• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

pfSense Plus and SG-3100

Official Netgate® Hardware
31
152
43.4k
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    stephenw10 Netgate Administrator
    last edited by Mar 12, 2021, 3:07 PM

    There are no lists enabled by default so it must be using lists you have in your config already. What lists do you enabled there?

    ON the box I have running it without issues I have it installed mostly for ad-blocking. This is what updating looks like:

     UPDATE PROCESS START [ 03/12/21 15:05:39 ]
    
    ===[  DNSBL Process  ]================================================
    
    [ Easylist_Default ]	 Reload . completed ..
      ----------------------------------------------------------------------
      Orig.    Unique     # Dups     # White    # Alexa    Final                
      ----------------------------------------------------------------------
      17258    16569      0          0          0          16569                
      ----------------------------------------------------------------------
    
    [ Easylist_Privacy ]	 Reload [ 03/12/21 15:05:40 ] . completed ..
      Whitelist: amazonaws.com|
      ----------------------------------------------------------------------
      Orig.    Unique     # Dups     # White    # Alexa    Final                
      ----------------------------------------------------------------------
      4381     4355       59         1          0          4295                 
      ----------------------------------------------------------------------
    
    [ Custom_List_custom ]	 Reload [ 03/12/21 15:05:41 ].
      ----------------------------------------------------------------------
      Orig.    Unique     # Dups     # White    # Alexa    Final                
      ----------------------------------------------------------------------
      7        7          0          0          0          7                    
      ----------------------------------------------------------------------
    
    ------------------------------------------
    Assembling database... completed
    Executing TLD
    TLD analysis. completed
    Finalizing TLD...  completed
     ----------------------------------------
     Original    Matches    Removed    Final     
     ----------------------------------------
     20871       20748      34         20837     
     -----------------------------------------
    Validating database... completed [ 03/12/21 15:05:47 ]
    Reloading Unbound.... completed
    DNSBL update [ 20837 | PASSED  ]... completed [ 03/12/21 15:05:49 ]
    ------------------------------------------
    
    ===[  Continent Process  ]============================================
    
    
    ===[  IPv4 Process  ]=================================================
    
    [ Spamhaus_drop ]	 Reload . completed ..
    
    [ Google ]		 Reload . completed ..
    
    [ Facebook ]		 Reload . completed ..
    
    [ Netflix ]		 Reload . completed ..
    
    
    ===[  IPv6 Process  ]=================================================
    
    
    ===[  Aliastables / Rules  ]==========================================
    
    No changes to Firewall rules, skipping Filter Reload
    
     Updating: pfB_Spamhaus
    no changes.
     Updating: pfB_ASN_List
    no changes.
    
    
    Archiving Aliastable folder
    
    
    Archiving selected pfBlockerNG files.
    
    ===[ FINAL Processing ]=====================================
    
       [ Original IP count   ]  [ 8570 ]
    
    ===[ Native List IP Counts ] ===================================
    
        8566 total
        7375 /var/db/pfblockerng/native/Google.txt
         956 /var/db/pfblockerng/native/Spamhaus_drop.txt
         182 /var/db/pfblockerng/native/Facebook.txt
          53 /var/db/pfblockerng/native/Netflix.txt
    
    ===[ DNSBL Domain/IP Counts ] ===================================
    
       20837 total
       16538 /var/db/pfblockerng/dnsbl/Easylist_Default.txt
        4293 /var/db/pfblockerng/dnsbl/Easylist_Privacy.txt
           6 /var/db/pfblockerng/dnsbl/Custom_List_custom.txt
    
    ====================[ Last Updated List Summary ]==============
    
    Feb 25	19:01	Spamhaus_drop
    Feb 27	00:00	Google
    Feb 27	00:00	Facebook
    Feb 27	00:00	Netflix
    
    IPv4 alias tables IP count
    -----------------------------
    8566
    
    IPv6 alias tables IP count
    -----------------------------
    0
    
    Alias table IP Counts
    -----------------------------
        8566 total
        7610 /var/db/aliastables/pfB_ASN_List.txt
         956 /var/db/aliastables/pfB_Spamhaus.txt
    
    pfSense Table Stats
    -------------------
    table-entries hard limit  1000000
    Table Usage Count         11310
    
     UPDATE PROCESS ENDED [ 03/12/21 15:05:57 ]
    

    Steve

    M 1 Reply Last reply Mar 12, 2021, 3:09 PM Reply Quote 0
    • M
      mcury @stephenw10
      last edited by Mar 12, 2021, 3:09 PM

      @stephenw10 Tick the option to enable pfblockerng, and update, there are lists by default, you don't need a wizard.
      This will create an alias for a firewall rule in LAN with malicious IPs and etc, and that causes the problem during the boot.

      dead on arrival, nowhere to be found.

      S 1 Reply Last reply Mar 12, 2021, 3:22 PM Reply Quote 0
      • S
        stephenw10 Netgate Administrator
        last edited by Mar 12, 2021, 3:21 PM

        Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.

