Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense Plus and SG-3100

    Official Netgate® Hardware
    31
    152
    43.4k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mcury @Amarand
      last edited by

      @amarand said in pfSense Plus and SG-3100:

      @mcury said in pfSense Plus and SG-3100:

      @luketa said in pfSense Plus and SG-3100:

      Hey guys, how is the SG3100 on v 21.02_1, is it stable?

      I intend to update this weekend.

      It's stable..
      There are problems with packages like pfblockerng, snot/suricata, so I wouldn't recommend you to upgrade in case you use these packages.
      Also, there are some problems with IPsec, and a few patches were released to address these issues.

      Patches that I found so far that can help you with IPsec/Openvpn
      https://forum.netgate.com/post/971136

      Were those issues caused by the major jump to 21.02 or the hotfix itself (21.02_1)?

      Netgate worked hard to fix the issues with 21.02, and it is fixed..
      This issue with 21.02 was triggered by filter reloads during high load.

      The problem with the packages mentioned above was happening with 21.02, and persists on 21.02p1
      There are a few redmine bug reports being worked on..

      dead on arrival, nowhere to be found.

      1 Reply Last reply Reply Quote 0
      • LuketaL
        Luketa @mcury
        last edited by

        @mcury
        sad to know that, I use snort and pfblocker, I really won't be able to update, thanks for the information.

        1 Reply Last reply Reply Quote 0
        • C
          CyberDude6
          last edited by

          Not sure if I did something wrong but my SG-3100 just hangs there with the three blinking lights. I thought this was fixed but I guess not. Console cable connection on putty shows just a bunch of dots, pretty much constantly. Any ideas?

          AmarandA 1 Reply Last reply Reply Quote 0
          • AmarandA
            Amarand @CyberDude6
            last edited by

            @cyberdude6 said in pfSense Plus and SG-3100:

            Not sure if I did something wrong but my SG-3100 just hangs there with the three blinking lights. I thought this was fixed but I guess not. Console cable connection on putty shows just a bunch of dots, pretty much constantly. Any ideas?

            If the dots are still outputting, wait until they cease. That might be an indication that it’s still writing the latest update?

            Once there’s no output, if you still have three blinking lights, you can power cycle.

            I would not power cycle if there were any indication of activity on the console.

            1 Reply Last reply Reply Quote 1
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Did you have the console connected up before it rebooted? Any idea what the last it showed was before dots?

              Continuous single dots like that is not part of any update I would expect. Sounds like it's waiting for something maybe.

              Steve

              C 1 Reply Last reply Reply Quote 0
              • C
                CyberDude6 @stephenw10
                last edited by

                @stephenw10

                I ended up just leaving the SG3100 there and came back a few hours later. It ended up stopping that nonsense and went to the normal menu to do all the usual things. Was able to factory restore there and it is working well now!

                1 Reply Last reply Reply Quote 3
                • A
                  amarcino
                  last edited by

                  I use both PF Blocker and Suricata, so I am going to wait on this update.

                  LuketaL 1 Reply Last reply Reply Quote 1
                  • LuketaL
                    Luketa @amarcino
                    last edited by

                    @amarcino I'm in the same situation.
                    because of things, I think I will stay for a long time in 2.4.5

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      The PHP issue, which is what you will be hitting with pfBlocker and Suricata, seems to be very load dependent.
                      I have both those running here on SG-3100s in 21.02p1 without any problems. The throughput on the those is not huge and I don't have a large number of lists loaded though.

                      Steve

                      M 1 Reply Last reply Reply Quote 1
                      • M
                        mcury @stephenw10
                        last edited by

                        @stephenw10 said in pfSense Plus and SG-3100:

                        The PHP issue, which is what you will be hitting with pfBlocker and Suricata, seems to be very load dependent.
                        I have both those running here on SG-3100s in 21.02p1 without any problems. The throughput on the those is not huge and I don't have a large number of lists loaded though.

