Update lists fail

Qinn

So what does the MaxMind updates trigger?

Qinn

@qinn Is there a way to check when the next update of MaxMind will run?

RonpfS

@qinn You can check /var/log/pfblockerng/extras.log to see when the last update was done.

Qinn

Thanks, nice overview btw of the last 2 years, seems I have to wait for 11 juni (when updating comes once a month)

Qinn

Hmm it's been well over a month and as from what it looks in the dashboard MaxMind isn't updated, I looked in

cat /var/log/pfblockerng/extras.log

and it reads:

Download Process Starting [ 06/05/18 07:00:00 ]
 /usr/local/share/GeoIP/GeoIP.dat.gz            200 OK
 /usr/local/share/GeoIP/GeoIPv6.dat.gz          200 OK
 /usr/local/share/GeoIP/GeoLite2-Country-CSV.zip                200 OK
 /var/db/pfblockerng/top-1m.csv.zip             200 OK
Download Process Ended [ 06/05/18 07:00:28 ]

Country code update Start
 Converting MaxMind Country databases for pfBlockerNG.
 Processing ISO IPv4 Continent/Country Data
 Processing ISO IPv6 Continent/Country Data [ 06/05/18 07:01:46 ]
 Creating pfBlockerNG Continent XML files
 IPv4 Africa                     [ 06/05/18 07:02:07 ]
 IPv6 Africa                     [ 06/05/18 07:02:08 ]
 IPv4 Antarctica
 IPv6 Antarctica
 IPv4 Asia
 IPv6 Asia                       [ 06/05/18 07:02:17 ]
 IPv4 Europe                     [ 06/05/18 07:02:19 ]
 IPv6 Europe                     [ 06/05/18 07:02:48 ]
 IPv4 North America              [ 06/05/18 07:02:58 ]
 IPv6 North America              [ 06/05/18 07:03:19 ]
 IPv4 Oceania                    [ 06/05/18 07:03:22 ]
 IPv6 Oceania                    [ 06/05/18 07:03:24 ]
 IPv4 South America
 IPv6 South America              [ 06/05/18 07:03:26 ]
 IPv4 Proxy and Satellite        [ 06/05/18 07:03:28 ]
 IPv6 Proxy and Satellite
 IPv4 TOP 20
 IPv6 TOP 20
 pfBlockerNG Reputation Tab
Country Code Update Ended [ 06/05/18 07:03:29 ]

So it confirms that the last one, was the one I did manually, what goes wrong, why doesn't it update automatically once a month?

Thnx for any advise

Cheers Qinn

RonpfS

@qinn said in Update lists fail:

was the one I did manually, what goes wrong

Nothing is wrong for now. You did a manual update on June 5th. The next automatic update will be done by Cron between the 4th and the 10th of July.

BTW my last update was on 06/07/18, but the version is from May 1st

/var/log/pfblockerng/maxmind_ver

MaxMind GeoLite2 Date/Time Stamp
Last-Modified: Tue, 01 May 2018 16:48:16 GMT
Duplicate Represented IP4 Networks: 36994

Qinn

Thanks for you reply, always helpful, but I have to say nope. I hoped that to, but 10/15/16 08:20:12 (as you can see below) isn't possible so it's dd-mm-yy, so there is something wrong...


Download Process Starting [ 10/15/16 08:18:03 ]
 /usr/local/share/GeoIP/GeoIP.dat.gz            200 OK
 /usr/local/share/GeoIP/GeoIPv6.dat.gz          200 OK
 /usr/local/share/GeoIP/GeoLite2-Country-CSV.zip                200 OK
 /var/db/pfblockerng/top-1m.csv.zip             200 OK
Download Process Ended [ 10/15/16 08:18:40 ]

