PfBlockerNG v2.0 w/DNSBL
-
Where does it fails when you install it ? There must be some hints in the installation logs, system log or pfblockerng log.
-
php /usr/local/www/pfblockerng/pfblockerng.php dc
and as it's shown in the logs :
Download Process Starting [ 08/15/16 21:18:57 ]
/usr/local/share/GeoIP/GeoIP.dat.gz 200 OK
/usr/local/share/GeoIP/GeoIPv6.dat.gz 200 OK
/usr/local/share/GeoIP/GeoLite2-Country-CSV.zip 200 OK
/var/db/pfblockerng/top-1m.csv.zip 200 OK
Download Process Ended [ 08/15/16 21:19:31 ]Country code update Start
Converting MaxMind Country databases for pfBlockerNG.
Processing ISO IPv4 Continent/Country Data
Processing ISO IPv6 Continent/Country Data
Creating pfBlockerNG Continent XML files
IPv4 Africa
IPv6 Africa
IPv4 Antarctica
IPv6 Antarctica
IPv4 Asia
IPv6 Asia
IPv4 Europe
IPv6 Europe
IPv4 North America
IPv6 North America
IPv4 Oceania
IPv6 Oceania
IPv4 South America
IPv6 South America
IPv4 Proxy and Satellite
IPv6 Proxy and Satellite
IPv4 TOP 20
IPv6 TOP 20
Saving pfBlockerNG Reputation TAB
Country Code Update Ended - [ 08/15/16 21:24:37 ]–-----
tail -f pfblockerng.log
DNSBL - Adding Unbound custom 'include' option
Saving new DNSBL web server configuration to port [ 8081 and 8443 ]
Saving pfSense config…
VIP address configured. Widget Packet statistics reset.
Restarting Service DNSBL...**Saving configuration [ 08/15/16 19:16:28 ] …
Restarting Service DNSBL...and stays like this for 20 minutes.
-
Looks like the MaxMind database creation went ok.
Can you try to reinstall pfBlockerNG? -
Just did this:
install log looks like :
Upgrading pfSense-pkg-pfBlockerNG…
Updating pfSense-core repository catalogue...
pfSense-core repository is up-to-date.
Updating pfSense repository catalogue...
pfSense repository is up-to-date.
All repositories are up-to-date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):Installed packages to be REINSTALLED:
pfSense-pkg-pfBlockerNG-2.1.1_2 [pfSense]Number of packages to be reinstalled: 1
[1/1] Reinstalling pfSense-pkg-pfBlockerNG-2.1.1_2…
[1/1] Extracting pfSense-pkg-pfBlockerNG-2.1.1_2: …....... done
Removing pfBlockerNG components...
Menu items... done.
Services... done.
Loading package instructions...
Removing pfBlockerNG...cat: /var/db/pfblockerng/dnsbl/.txt: No such file or directory
All customizations/data will be retained... done.
Saving updated package information...
overwrite!
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Executing custom_php_install_command()...
MaxMind GeoIP databases previously downloaded.
Adding pfBlockerNG Widget to the Dashboard... done.
Remove any existing and create link for DNSBL lighttpd executable... done.
Creating DNSBL web server start-up script... done.
Creating DNSBL web server config ... done.
Starting DNSBL Service... done.
Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
Custom commands completed ... done.
Executing custom_php_resync_config_command()...1 table created.
1/1 addresses added.
cat: /var/db/pfblockerng/dnsbl/.txt: No such file or directory
pkg: POST-INSTALL script failedCleaning up cache... done.
Success
just after the refresh i got a crash report:
Crash report begins. Anonymous machine information:
amd64
10.3-RELEASE-p5
FreeBSD 10.3-RELEASE-p5 #0 7307492(RELENG_2_3_2): Tue Jul 19 13:29:35 CDT 2016 root@ce23-amd64-builder:/builder/pfsense-232/tmp/obj/builder/pfsense-232/tmp/FreeBSD-src/sys/pfSenseCrash report details:
PHP Errors:
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP Fatal error: Allowed memory size of 104857600 bytes exhausted (tried to allocate 24 bytes) in /usr/local/pkg/pfblockerng/pfblockerng.inc on line 3867
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP Stack trace:
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 1. {main}() /etc/rc.start_packages:0
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 2. sync_package() /etc/rc.start_packages:90
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 3. eval() /etc/inc/pkg-utils.inc:631
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 4. sync_package_pfblockerng() /etc/inc/pkg-utils.inc(631) : eval()'d code:3
[15-Aug-2016 21:57:31 Europe/Bucharest] PHP 5. file() /usr/local/pkg/pfblockerng/pfblockerng.inc:3867 -
Allowed memory size of 104857600 bytes exhausted (tried to allocate 24 bytes)
This tells me you only have 100M for memory limit.
