pfSense Plus and SG-3100

mcury

@stephenw10 said in pfSense Plus and SG-3100:

Hmm, what are you actually enabling there? The non-dev version doesn't have a wizard to set defaults. I may have disabled some things on my install. I don't use the auto-added firewall rules.

Steve

Default settings, just install it, wait for the update, or force it, then reboot..

stephenw10

By default it is not enabled at all so I assume you enable it?

There are no lists enabled by default either so I assume you added some? Or it pulled in values you already had?

Steve

mcury

@stephenw10 said in pfSense Plus and SG-3100:

By default it is not enabled at all so I assume you enable it?

There are no lists enabled by default either so I assume you added some? Or it pulled in values you already had?

Steve

Enabled pfblockerng, wait for the update.
There are lists enabled by default, didn't add anything.

Just install, enabled it, update it, and reboot, and the bug happens.
Same bug that was happening with 21.02, and this never happened with 2.4.5p1.

stephenw10

There are no lists enabled by default so it must be using lists you have in your config already. What lists do you enabled there?

ON the box I have running it without issues I have it installed mostly for ad-blocking. This is what updating looks like:

 UPDATE PROCESS START [ 03/12/21 15:05:39 ]

===[  DNSBL Process  ]================================================

[ Easylist_Default ]	 Reload . completed ..
  ----------------------------------------------------------------------
  Orig.    Unique     # Dups     # White    # Alexa    Final                
  ----------------------------------------------------------------------
  17258    16569      0          0          0          16569                
  ----------------------------------------------------------------------

[ Easylist_Privacy ]	 Reload [ 03/12/21 15:05:40 ] . completed ..
  Whitelist: amazonaws.com|
  ----------------------------------------------------------------------
  Orig.    Unique     # Dups     # White    # Alexa    Final                
  ----------------------------------------------------------------------
  4381     4355       59         1          0          4295                 
  ----------------------------------------------------------------------

[ Custom_List_custom ]	 Reload [ 03/12/21 15:05:41 ].
  ----------------------------------------------------------------------
  Orig.    Unique     # Dups     # White    # Alexa    Final                
  ----------------------------------------------------------------------
  7        7          0          0          0          7                    
  ----------------------------------------------------------------------

------------------------------------------
Assembling database... completed
Executing TLD
TLD analysis. completed
Finalizing TLD...  completed
 ----------------------------------------
 Original    Matches    Removed    Final     
 ----------------------------------------
 20871       20748      34         20837     
 -----------------------------------------
Validating database... completed [ 03/12/21 15:05:47 ]
Reloading Unbound.... completed
DNSBL update [ 20837 | PASSED  ]... completed [ 03/12/21 15:05:49 ]
------------------------------------------

===[  Continent Process  ]============================================


===[  IPv4 Process  ]=================================================

[ Spamhaus_drop ]	 Reload . completed ..

[ Google ]		 Reload . completed ..

[ Facebook ]		 Reload . completed ..

[ Netflix ]		 Reload . completed ..


===[  IPv6 Process  ]=================================================


===[  Aliastables / Rules  ]==========================================

No changes to Firewall rules, skipping Filter Reload

 Updating: pfB_Spamhaus
no changes.
 Updating: pfB_ASN_List
no changes.


Archiving Aliastable folder


Archiving selected pfBlockerNG files.

===[ FINAL Processing ]=====================================

   [ Original IP count   ]  [ 8570 ]

===[ Native List IP Counts ] ===================================

    8566 total
    7375 /var/db/pfblockerng/native/Google.txt
     956 /var/db/pfblockerng/native/Spamhaus_drop.txt
     182 /var/db/pfblockerng/native/Facebook.txt
      53 /var/db/pfblockerng/native/Netflix.txt

===[ DNSBL Domain/IP Counts ] ===================================

   20837 total
   16538 /var/db/pfblockerng/dnsbl/Easylist_Default.txt
    4293 /var/db/pfblockerng/dnsbl/Easylist_Privacy.txt
       6 /var/db/pfblockerng/dnsbl/Custom_List_custom.txt

====================[ Last Updated List Summary ]==============

Feb 25	19:01	Spamhaus_drop
Feb 27	00:00	Google
Feb 27	00:00	Facebook
Feb 27	00:00	Netflix

IPv4 alias tables IP count
-----------------------------
8566

IPv6 alias tables IP count
-----------------------------
0

Alias table IP Counts
-----------------------------
    8566 total
    7610 /var/db/aliastables/pfB_ASN_List.txt
     956 /var/db/aliastables/pfB_Spamhaus.txt

pfSense Table Stats
-------------------
table-entries hard limit  1000000
Table Usage Count         11310

 UPDATE PROCESS ENDED [ 03/12/21 15:05:57 ]

Steve

mcury

@stephenw10 Tick the option to enable pfblockerng, and update, there are lists by default, you don't need a wizard.
This will create an alias for a firewall rule in LAN with malicious IPs and etc, and that causes the problem during the boot.

stephenw10

Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.

