Got up to 15000000, but then saw your post. So I'm going to try that large number[9999999999999999].
-
Are you sure you are not reading an old alert?
BTW, if a really large value does not exaust memory, It's an excelent option to prevent errors.
-
Are you sure you are not reading an old alert?
BTW, if a really large value does not exaust memory, It's an excelent option to prevent errors.
Yes, I was making sure they where not old. I have 4GB in this box. Current memory usage:
Mem: 603M Active, 67M Inact, 1151M Wired, 1048K Cache, 406M Buf, 1991M Free
Swap: 8192M Total, 8192M FreeWhen I initially click on save, it all works fine for a few minutes[~2]. Then after a random amount of time, clicking different menus to check the settings the error pops back up. At first after using 9999999999999999; I was still getting the error. It has now been ~19 minutes since the last error message. Will keep my on it too see if the error comes back. If the error comes back, I will try deleting the offending list and re adding it, to see if that helps.
Thanks for the help!
-
Check on widget if were changes on amount of cidrs applied.
CIDRs are get from applied file and package count from firewall tables.
-
Check on widget if were changes on amount of cidrs applied.
CIDRs are get from applied file and package count from firewall tables.
IP-Blocklist injects a large number like that to /tmp/rules.debug at the top to ensure no matter how many lists a user has there won't be any errors. So with pfBlocker, even though it's a manual process, I add that large number.
-
The CIDRs are the same as in the screenshot I posted above:
pfBlockerBluetack 761470
pfBlockerTBG 1262743It has been ~35 minutes and no new errors :) I'm crossing my fingers ;)
-
I need to improve lists size check to reduce this kind of issues or change error message suggesting tommyboy180 large configuration.
It's in my 'todo list when time permits' ;)
-
Needed to restart Squid and the got an alert with the error.
EDIT: Every time Squid is restarted is when the error occurs. I was messing with Squid yesterday, but did not put it together until now.
-
There was a update on squid package today, apply it and see what happens.
-
There was a update on squid package today, apply it and see what happens.
Squid was reinstalled with the latest version, but still the same.
-
I'll try to reproduce it here.
You get this memory alert once or after squid restart alerts are frequent?
-
I'll try to reproduce it here.
You get this memory alert once or after squid restart alerts are frequent?
The memory alerts only shows after a Squid restart. After the initial alerts there are no more alerts. At least that is what is occurring here.
Dec 30 15:11:54 php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 30 15:11:54 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 30 15:11:46 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'
Dec 30 15:11:16 php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 30 15:11:16 php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfblockertbg>persist file "/var/db/aliastables/pfBlockerTBG.txt"
Dec 30 15:11:07 php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'
Dec 30 15:10:32 php: /pkg_edit.php: Reloading Squid for configuration sync
Dec 30 15:10:32 check_reload_status: Reloading filter
Dec 30 15:10:32 check_reload_status: Syncing firewall
Dec 30 15:10:32 check_reload_status: Reloading filter
Dec 30 15:10:31 php: /pkg_edit.php: Reloading Squid for configuration sync</pfblockertbg></pfblockertbg></pfblockertbg></pfblockertbg> -
When that error occurs, Squid fails to work as a transparent proxy. Squid still works if you manually set the proxy settings in a browser for example. I disabled pfBlocker for now. Will try a few things.
-
Increase even more Firewall Maximum Table Entries in system->advanced -> firewall/NAT
not!!!! Firewall Maximum States ;)
-
PfBlocker use url tables, so it is firewall maximum table entries for sure.
Firewall maximum states are related to active connections. When you reach this value, you can't do anything on firewall.
-
After trying out a few things all is fine for now. Disabled the TBG List and left the Bluetack enabled. Also in System -> Advanced -> Firewall and NAT; Firewall Maximum Table Entries, removed that large number[9999999999999999] from there. Restarted pfBlocker and now there are no error messages and Squid works as transparent proxy, even with pfBlocker enabled. So it seems the TBG list is the cause of all these issues I was having.
TBG list:
http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=ecqbsykllnadihkdirsh&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=tbnuqfclfkemqivekikv&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=ewqglwibdgjttwttrinl&fileformat=p2p&archiveformat=gzBluetack list:
http://list.iblocklist.com/?list=bt_level1&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_level2&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_level3&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_ads&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_spyware&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_proxy&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_templist&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_hijacked&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_dshield&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_bogon&fileformat=p2p&archiveformat=gz -
You may try if you want add each TBG list until you find what list get errors.
-
You may try if you want add each TBG list until you find what list get errors.
Yes, I'm going to try that. I might spring for the i-block lists, need to do some research on that. Are the i-block lists any better than the public lists?
-
Did some testing.
With the following in the TBG list, whenever I try to enable them[one at a time], get the Fatal error below.
http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=ecqbsykllnadihkdirsh&fileformat=p2p&archiveformat=gzFatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 8650655 bytes) in /usr/local/pkg/pfblocker.inc on line 268
Note, the Bluetack list is still enabled. When testing the above.
