New 502 Bad Gateway

That why the report of @rightnow would be interesting. As he has this error without any packages installed. Makes me wonder if some other component causes (part of) the problem, and maybe pfBlocker is just the most visible to suffer from that 'defect'.

jimp

@PiBa:

That why the report of @rightnow would be interesting. As he has this error without any packages installed. Makes me wonder if some other component causes (part of) the problem, and maybe pfBlocker is just the most visible to suffer from that 'defect'.

If that were the case there should be some other sign of stress on the PHP-FPM socket, and there isn't. Most likely it's a completely unrelated problem that happens to present with one common symptom.

Hans_P

@jimp:

@PiBa:

That why the report of @rightnow would be interesting. As he has this error without any packages installed. Makes me wonder if some other component causes (part of) the problem, and maybe pfBlocker is just the most visible to suffer from that 'defect'.

If that were the case there should be some other sign of stress on the PHP-FPM socket, and there isn't. Most likely it's a completely unrelated problem that happens to present with one common symptom.

It has started becoming an issue for me again. I have attached my outputs as requested.

Netgate Sg-4860
Ver. 2.4.0
pfBlocker
Ver. 2.1.2

[pfSense Freeze.txt](/public/imported_attachments/1/pfSense Freeze.txt)

Jailer

@jimp:

@PiBa:

That why the report of @rightnow would be interesting. As he has this error without any packages installed. Makes me wonder if some other component causes (part of) the problem, and maybe pfBlocker is just the most visible to suffer from that 'defect'.

If that were the case there should be some other sign of stress on the PHP-FPM socket, and there isn't. Most likely it's a completely unrelated problem that happens to present with one common symptom.

If thats the case I’m curious as to why a ZFS install mitigates it?

ak

@PiBa:

@jimp:

@ntct:

I also have 502 Bad Gateway on pfSense 2.4 and pfblockerng 2.1.2…... :-\

And judging by the output, it's still DNSBL getting backed up.

That why the report of @rightnow would be interesting. As he has this error without any packages installed. Makes me wonder if some other component causes (part of) the problem, and maybe pfBlocker is just the most visible to suffer from that 'defect'.

I did a fresh install of 2.4 and had pfblockerng with the issue. I didn't come on the forum so didn't know of the instructions to get log details.

However, I disabled pfblockerng and have not had a lock up for over 24 hours. Let me run without pfblockerng for a bit more then switch it back on and see.

msvuze

mine crashes right away if enabled but with pfblockerng disabled it crashes a lot later like 24-28 hrs after.

Is this fixed if I select the developer update ? or is this still a work in progress>

PiBa

@msvuze:

mine crashes right away if enabled but with pfblockerng disabled it crashes a lot later like 24-28 hrs after.

Is this fixed if I select the developer update ? or is this still a work in progress>

If you have this same issue with pfBlocker and DNSbl disabled, then please provide the information requested to see if it is really the same behavior in the background, that might help tell what causes it. And once the root cause is known, a fix can be made, not before..

BBcan177

As per jimp's suggestion, please try these two patched files which use a pfSense function called try_lock() as opposed to flock().

Run the following commands to download the patched version of the two files from my Github Gist:

fetch -o /usr/local/www/pfblockerng/www/index.php "https://gist.githubusercontent.com/BBcan177/9f9c8e62b166cee07ad16cd4ff59103c/raw"
fetch -o /usr/local/pkg/pfblockerng/pfblockerng.inc "https://gist.githubusercontent.com/BBcan177/7ff15715be0f02afdbe0a00c676aedce/raw"

Recommend a reboot after downloading the patches.

You can review the Gist revisions here:

index.php
https://gist.github.com/BBcan177/9f9c8e62b166cee07ad16cd4ff59103c/revisions

pfblockerng.inc
https://gist.github.com/BBcan177/7ff15715be0f02afdbe0a00c676aedce/revisions

Note: The try_lock() function calls might require increasing the timeout setting from the default setting of "5" (seconds)

BBcan177

Made a couple changes to the code… So if you have downloaded these files prior to this post, please re-download the same URLs above to get the new changes.... Thanks!

ntct

@BBcan177:

Made a couple changes to the code… So if you have downloaded these files prior to this post, please re-download the same URLs above to get the new changes.... Thanks!

Hi BBcan177

Can you make a PR?

BBcan177

Added some temp file removal to the patches. So please re-download this new code if you have downloaded these files prior to this post, please re-download the same URLs above to get the new changes…. Thanks!

A reboot is recommended following these patches.

Once the code has been tested, I will submit this as a PR.

Please report back your feedback.

Thanks!

hdejongh

@jimp:

@hdejongh:

hee Jim,

https://pastebin.com/JVMQTWbY

bad gateway 502 issue

That looks like it was taken just after a reboot, not when the problem was happening. No sign of anything getting backed up in there.

Hee Jim,

im 99,99999% certain the issue was happening at that time.
Ill do it again.

this one is from an other firewall.
it hangs on "sockstat" 15 minutes now so i think those wont come anymore.

https://pastebin.com/Ek9R0qkh

ha11oga11o

Here is more data with 502 err:

https://pastebin.com/TqSBTKEK

OpenVPN clients cannot connect also, which is mine major problem for now.

hope will help.

hdejongh

@ha11oga11o:

Here is more data with 502 err:

https://pastebin.com/TqSBTKEK

OpenVPN clients cannot connect also, which is mine major problem for now.

hope will help.

it starts to become a major issue as well for us. Im about to restore backups..
All virtual firewall's that we upgraded have the same problem…
we have to reboot them multiple times per day to get it working, otherwise ipsec's and openvpn stop working.