 UPDATE PROCESS START [ 03/12/21 15:20:15 ]

Clearing all DNSBL Feeds... 
** DNSBL Disabled **


===[  Continent Process  ]============================================


===[  Aliastables / Rules  ]==========================================

No changes to Firewall rules, skipping Filter Reload
No Changes to Aliases, Skipping pfctl Update

 UPDATE PROCESS ENDED

So if you are seeing lists it's because they already exist on your config and pfBlocker is using them.

What lists do you see?

Steve

SteveITS

The PHP dump has been replicated at the command line: https://redmine.pfsense.org/issues/11466#note-21

mcury

@stephenw10 said in pfSense Plus and SG-3100:

Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.
 UPDATE PROCESS START [ 03/12/21 15:20:15 ]

Clearing all DNSBL Feeds... 
** DNSBL Disabled **


===[  Continent Process  ]============================================


===[  Aliastables / Rules  ]==========================================

No changes to Firewall rules, skipping Filter Reload
No Changes to Aliases, Skipping pfctl Update

 UPDATE PROCESS ENDED
So if you are seeing lists it's because they already exist on your config and pfBlocker is using them.

What lists do you see?

Steve

If that is the case, the same lists that pfblockerng 3.0.0_15 has, because it was the last pfblockerng version installed.

mcury

@teamits found another way to trigger it.. not sure if it's the same problem, but try:

ssh to pfsense and type:
gpioctl 2 0

stephenw10

@mcury said in pfSense Plus and SG-3100:

gpioctl 2 0

Hmm, interesting. Not the same issue though, php is not involved there:

Mar 14 13:52:52 	kernel 		pid 32606 (gpioctl), jid 0, uid 0: exited on signal 11 (core dumped)

Likely that's because the first GPIO device cannot be set like that. You can set a PWM duty there. It should not segfault though.

Steve

mcury

Any news about this issue?

#11466 latest update on 03/11/21, nobody is assigned to that task..

Searched for this PHP bug in https://bugs.php.net/ and couldn't find anything about this PHP interpreter error for ARM 32 bits and/or Freebsd..

stephenw10

Nothing specific yet I'm afraid. We are looking at it though just no-one has been assigned in Redmine. Details will be on the bug report there as we confirm them.
We have a separate internal report we use until we have something useful to add publicly.

Steve

mcury

@stephenw10 Thanks Stephen.

I didn't know about the separate internal report.

bigchimpin

I can't believe I paid almost $500 for this router lol

mcury

There is one bug that the affected version is incorrect for the SG-3100 , #11473

Luketa

I continue with version 2.4.5_1 on the SG-3100
I saw that it came out of version 21.02.2, is it stable?

I plan to update this week from 2.4.5 to 21.02.2

NOCling

My SG-3100 runs nice with 21.02.2.

mcury

Same here, didn't try snort/suricata.
Running smoothly with pfblockerng-devel 3.0.0_16

NokkieF

@mcury still experiencing same kernel alerts here

Amarand

@luketa

There was a bug, during the standard upgrade from 2.4.5 to 21.02_2 (the hot fix), where the SG-3100 hung post-install with the triple-flashing-lights.

After connecting a serial console, and verifying no output, I power cycled the SG-3100, and it came back up fine, with the 21.02_2.

I upgraded from 21.02_2 to 21.02.2 (note the _ versus the .) yesterday, and it A) upgraded fine and B) has been running fine with no issues.

Please make sure you take a look at some of the persistent plugin related bugs associated with the 21.x line that are not present in the 2.4.5 code, to make sure you won't be impacted by these bugs, before you upgrade.

Edit: the SG-3100 comes with a serial cable, which you can connect up to a computer and run a serial terminal (like PuTTY or whatever), to watch the upgrade process. I'd recommend doing this, especially from 2.x to 21.x