         UPDATE PROCESS START [ 03/12/21 15:20:15 ]
        
        Clearing all DNSBL Feeds... 
        ** DNSBL Disabled **
        
        
        ===[  Continent Process  ]============================================
        
        
        ===[  Aliastables / Rules  ]==========================================
        
        No changes to Firewall rules, skipping Filter Reload
        No Changes to Aliases, Skipping pfctl Update
        
         UPDATE PROCESS ENDED
        

        So if you are seeing lists it's because they already exist on your config and pfBlocker is using them.

        What lists do you see?

        Steve

        M 1 Reply Last reply Mar 12, 2021, 3:24 PM Reply Quote 0
        • S
          SteveITS Galactic Empire @mcury
          last edited by Mar 12, 2021, 3:22 PM

          The PHP dump has been replicated at the command line: https://redmine.pfsense.org/issues/11466#note-21

          Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
          When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
          Upvote 👍 helpful posts!

          M 1 Reply Last reply Mar 12, 2021, 3:35 PM Reply Quote 1
          • M
            mcury @stephenw10
            last edited by Mar 12, 2021, 3:24 PM

            @stephenw10 said in pfSense Plus and SG-3100:

            Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.

             UPDATE PROCESS START [ 03/12/21 15:20:15 ]
            
            Clearing all DNSBL Feeds... 
            ** DNSBL Disabled **
            
            
            ===[  Continent Process  ]============================================
            
            
            ===[  Aliastables / Rules  ]==========================================
            
            No changes to Firewall rules, skipping Filter Reload
            No Changes to Aliases, Skipping pfctl Update
            
             UPDATE PROCESS ENDED
            

            So if you are seeing lists it's because they already exist on your config and pfBlocker is using them.

            What lists do you see?

            Steve

            If that is the case, the same lists that pfblockerng 3.0.0_15 has, because it was the last pfblockerng version installed.

            dead on arrival, nowhere to be found.

            1 Reply Last reply Reply Quote 0
            • M
              mcury @SteveITS
              last edited by Mar 12, 2021, 3:35 PM

              @teamits found another way to trigger it.. not sure if it's the same problem, but try:

              ssh to pfsense and type:
              gpioctl 2 0

              dead on arrival, nowhere to be found.

              1 Reply Last reply Reply Quote 0
              • S
                stephenw10 Netgate Administrator
                last edited by Mar 14, 2021, 1:58 PM

                @mcury said in pfSense Plus and SG-3100:

                gpioctl 2 0

                Hmm, interesting. Not the same issue though, php is not involved there:

                Mar 14 13:52:52 	kernel 		pid 32606 (gpioctl), jid 0, uid 0: exited on signal 11 (core dumped) 
                

                Likely that's because the first GPIO device cannot be set like that. You can set a PWM duty there. It should not segfault though.

                Steve

                M 1 Reply Last reply Mar 24, 2021, 3:03 PM Reply Quote 1
                • M
                  mcury @stephenw10
                  last edited by Mar 24, 2021, 3:03 PM

                  Any news about this issue?

                  🔒 Log in to view

                  #11466 latest update on 03/11/21, nobody is assigned to that task..

                  Searched for this PHP bug in https://bugs.php.net/ and couldn't find anything about this PHP interpreter error for ARM 32 bits and/or Freebsd..

                  dead on arrival, nowhere to be found.

                  1 Reply Last reply Reply Quote 1
                  • S
                    stephenw10 Netgate Administrator
                    last edited by Mar 24, 2021, 9:51 PM

                    Nothing specific yet I'm afraid. We are looking at it though just no-one has been assigned in Redmine. Details will be on the bug report there as we confirm them.
                    We have a separate internal report we use until we have something useful to add publicly.

                    Steve

                    M 1 Reply Last reply Mar 24, 2021, 9:55 PM Reply Quote 1
                    • M
                      mcury @stephenw10
                      last edited by Mar 24, 2021, 9:55 PM

                      @stephenw10 Thanks Stephen.

                      I didn't know about the separate internal report.

                      dead on arrival, nowhere to be found.

                      B 1 Reply Last reply Mar 25, 2021, 3:53 PM Reply Quote 0
                      • B
                        bigchimpin Banned @mcury
                        last edited by Mar 25, 2021, 3:53 PM

                        I can't believe I paid almost $500 for this router lol

                        M 1 Reply Last reply Mar 26, 2021, 2:38 PM Reply Quote 1
                        • M
                          mcury @bigchimpin
                          last edited by Mar 26, 2021, 2:38 PM

                          There is one bug that the affected version is incorrect for the SG-3100 , #11473

                          dead on arrival, nowhere to be found.

                          1 Reply Last reply Reply Quote 0
                          • LuketaL
                            Luketa
                            last edited by Apr 22, 2021, 5:07 PM

                            I continue with version 2.4.5_1 on the SG-3100
                            I saw that it came out of version 21.02.2, is it stable?

                            I plan to update this week from 2.4.5 to 21.02.2

                            M AmarandA 2 Replies Last reply Apr 22, 2021, 5:25 PM Reply Quote 1
                            • N
                              NOCling
                              last edited by Apr 22, 2021, 5:13 PM

                              My SG-3100 runs nice with 21.02.2.

