PfBlockerNG v2.0 w/DNSBL

varazir

I changed the mem settings and the table settings and now I'm getting

>>> Upgrading pfSense-pkg-pfBlockerNG... 
Updating pfSense-core repository catalogue...
pfSense-core repository is up-to-date.
Updating pfSense repository catalogue...
pfSense repository is up-to-date.
All repositories are up-to-date.
Checking integrity... done (0 conflicting)
The following 1 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
	pfSense-pkg-pfBlockerNG-2.1.1_2 [pfSense]

Number of packages to be reinstalled: 1
[1/1] Reinstalling pfSense-pkg-pfBlockerNG-2.1.1_2...
[1/1] Extracting pfSense-pkg-pfBlockerNG-2.1.1_2: .......... done
Removing pfBlockerNG components...
Menu items... done.
Services... done.
Loading package instructions...
Removing pfBlockerNG... All customizations/data will be retained... done.
Saving updated package information...
overwrite!
Loading package configuration... done.
Configuring package components...
Loading package instructions...
Custom commands...
Executing custom_php_install_command()...
MaxMind GeoIP databases previously downloaded.
Adding pfBlockerNG Widget to the Dashboard... done.
Remove any existing and create link for DNSBL lighttpd executable... done.
Creating DNSBL web server start-up script... done.
Creating DNSBL web server config ... done.
Starting DNSBL Service... done.
Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
Custom commands completed ... done.
Executing custom_php_resync_config_command()...1 table created.
1/1 addresses added.
PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed
>>> Cleaning up cache... done.
Success

nikkon

same line on which i have the crash reported

RonpfS

Again which memory settings did you change ?

In this thread there was a fix for pfblockerng.inc that will NEVER work on installation as the file is overwritten during the installation of the package.

It is good practice to disable pfBlockerNG AND DNSBL before removing or re-installing pfBlockerNG or before upgrading pfsense.

So to reinstall of a i386, in Diagnostics / Edit File open /etc/inc/config.inc,
go to line 77 and change from

// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
   ini_set("memory_limit", "512M"); 
} else {
   ini_set("memory_limit", "128M");
}
```to

// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "512M");
} else {
ini_set("memory_limit", "256M"); # i386 Default 128M
}


If the installation fails to complete on a **amd64** system, then you need to change /etc/inc/config.inc (line 75) from 512M to 640M or 768M.

// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "512M");
} else {
ini_set("memory_limit", "128M");
}

// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "768M"); # amd64 Default 512M
} else {
ini_set("memory_limit", "128M");
}

**AND** modify the /usr/local/etc/php.ini (last line) and /etc/rc.php_ini_setup files (line 303) from

suhosin.memory_limit = 536870912

to

suhosin.memory_limit = 671088640 # 640M Default 536870912

or

suhosin.memory_limit = 805306368 # 768M Default 536870912


If you use many GeoIP IPV6 tables (like those who block the world, again this is not the _optimal_ way to configure a firewall), then you will have to raise the **Firewall Maximum Table Entries** until the FW rules loads.

Check the installation logs,  Dashboard for crash report, /var/log, /var/log/pfblockerng, etc

nikkon

ok if i do allocate 768M as mem limit, whats the value to be changed on suhosin.memory_limit in php.ini?

RonpfS

You have to edit the /usr/local/etc/php.ini, /etc/rc.php_ini_setup files to

suhosin.memory_limit = 805306368

nikkon

no more crash reports after reinstall.
pfblokerNG back in the menu.
all back to normal !
thanks for helping :)

beer-intro.jpg_thumb

makq

what was the file path for config.inc

RonpfS

/etc/inc/config.inc
I updated the previous post.

varazir

@RonpfS:

You have to edit the /usr/local/etc/php.ini, /etc/rc.php_ini_setup files to

suhosin.memory_limit = 805306368

I'll try the rc.php_ini_setup when I get back home.

I changed to this(I'm running on a 64bit system)

// Set memory limit to 512M on amd64.
if ($ARCH == "amd64") {
ini_set("memory_limit", "768M");
} else {
ini_set("memory_limit", "128M");
}

varazir

Thanks it worked!!

surface

Hi all,

I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

Thanks in advance for your help!

RonpfS

@surface:

Hi all,

I'm also having this issue. However, I don't know where you guys are finding the file to edit. I see that the location of the file is /etc/inc/config.inc but how do I get to it to edit? I'm only familiar with pfsense through the web interface.

Thanks in advance for your help!

Maybe you should read this https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 again

varazir

I made the mistake to reinstall the pkg. ( didn't take a snapshot before doing it) But I have a backup of the machine that I could restore and boot up.

My idea was if it could be done to export the settings from the backuped VM ( running ) and import it in my live system?

I can't find any way to extract the settings. found a way to sync the settings could try that but export import would be easier I think.

RonpfS

@varazir:

I made the mistake to reinstall the pkg. ( didn't take a snapshot before doing it) But I have a backup of the machine that I could restore and boot up.

My idea was if it could be done to export the settings from the backuped VM ( running ) and import it in my live system?

I can't find any way to extract the settings. found a way to sync the settings could try that but export import would be easier I think.

The settings for pfBlockerNG are stored in the config.xml file.

But on a new installation, restoring the config file without modifications will not work with DNSBL enabled. The Resolver service (unbound) will not start as the unbound <custom_options>will try to load /var/unbound/pfb_dnsbl.conf which doesn't exist on a new installation. Without DNS Resolver running, the reinstallation of package on reboot will fail.
One workaround is to```
touch /var/unbound/pfb_dnsbl.conf


Edit the config.xml to disable pfBlockerNG and DNSBL first.

To disable pfBlockerNG in the config.xml change

	 <pfblockerng><config><enable_cb>on</enable_cb>
			<pfb_keep>on</pfb_keep></config></pfblockerng>

	 <pfblockerng><config><enable_cb><pfb_keep>on</pfb_keep></enable_cb></config></pfblockerng>


To disable DNSBL in the config.xml change

	 <pfblockerngdnsblsettings><config><pfb_dnsbl>on</pfb_dnsbl></config></pfblockerngdnsblsettings>


**AND** change custom_options :

 <unbound><active_interface>lan,opt1,lo0</active_interface>
	<outgoing_interface>wan</outgoing_interface>
	<custom_options>c2VydmVyOmluY2x1ZGU6IC92YXIvdW5ib3VuZC9wZmJfZG5zYmwuY29uZg==</custom_options></unbound>

 <unbound><active_interface>lan,opt1,lo0</active_interface>
	<outgoing_interface>wan</outgoing_interface></unbound>


On reboot the package installation should proceed and pfBlockerNG will rebuild the MaxMind database. If you had memory issues, you will have to apply the other fixes for memory issues https://forum.pfsense.org/index.php?topic=102470.msg647719#msg647719 **before** restoring the config.xml file to the new installation.

Then you re enable pfBlockerNG and DNSBL, do a Force Update to download the Tables and rebuild the pfBlockerNG database.</custom_options>

matt.will

Hey Ron,

Going to start following this thread. Hopefully BBCan will chime in soon; do we know if there is an optimal fix in-work to deal with the MaxMind changes? The workaround procedure worked for, but find it odd to see these tables growing at an alarming rate.

M

duanes

My system has 8GB of RAM. This is very frustrating.

I have adjusted the max table entries to 70000000
and in php.ini and php setup files suhosin.memory_limit = 1024000000
Also, changed the config.inc file so that AMD64 = 4096M

Then reinstall pfBlockerNG and I still get this near the end. It is still

Executing custom_php_install_command()…
MaxMind GeoIP databases previously downloaded.
Adding pfBlockerNG Widget to the Dashboard... done.
Remove any existing and create link for DNSBL lighttpd executable... done.
Creating DNSBL web server start-up script... done.
Creating DNSBL web server config ... done.
Starting DNSBL Service... done.
Upgrading Adv. Inbound firewall rule settings ... no changes required ... done.
Custom commands completed ... done.
Executing custom_php_resync_config_command()...1 table created.
1/1 addresses added.
PHP ERROR: Type: 1, File: /usr/local/pkg/pfblockerng/pfblockerng.inc, Line: 3867, Message: Allowed memory size of 134217728 bytes exhausted (tried to allocate 72 bytes)pkg: POST-INSTALL script failed

Ramosel

It's not something I use all the time but I KNOW there used to be links on one of the pfBlockerNG screens to get you to an external lookup for finding AS numbers. Has that moved? Been dropped? I can't find it anywhere…..

varazir

@RonpfS:

Ahh ok, so I just thought I missed something well, and you was right when I turned on my backup it had the same settings as I hade after the reinstallation.

Everything is purring like kitten again. :)

cmpufxr

I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

Everything works as it should now, even blocking the youtube ads and porn.

I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

RonpfS

@cmpufxr:

I did notice that when I did a new install with the latest pfsense software and loaded pfblockerng that the floating rules for the VIP 10.10.10.1 were not created even though I had all the interfaces checked along with the floating rules box. I could not get any blocking until I manually created the floating rule for the vip.

I did try to check and recheck the settings and also restarted pfblockerng and restart the system multiple times until I discovered that the floating rule was missing.

Everything works as it should now, even blocking the youtube ads and porn.

I have been using pfsense and pfblockerng and before that the pfblocker. I love the package!!!

A fix for this issue is being tested.