pfBlockerNG-devel feedback

[un1que]

Since some days I have some troubles using pfBlockerNG. From time to time there appears a notification:

There were error(s) loading the rules: /tmp/rules.debug:52: cannot define table pfB_Level4_v4: Cannot allocate memory - The line in question reads [52]: table <pfB_Level4_v4> persist file "/var/db/aliastables/pfB_Level4_v4.txt"
@ 2018-09-16 00:38:28

Has anyone an idea what the solution might be?

[BBcan177]

@un1que said in pfBlockerNG-devel feedback:

Cannot allocate memory

Need to increase the pfSense > System > Advanced > Firewall & NAT > Firewall Maximum Table Entries
The package defaults it to "2000000", but you might need to increase that value depending on how many Aliastable entries you have.

[un1que]

@bbcan177
Thanks for your reply! I’ll try that.

I now reloaded the IP values via force update and at the end of that process I found those numbers:

pfSense Table Stats
-------------------
table-entries hard limit  2000000
Table Usage Count         104384

Before your hint I had 600000 table entries set in advanced settings. But for only about 100k used entries it should have been enough, isn’t it?

[RonpfS]

And the table-entries hard limit was showing 600000 in pfblockerng.log before you made the change ?

[un1que]

@ronpfs
I can’t say yet, but I think at the end of the force update process it was showing 600k instead of 2mio now, yes.

[Grimson]

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

[BBcan177]

@grimson said in pfBlockerNG-devel feedback:

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

Can you check this:
https://forum.netgate.com/topic/135893/getting-crash-reports-after-updating-to-2-4-4/24

php -v
php_pfb -v

Versions should match.

You can also try to start from the shell to see if it shows any errors:

/usr/local/etc/rc.d/pfb_filter.sh restart

[BBcan177]

@grimson said in pfBlockerNG-devel feedback:

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

I think its running:

ps auxww | grep pfb

/usr/local/bin/php_pfb -f /usr/local/pkg/pfblockerng/pfblockerng.inc filterlog (php)

But now thats its a symlink and not a link, the Services function might not see the executable "php_pfb".

So as long as your still getting firewall events in the Alerts/Reports tab, then it is still working, just not showing that in the the services status as "running".

Still investigating...

[occamsrazor]

@grimson said in pfBlockerNG-devel feedback:

I just updated from v2.2.5_15 to v2.2.5_16, now the "pfBlockerNG firewall filter service" refuses to start, according to the dashboard status. There are no errors in the logs (checked both pfB logs and system logs).

Just to chime in... same situation here, was shown as running Services before I upgraded to v2.2.5_16 but not now.

[BBcan177]

@occamsrazor said in pfBlockerNG-devel feedback:

Just to chime in... same situation here, was shown as running Services before I upgraded to v2.2.5_16 but not now.

I posted a PR which reverts the symlink change... Will be v2.2.5_17 once that is merged.

https://github.com/pfsense/FreeBSD-ports/pull/575

[Grimson]

Sorry for the late answer, I got an emergency call from work and had to leave.

@bbcan177 said in pfBlockerNG-devel feedback:

php -v
php_pfb -v

Versions should match.

Both show the same version:

PHP 7.2.10 (cli) (built: Sep 14 2018 11:32:18) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
    with Zend OPcache v7.2.10, Copyright (c) 1999-2018, by Zend Technologies

You can also try to start from the shell to see if it shows any errors:

/usr/local/etc/rc.d/pfb_filter.sh restart

Restarts without an error.

I think its running:

ps auxww | grep pfb

/usr/local/bin/php_pfb -f /usr/local/pkg/pfblockerng/pfblockerng.inc filterlog (php)

Yes it's running.

But now thats its a symlink and not a link, the Services function might not see the executable "php_pfb".

Yep, looks like it.

[Xentrk]

@bbcan177
I landed here by doing a search as I have the same issue. Thanks for the update!

[Grimson]

BBcan177 posted a quick fix here: https://forum.netgate.com/topic/136155/2-4-4-upgrade-messed-pfbng-beta/3 if the red status icon is bothering you.

[stownplayer]

Just updated and still have the same issue. I'm on 2.2.5_17 and the filter service is still red.

[occamsrazor]

@stownplayer Try the quick fix in the post 2 above this.... worked fine for me.

[stownplayer]

@occamsrazor We think my pfsense install is corrupted in some way. I'm going to re-install 2.4.4 and then reload the config. I tried those commands not long after they were posted and it did not work.

[Veldkornet]

On my dashboard, DNSBL always has a yellow icon and says

DNSBL is out of sync. Perform a force reload to correct.

Although I’ve already done a force reload a few times...

Also, unrelated to the above, would it be possible to allow the ability to choose your own certificate for DNSBL so that you don’t get certificate errors for the https page?

[Hugovsky]

after upgrade to latest _17, I can't open 10.10.10.1 with browser. pfBlocker seems to be working and logging fine but can't get the 10.10.10.1 page. Is it normal?

[BBcan177]

@veldkornet said in pfBlockerNG-devel feedback:

On my dashboard, DNSBL always has a yellow icon and says
DNSBL is out of sync. Perform a force reload to correct.

Although I’ve already done a force reload a few times...
Also, unrelated to the above, would it be possible to allow the ability to choose your own certificate for DNSBL so that you don’t get certificate errors for the https page?

For the Sync issue: Typically this is caused by having multiple feeds with the same "Header/Label" name. Every Header needs to be unique. Also can be caused if you have a duplicated Feed.

For the Certificate errors, you can fix this in pfBlockerNG-devel, see here:
https://forum.netgate.com/topic/136302/is-hiding-dnsbl-alerts-without-whitlisting-possible

[BBcan177]

@hugovsky said in pfBlockerNG-devel feedback:

after upgrade to latest _17, I can't open 10.10.10.1 with browser. pfBlocker seems to be working and logging fine but can't get the 10.10.10.1 page. Is it normal?

Any errors in the system.log when you restart the service?

What happens if you try to start it from the shell?

/usr/local/etc/rc.d/pfb_filter.sh restart

Also check the pfblockerng.log for any errors.