What are the fixes you applied up to now to the system? -
/usr/local/pkg/pfblockerng/pfblockerng.inc
pfb_global();
// DNSBL Lighttpd HTTPS Daemon (Scans Lighttpd dnsbl_error.log for requested https domain names)
if (isset($argv[1]) && $argv[1] == 'dnsbl') {
set_time_limit(0);
pfb_livetail($pfb['dnserrlog'], 'dnsbl');
exit;
}and i guess is default.
and also usr/local/www/pfblockerng/pfblockerng.php - not modified.
-
And no modifications to /etc/inc/config.inc or /usr/local/etc/php.ini, /etc/rc.php_ini_setup ?
-
well based on my comments i did one to the first file:
// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "512M");
} else {
ini_set("memory_limit", "256M"); # increased from 128M
}–--
-
This change only affect i386 systems, you are on a amd64.
Did you raise the System / Advanced / Firewall & NAT Firewall Maximum Table Entries ? -
no
will do now. what's a starting value?i had 5000000 now i have 50000000
-
I think 2000000 is the default, 50000000 should be more than enuf.
Do you see the pfblockerNG menu ?
BTW how much free memory do you have ? -
still not there.
i have deleted, restarted, reinstalled pfbloker.
27% of 8130 MiB free ram -
I changed the mem settings and the table settings and now I'm getting
>>> Upgrading pfSense-pkg-pfBlockerNG... Updating pfSense-core repository catalogue... pfSense-core repository is up-to-date. Updating pfSense repository catalogue... pfSense repository is up-to-date. All repositories are up-to-date. Checking integrity... done (0 conflicting) The following 1 package(s) will be affected (of 0 checked): Installed packages to be REINSTALLED: pfSense-pkg-pfBlockerNG-2.1.1_2 [pfSense] Number of packages to be reinstalled: 1 [1/1] Reinstalling pfSense-pkg-pfBlockerNG-2.1.1_2... [1/1] Extracting pfSense-pkg-pfBlockerNG-2.1.1_2: .......... done Removing pfBlockerNG components... Menu items... done. Services... done. Loading package instructions... Removing pfBlockerNG... All customizations/data will be retained... done. Saving updated package information... overwrite! Loading package configuration... done. Configuring package components... Loading package instructions... Custom commands... Executing custom_php_install_command()... MaxMind GeoIP databases previously downloaded. Adding pfBlockerNG Widget to the Dashboard... done. Remove any existing and create link for DNSBL lighttpd executable... done. Creating DNSBL web server start-up script... done. Creating DNSBL web server config ... done. Starting DNSBL Service... done. Upgrading Adv. Inbound firewall rule settings ... no changes required ... done. Custom commands completed ... done. Executing custom_php_resync_config_command()...1 table created. 1/1 addresses added. PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed >>> Cleaning up cache... done. Success -
same line on which i have the crash reported
-
Again which memory settings did you change ?
In this thread there was a fix for pfblockerng.inc that will NEVER work on installation as the file is overwritten during the installation of the package.
It is good practice to disable pfBlockerNG AND DNSBL before removing or re-installing pfBlockerNG or before upgrading pfsense.
So to reinstall of a i386, in Diagnostics / Edit File open /etc/inc/config.inc,
go to line 77 and change from// Set memory limit to 512M on amd64. if ($ARCH == "amd64") { ini_set("memory_limit", "512M"); } else { ini_set("memory_limit", "128M"); } ```to// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "512M");
} else {
ini_set("memory_limit", "256M"); # i386 Default 128M
}If the installation fails to complete on a **amd64** system, then you need to change /etc/inc/config.inc (line 75) from 512M to 640M or 768M.// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "512M");
} else {
ini_set("memory_limit", "128M");
}// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "768M"); # amd64 Default 512M
} else {
ini_set("memory_limit", "128M");
}**AND** modify the /usr/local/etc/php.ini (last line) and /etc/rc.php_ini_setup files (line 303) fromsuhosin.memory_limit = 536870912
tosuhosin.memory_limit = 671088640 # 640M Default 536870912
orsuhosin.memory_limit = 805306368 # 768M Default 536870912
If you use many GeoIP IPV6 tables (like those who block the world, again this is not the _optimal_ way to configure a firewall), then you will have to raise the **Firewall Maximum Table Entries** until the FW rules loads. Check the installation logs, Dashboard for crash report, /var/log, /var/log/pfblockerng, etc -
ok if i do allocate 768M as mem limit, whats the value to be changed on suhosin.memory_limit in php.ini?
-
You have to edit the /usr/local/etc/php.ini, /etc/rc.php_ini_setup files to
suhosin.memory_limit = 805306368
-
no more crash reports after reinstall.
pfblokerNG back in the menu.
all back to normal !
thanks for helping :)
-
what was the file path for config.inc
-
/etc/inc/config.inc
I updated the previous post.