                              Netgate 6100 & Netgate 2100

                              B 1 Reply Last reply Apr 25, 2021, 6:38 PM Reply Quote 1
                              • M
                                mcury @Luketa
                                last edited by mcury Apr 22, 2021, 5:25 PM Apr 22, 2021, 5:25 PM

                                Same here, didn't try snort/suricata.
                                Running smoothly with pfblockerng-devel 3.0.0_16

                                dead on arrival, nowhere to be found.

                                N 1 Reply Last reply Apr 22, 2021, 5:27 PM Reply Quote 1
                                • N
                                  NokkieF @mcury
                                  last edited by Apr 22, 2021, 5:27 PM

                                  @mcury still experiencing same kernel alerts here

                                  M 1 Reply Last reply Apr 22, 2021, 5:32 PM Reply Quote 0
                                  • AmarandA
                                    Amarand @Luketa
                                    last edited by Amarand Apr 22, 2021, 5:31 PM Apr 22, 2021, 5:29 PM

                                    @luketa

                                    There was a bug, during the standard upgrade from 2.4.5 to 21.02_2 (the hot fix), where the SG-3100 hung post-install with the triple-flashing-lights.

                                    After connecting a serial console, and verifying no output, I power cycled the SG-3100, and it came back up fine, with the 21.02_2.

                                    I upgraded from 21.02_2 to 21.02.2 (note the _ versus the .) yesterday, and it A) upgraded fine and B) has been running fine with no issues.

                                    Please make sure you take a look at some of the persistent plugin related bugs associated with the 21.x line that are not present in the 2.4.5 code, to make sure you won't be impacted by these bugs, before you upgrade.

                                    Edit: the SG-3100 comes with a serial cable, which you can connect up to a computer and run a serial terminal (like PuTTY or whatever), to watch the upgrade process. I'd recommend doing this, especially from 2.x to 21.x

                                    1 Reply Last reply Reply Quote 1
                                    • M
                                      mcury @NokkieF
                                      last edited by Apr 22, 2021, 5:32 PM

                                      @nokkief Can you share more details about your setup?
                                      I've been testing for about 4 days, trying to crash the SG-3100 with high loads, and it seems to be pretty stable..

                                      Are you using suricata/snort ?
                                      Are you using pfblockerng-devel_3.0.0_16, and if so, what feeds?

                                      dead on arrival, nowhere to be found.

                                      N 1 Reply Last reply Apr 22, 2021, 5:39 PM Reply Quote 1
                                      • N
                                        NokkieF @mcury
                                        last edited by Apr 22, 2021, 5:39 PM

                                        @mcury
                                        I am seeing this:

                                        2021-04-22 19:30:04.062460+02:00 	kernel 	- 	pid 73327 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
                                        2021-04-22 19:15:03.967524+02:00 	kernel 	- 	pid 27459 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
                                        2021-04-22 19:00:03.889566+02:00 	kernel 	- 	pid 8141 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
                                        2021-04-22 18:45:04.012638+02:00 	kernel 	- 	pid 56654 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
                                        2021-04-22 18:30:03.934697+02:00 	kernel 	- 	pid 48931 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
                                        2021-04-22 18:15:04.057781+02:00 	kernel 	- 	pid 94150 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
                                        2021-04-22 18:02:36.622513+02:00 	php 	25838 	[pfBlockerNG] No changes to Firewall rules, skipping Filter Reload
                                        2021-04-22 18:00:04.180824+02:00 	kernel 	- 	pid 25987 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
                                        2021-04-22 18:00:01.142905+02:00 	php 	25838 	[pfBlockerNG] Starting cron process.
                                        2021-04-22 17:45:04.303922+02:00 	kernel 	- 	pid 79696 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) ```
                                        code_text
                                        

                                        I am running the following packages
                                        acme security 0.6.9_3
                                        haproxy net 0.61_1
                                        pfBlockerNG-devel net 3.0.0_16

                                        Not sure how I can easily retrieve the lists I am using, but I am using quite a few.

                                        M 1 Reply Last reply Apr 22, 2021, 5:48 PM Reply Quote 0
                                        • M
                                          mcury @NokkieF
                                          last edited by Apr 22, 2021, 5:48 PM

                                          @nokkief Those are the same errors I was getting before.
                                          I'm suspecting that the number of feeds is causing the crash.

                                          I would like to suggest you to remove pfblockerng-devel completely and reinstall.
                                          There is an option "keep settings" in pfblocker that you shouldn't tick before package removal.

                                          After that, save the pfsense xml configuration, edit it and confirm that there isn't a single entry for pfblockerng...
                                          I'm saying this because the 'old feeds' from previous versions remained in my XML configuration.

                                          After removing all the pfblockerng entries in xml, restore it, then reinstall pfblockerng.

                                          I did add dnsbl_easylists feed after the wizard, for me it is enough.
                                          You should add one feed at a time to test..

                                          🔒 Log in to view

                                          dead on arrival, nowhere to be found.

                                          N 1 Reply Last reply Apr 25, 2021, 12:08 PM Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.