                        Steve

                        Hello Steve, if you install pfblockerng, run the wizard, and reboot, you get:

                        done.
Configuring firewall.
pflog0: promiscuous mode enabled
pid 401 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
Segmentation fault (core dumped)
Starting CRON... done.
 Starting package IPsec Profile Wizard...done.
 Starting package AWS VPC Wizard...done.
 Starting package acme...done.

                        Nothing works, to recover access, you need, through the console, select the option 11, disable pfblockerng and reboot again.

                        dead on arrival, nowhere to be found.

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Hmm, interesting. I aleady had it installed before the upgrade. And the wizard is only in the development version which I'm not running on that firewall.
                          Are you able to install the non-dev version?

                          Steve

                          M 1 Reply Last reply Reply Quote 0
                          • M
                            mcury @stephenw10
                            last edited by mcury

                            @stephenw10 said in pfSense Plus and SG-3100:

                            Hmm, interesting. I aleady had it installed before the upgrade. And the wizard is only in the development version which I'm not running on that firewall.
                            Are you able to install the non-dev version?

                            Steve

                            Yes, I can do it right now to confirm, but, as I have been reading everything about this lately, I already found reports from users with the same problem using the non-dev version.

                            f7609d69-bb01-4f4e-ba50-ebaf2e439c5e-image.png

                            Installed pfblockerng non-dev, enabled it, I'll wait for the update, then reboot, updates soon.

                            dead on arrival, nowhere to be found.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              It certainly can hit that same issue in the non-dev version if you have a lot of lists loaded triggering the issue when php tries to parse them.

                              M 1 Reply Last reply Reply Quote 0
                              • M
                                mcury @stephenw10
                                last edited by

                                @stephenw10 said in pfSense Plus and SG-3100:

                                It certainly can hit that same issue in the non-dev version if you have a lot of lists loaded triggering the issue when php tries to parse them.

                                Same lists that I used to have in 2.4.5p1, are failing with 21.02, and 21.02p1.
                                I usually just run pfblockerng defaults settings to test, and it fails to boot..

                                dead on arrival, nowhere to be found.

                                M 1 Reply Last reply Reply Quote 0
                                • M
                                  mcury @mcury
                                  last edited by

                                  bebdd0f5-dbe6-4dc7-aecc-5ab5e8b1e69e-image.png

                                  non-dev version, default settings.

                                  dead on arrival, nowhere to be found.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Hmm, what are you actually enabling there? The non-dev version doesn't have a wizard to set defaults. I may have disabled some things on my install. I don't use the auto-added firewall rules.

                                    Steve

                                    M 1 Reply Last reply Reply Quote 0
                                    • M
                                      mcury @stephenw10
                                      last edited by

                                      @stephenw10 said in pfSense Plus and SG-3100:

                                      Hmm, what are you actually enabling there? The non-dev version doesn't have a wizard to set defaults. I may have disabled some things on my install. I don't use the auto-added firewall rules.

                                      Steve

                                      Default settings, just install it, wait for the update, or force it, then reboot..

                                      dead on arrival, nowhere to be found.

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        By default it is not enabled at all so I assume you enable it?

                                        There are no lists enabled by default either so I assume you added some? Or it pulled in values you already had?

                                        Steve

                                        M 1 Reply Last reply Reply Quote 0
                                        • M
                                          mcury @stephenw10
                                          last edited by

                                          @stephenw10 said in pfSense Plus and SG-3100:

                                          By default it is not enabled at all so I assume you enable it?

                                          There are no lists enabled by default either so I assume you added some? Or it pulled in values you already had?

                                          Steve

                                          Enabled pfblockerng, wait for the update.
                                          There are lists enabled by default, didn't add anything.

                                          Just install, enabled it, update it, and reboot, and the bug happens.
                                          Same bug that was happening with 21.02, and this never happened with 2.4.5p1.