Country code update Start
 Converting MaxMind Country databases for pfBlockerNG.
 Processing ISO IPv4 Continent/Country Data
 Processing ISO IPv6 Continent/Country Data [ 10/15/16 08:19:49 ]
 Creating pfBlockerNG Continent XML files
 IPv4 Africa                     [ 10/15/16 08:20:03 ]
 IPv6 Africa                     [ 10/15/16 08:20:04 ]
 IPv4 Antarctica
 IPv6 Antarctica
 IPv4 Asia
 IPv6 Asia                       [ 10/15/16 08:20:12 ]
 IPv4 Europe                     [ 10/15/16 08:20:14 ]
 IPv6 Europe                     [ 10/15/16 08:20:40 ]
 IPv4 North America              [ 10/15/16 08:20:45 ]
 IPv6 North America              [ 10/15/16 08:21:02 ]
 IPv4 Oceania                    [ 10/15/16 08:21:05 ]
 IPv6 Oceania                    [ 10/15/16 08:21:07 ]
 IPv4 South America
 IPv6 South America              [ 10/15/16 08:21:09 ]
 IPv4 Proxy and Satellite        [ 10/15/16 08:21:10 ]
 IPv6 Proxy and Satellite
 IPv4 TOP 20
 IPv6 TOP 20                     [ 10/15/16 08:21:11 ]
 pfBlockerNG Reputation Tab
Country Code Update Ended


 Download Process Starting [ 05/12/18 16:43:36 ]
 /usr/local/share/GeoIP/GeoIP.dat.gz            200 OK
 /usr/local/share/GeoIP/GeoIPv6.dat.gz          200 OK
 /usr/local/share/GeoIP/GeoLite2-Country-CSV.zip                200 OK
 /var/db/pfblockerng/top-1m.csv.zip             200 OK
Download Process Ended [ 05/12/18 16:44:09 ]

Country code update Start
 Converting MaxMind Country databases for pfBlockerNG.
 Processing ISO IPv4 Continent/Country Data
 Processing ISO IPv6 Continent/Country Data [ 05/12/18 16:45:27 ]
 Creating pfBlockerNG Continent XML files
 IPv4 Africa                     [ 05/12/18 16:45:48 ]
 IPv6 Africa                     [ 05/12/18 16:45:49 ]
 IPv4 Antarctica                 [ 05/12/18 16:45:50 ]
 IPv6 Antarctica
 IPv4 Asia
 IPv6 Asia                       [ 05/12/18 16:45:59 ]
 IPv4 Europe                     [ 05/12/18 16:46:01 ]
 IPv6 Europe                     [ 05/12/18 16:46:30 ]
 IPv4 North America              [ 05/12/18 16:46:40 ]
 IPv6 North America              [ 05/12/18 16:47:01 ]
 IPv4 Oceania                    [ 05/12/18 16:47:04 ]
 IPv6 Oceania                    [ 05/12/18 16:47:06 ]
 IPv4 South America
 IPv6 South America              [ 05/12/18 16:47:08 ]
 IPv4 Proxy and Satellite        [ 05/12/18 16:47:10 ]
 IPv6 Proxy and Satellite
 IPv4 TOP 20
 IPv6 TOP 20
 pfBlockerNG Reputation Tab
Country Code Update Ended [ 05/12/18 16:47:11 ]


Download Process Starting [ 06/05/18 07:00:00 ]
 /usr/local/share/GeoIP/GeoIP.dat.gz            200 OK
 /usr/local/share/GeoIP/GeoIPv6.dat.gz          200 OK
 /usr/local/share/GeoIP/GeoLite2-Country-CSV.zip                200 OK
 /var/db/pfblockerng/top-1m.csv.zip             200 OK
Download Process Ended [ 06/05/18 07:00:28 ]

Country code update Start
 Converting MaxMind Country databases for pfBlockerNG.
 Processing ISO IPv4 Continent/Country Data
 Processing ISO IPv6 Continent/Country Data [ 06/05/18 07:01:46 ]
 Creating pfBlockerNG Continent XML files
 IPv4 Africa                     [ 06/05/18 07:02:07 ]
 IPv6 Africa                     [ 06/05/18 07:02:08 ]
 IPv4 Antarctica
 IPv6 Antarctica
 IPv4 Asia
 IPv6 Asia                       [ 06/05/18 07:02:17 ]
 IPv4 Europe                     [ 06/05/18 07:02:19 ]
 IPv6 Europe                     [ 06/05/18 07:02:48 ]
 IPv4 North America              [ 06/05/18 07:02:58 ]
 IPv6 North America              [ 06/05/18 07:03:19 ]
 IPv4 Oceania                    [ 06/05/18 07:03:22 ]
 IPv6 Oceania                    [ 06/05/18 07:03:24 ]
 IPv4 South America
 IPv6 South America              [ 06/05/18 07:03:26 ]
 IPv4 Proxy and Satellite        [ 06/05/18 07:03:28 ]
 IPv6 Proxy and Satellite
 IPv4 TOP 20
 IPv6 TOP 20
 pfBlockerNG Reputation Tab
Country Code Update Ended [ 06/05/18 07:03:29 ]

RonpfS

@qinn said in Update lists fail:

so it’s dd-mm-yy,

The date is in mm-dd-yy format.

