pfSense Plus and SG-3100
-
I saw the same behavior on my SG-3100. Ive downgraded to 2.4.5p1 for now, as not only hard hard reboots required when it locks up, but there are no packages available on this device at this time for the 21.02 branch. I suggest downgrading, and waiting till there is a fixed, stable update released. Im sure Netgate/pFsense will resolve this quickly for us on the SG-3100/1000 platform soon.
-
I had the same behavior, ended up wiping and installing from scratch, but has already locked up once since doing that as well.
Now I don't only have a system that's prone to crashing, but I cannot install any packages either. SG-3100 has to be one of their most popular devices, how did this make it out of testing?!
-
In 2.4.5p1? If so that's something unrelated.
If you re-installed 21.02 you will hit this if you have high traffic and something is reloading the filter unless you apply the single CPU core workaround.
We are testing the fixed images now.
Steve
-
I’m running the newest 21.05 images and the rule counters are broken and in this latest update it looks like UPnP doesn’t work anymore. Have you guys experienced this?
I guess this only matters if that’s the images you guys are testing.
-
I'm running fine now on 21.02 with the 1 cpu fix mentioned above. Only issue I see is slower throughput on my wireguard connection. No lockups for 27 hours so far.
-
@behemyth Yes 21.05 is the equivalent of 2.6. It's head effectively, anything could be broken!
The images we are testing are purely for this fix. Looking good so far.
Steve
-
@stephenw10 some clarity if you do not mind. The fix isnt a fix, it's a workaround, correct. When will the real fix be completed...a week..a month etc.
-
No, it's a real fix. See: https://reviews.freebsd.org/D28821
-
@stephenw10 said in pfSense Plus and SG-3100:
https://reviews.freebsd.org/D28821
i guess i'm just a little confused then. Is the fix going to degrade performance if we're limiting the hardware cpu cores? Do we need to reapproach our load on a 3100 with these changes?
-
No, the temporary workaround was to disable one CPU core. That is not required with the fix that is now in 21.02p1.
Steve
-
@stephenw10 Do we remove that line from the config before or after applying the patch? Want the update to go as flawless as possible.
-
@flsnowbird said in pfSense Plus and SG-3100:
@stephenw10 Do we remove that line from the config before or after applying the patch? Want the update to go as flawless as possible.
I did it before
Then did the update, then rebooted the firewall so the limitation were not in place -
Yes, you could do either but you will need to reboot after removing it since that is applied as a loader variable at boot.
Steve
-
@stephenw10 It would be nice if you could explain in any detail what the problem is/was. I just purchased an SG3100 and I got no emailed warning about any potential issue either (would be nice really).
That said I answered the upgrade survey not knowing all that was meant by the upgrade to pfsense+. If you're going to make a really good firewall product in terms of control panel / GUI and work process you should get your hands on Microsoft's ISA firewall from some time ago. I don't know why the product disappeared but it was the best gateway/firewall/router I've ever used. I looked for a reasonable replacement and found pfsense to be the next best thing but you guys still don't measure up to something from 15 or so years ago. ;0)
Now that you're on a serious commercial product path that is what I'd look from you guys.
-
@fg said in pfSense Plus and SG-3100:
explain in any detail what the problem is/was
https://www.netgate.com/blog/pfsense-obscure-bugs-and-code-wizards.html
-
@teamits Wonderful blog explanation. Been a long time since I debugged code, and I enjoyed the description of the "hunt." Kudos to the Netgate team for a superb job.
-
This same bug was in 2.5 DEVEL and I reported it to support, but was only told to revert to 2.4 stable. I guess I was just too exited about wireguard. Next big upgrade I'm waiting a few weeks before jumping on it.