                                          dead on arrival, nowhere to be found.

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            There are no lists enabled by default so it must be using lists you have in your config already. What lists do you enabled there?

                                            ON the box I have running it without issues I have it installed mostly for ad-blocking. This is what updating looks like:

                                             UPDATE PROCESS START [ 03/12/21 15:05:39 ]

===[  DNSBL Process  ]================================================

[ Easylist_Default ]	 Reload . completed ..
  ----------------------------------------------------------------------
  Orig.    Unique     # Dups     # White    # Alexa    Final                
  ----------------------------------------------------------------------
  17258    16569      0          0          0          16569                
  ----------------------------------------------------------------------

[ Easylist_Privacy ]	 Reload [ 03/12/21 15:05:40 ] . completed ..
  Whitelist: amazonaws.com|
  ----------------------------------------------------------------------
  Orig.    Unique     # Dups     # White    # Alexa    Final                
  ----------------------------------------------------------------------
  4381     4355       59         1          0          4295                 
  ----------------------------------------------------------------------

[ Custom_List_custom ]	 Reload [ 03/12/21 15:05:41 ].
  ----------------------------------------------------------------------
  Orig.    Unique     # Dups     # White    # Alexa    Final                
  ----------------------------------------------------------------------
  7        7          0          0          0          7                    
  ----------------------------------------------------------------------

------------------------------------------
Assembling database... completed
Executing TLD
TLD analysis. completed
Finalizing TLD...  completed
 ----------------------------------------
 Original    Matches    Removed    Final     
 ----------------------------------------
 20871       20748      34         20837     
 -----------------------------------------
Validating database... completed [ 03/12/21 15:05:47 ]
Reloading Unbound.... completed
DNSBL update [ 20837 | PASSED  ]... completed [ 03/12/21 15:05:49 ]
------------------------------------------

===[  Continent Process  ]============================================


===[  IPv4 Process  ]=================================================

[ Spamhaus_drop ]	 Reload . completed ..

[ Google ]		 Reload . completed ..

[ Facebook ]		 Reload . completed ..

[ Netflix ]		 Reload . completed ..


===[  IPv6 Process  ]=================================================


===[  Aliastables / Rules  ]==========================================

No changes to Firewall rules, skipping Filter Reload

 Updating: pfB_Spamhaus
no changes.
 Updating: pfB_ASN_List
no changes.


Archiving Aliastable folder


Archiving selected pfBlockerNG files.

===[ FINAL Processing ]=====================================

   [ Original IP count   ]  [ 8570 ]

===[ Native List IP Counts ] ===================================

    8566 total
    7375 /var/db/pfblockerng/native/Google.txt
     956 /var/db/pfblockerng/native/Spamhaus_drop.txt
     182 /var/db/pfblockerng/native/Facebook.txt
      53 /var/db/pfblockerng/native/Netflix.txt

===[ DNSBL Domain/IP Counts ] ===================================

   20837 total
   16538 /var/db/pfblockerng/dnsbl/Easylist_Default.txt
    4293 /var/db/pfblockerng/dnsbl/Easylist_Privacy.txt
       6 /var/db/pfblockerng/dnsbl/Custom_List_custom.txt

====================[ Last Updated List Summary ]==============

Feb 25	19:01	Spamhaus_drop
Feb 27	00:00	Google
Feb 27	00:00	Facebook
Feb 27	00:00	Netflix

IPv4 alias tables IP count
-----------------------------
8566

IPv6 alias tables IP count
-----------------------------
0

Alias table IP Counts
-----------------------------
    8566 total
    7610 /var/db/aliastables/pfB_ASN_List.txt
     956 /var/db/aliastables/pfB_Spamhaus.txt

pfSense Table Stats
-------------------
table-entries hard limit  1000000
Table Usage Count         11310

 UPDATE PROCESS ENDED [ 03/12/21 15:05:57 ]

                                            Steve

                                            M 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.