Qinn

@ronpfs please take a look at the logging in extras.log above and below, that can't be as there is no 15 month ...

Download Process Ended [ 10/15/16 08:18:40 ]

RonpfS

@qinn And you care about 2016 events ?

Qinn

@ronpfs ROFL ;)

Qinn

Somehow this won't go away, last Maxmind is 7 june and still pfBlockerNG did not update it. Is there anyway to restore the "automatic updates" or do I have to remove and reinstall the package?

BBcan177

Did you check to see if something is blocking access to MaxMind web site? Another possibility is that MaxMind is blocking your IP or rate limiting it for some reason...

Does MaxMind resolve?

host -t A geolite.maxmind.com

Can you download from this URL in a browser window:

https://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz

Did you check the pfBlockerNG error.log?

If you run the updater script, do you get any errors?

php /usr/local/www/pfblockerng/pfblockerng.php dc

Try the latest pfBlockerNG-devel version and see if that solves your issue....

Qinn

First a big thanks for you help and time, now to your advise, it gave the following results:

Yes, MaxMind did resolve

code[2.4.3-RELEASE][root@pfSense.localdomain]/root: host -t A geolite.maxmind.com
geolite.maxmind.com has address 104.16.37.47
geolite.maxmind.com has address 104.16.38.47

Yes, I can download the file GeoIP.dat.gz
I added the files

/var/log/pfblockerng/extras.log and error.log

0_1532592170771_pfblokcerNG.7z

I don't see anything out of the ordinary in these two, but I'm not a dev The 2 last updatesof MaxMind that are mentioned in the logs, where the result of a manually update using

code php -f /usr/local/www/pfblockerng/pfblockerng.php dc

My best guess is that if the MaxMind update is a cron job, it's not working anymore, a:

code crontab -l

results in:

code crontab: no crontab for root

So my last straw would be changing the update settings to the latest development and installing it, but I don't like unsolved cases (sorry that's me ) is there anything more I could look into, as I still don't get how MaxMind is updated as it doesn't seem to be a cron job?

btw From what I've read, when I want to move over to the latest dev of pfblockerNG I have to first deinstall pfblockerNG and then install the dev version and all settings will be restored, is this the right way to move over to the dev version?

Cheers Qinn

kpa

PfSense doesn't have user specific crontabs ( for reasons that I have hard time understanding myself) and the only crontab on the system is the /etc/crontab file.

Qinn

@kpa Thanks for pointing that one out to me, awaiting BBcan177 advise on how to proceed, hoping he can do something with the results and logs I provided.

BBcan177

@qinn said in Update lists fail:

btw From what I've read, when I want to move over to the latest dev of pfblockerNG I have to first deinstall pfblockerNG and then install the dev version and all settings will be restored, is this the right way to move over to the dev version?

Yes I would just go to devel and see if that fixes your issue.... There are a ton of new features in devel....
https://www.reddit.com/r/PFSENSE/comments/8lnugz/pfblockerng_devel_version_released/

Also install the "Cron" package for pfSense and you can see the pfSense Cron tasks from there.

Qinn

@bbcan177 said in Update lists fail:

@qinn said in Update lists fail:

btw From what I've read, when I want to move over to the latest dev of pfblockerNG I have to first deinstall pfblockerNG and then install the dev version and all settings will be restored, is this the right way to move over to the dev version?

Yes I would just go to devel and see if that fixes your issue.... There are a ton of new features in devel....
https://www.reddit.com/r/PFSENSE/comments/8lnugz/pfblockerng_devel_version_released/

Also install the "Cron" package for pfSense and you can see the pfSense Cron tasks from there.

Thanks for your advise hoping for a release soon, I don't care about an ETA, take your time and keep up the good work.