Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense Plus and SG-3100

    Scheduled Pinned Locked Moved Official Netgate® Hardware
    152 Posts 31 Posters 48.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mcury @stephenw10
      last edited by

      @stephenw10 Thanks Stephen.

      I didn't know about the separate internal report.

      dead on arrival, nowhere to be found.

      B 1 Reply Last reply Reply Quote 0
      • B
        bigchimpin Banned @mcury
        last edited by

        I can't believe I paid almost $500 for this router lol

        M 1 Reply Last reply Reply Quote 1
        • M
          mcury @bigchimpin
          last edited by

          There is one bug that the affected version is incorrect for the SG-3100 , #11473

          dead on arrival, nowhere to be found.

          1 Reply Last reply Reply Quote 0
          • LuketaL
            Luketa
            last edited by

            I continue with version 2.4.5_1 on the SG-3100
            I saw that it came out of version 21.02.2, is it stable?

            I plan to update this week from 2.4.5 to 21.02.2

            M AmarandA 2 Replies Last reply Reply Quote 1
            • N
              NOCling
              last edited by

              My SG-3100 runs nice with 21.02.2.

              Netgate 6100 & Netgate 2100

              B 1 Reply Last reply Reply Quote 1
              • M
                mcury @Luketa
                last edited by mcury

                Same here, didn't try snort/suricata.
                Running smoothly with pfblockerng-devel 3.0.0_16

                dead on arrival, nowhere to be found.

                N 1 Reply Last reply Reply Quote 1
                • N
                  NokkieF @mcury
                  last edited by

                  @mcury still experiencing same kernel alerts here

                  M 1 Reply Last reply Reply Quote 0
                  • AmarandA
                    Amarand @Luketa
                    last edited by Amarand

                    @luketa

                    There was a bug, during the standard upgrade from 2.4.5 to 21.02_2 (the hot fix), where the SG-3100 hung post-install with the triple-flashing-lights.

                    After connecting a serial console, and verifying no output, I power cycled the SG-3100, and it came back up fine, with the 21.02_2.

                    I upgraded from 21.02_2 to 21.02.2 (note the _ versus the .) yesterday, and it A) upgraded fine and B) has been running fine with no issues.

                    Please make sure you take a look at some of the persistent plugin related bugs associated with the 21.x line that are not present in the 2.4.5 code, to make sure you won't be impacted by these bugs, before you upgrade.

                    Edit: the SG-3100 comes with a serial cable, which you can connect up to a computer and run a serial terminal (like PuTTY or whatever), to watch the upgrade process. I'd recommend doing this, especially from 2.x to 21.x

                    1 Reply Last reply Reply Quote 1
                    • M
                      mcury @NokkieF
                      last edited by

                      @nokkief Can you share more details about your setup?
                      I've been testing for about 4 days, trying to crash the SG-3100 with high loads, and it seems to be pretty stable..

                      Are you using suricata/snort ?
                      Are you using pfblockerng-devel_3.0.0_16, and if so, what feeds?

                      dead on arrival, nowhere to be found.

                      N 1 Reply Last reply Reply Quote 1
                      • N
                        NokkieF @mcury
                        last edited by

                        @mcury
                        I am seeing this:

                        2021-04-22 19:30:04.062460+02:00 	kernel 	- 	pid 73327 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
2021-04-22 19:15:03.967524+02:00 	kernel 	- 	pid 27459 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
2021-04-22 19:00:03.889566+02:00 	kernel 	- 	pid 8141 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
2021-04-22 18:45:04.012638+02:00 	kernel 	- 	pid 56654 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
2021-04-22 18:30:03.934697+02:00 	kernel 	- 	pid 48931 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
2021-04-22 18:15:04.057781+02:00 	kernel 	- 	pid 94150 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
2021-04-22 18:02:36.622513+02:00 	php 	25838 	[pfBlockerNG] No changes to Firewall rules, skipping Filter Reload
2021-04-22 18:00:04.180824+02:00 	kernel 	- 	pid 25987 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)
2021-04-22 18:00:01.142905+02:00 	php 	25838 	[pfBlockerNG] Starting cron process.
2021-04-22 17:45:04.303922+02:00 	kernel 	- 	pid 79696 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) ```
code_text

                        I am running the following packages
                        acme security 0.6.9_3
                        haproxy net 0.61_1
                        pfBlockerNG-devel net 3.0.0_16

                        Not sure how I can easily retrieve the lists I am using, but I am using quite a few.

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          mcury @NokkieF
                          last edited by

                          @nokkief Those are the same errors I was getting before.
                          I'm suspecting that the number of feeds is causing the crash.

                          I would like to suggest you to remove pfblockerng-devel completely and reinstall.
                          There is an option "keep settings" in pfblocker that you shouldn't tick before package removal.

                          After that, save the pfsense xml configuration, edit it and confirm that there isn't a single entry for pfblockerng...
                          I'm saying this because the 'old feeds' from previous versions remained in my XML configuration.

                          After removing all the pfblockerng entries in xml, restore it, then reinstall pfblockerng.

                          I did add dnsbl_easylists feed after the wizard, for me it is enough.
                          You should add one feed at a time to test..

                          b89aac5b-07f3-4105-8daa-192f6f8ebe2d-image.png

                          dead on arrival, nowhere to be found.

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            NokkieF
                            last edited by

                            Thanks, I will give it a go later. See if I can make them go away. It might also be haproxy, but it might be worth a shot trying

                            1 Reply Last reply Reply Quote 1
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Yes, this looks like it's almost certainly php choking on a large list parsing function for as yet unknown reasons. Loading fewer or smaller lists in pfBlocker will likely avoid it.

                              1 Reply Last reply Reply Quote 2
                              • N
                                NokkieF @mcury
                                last edited by

                                @mcury the pfsense config you refer to the one in /conf?

                                N M 2 Replies Last reply Reply Quote 0
                                • N
                                  NokkieF @NokkieF
                                  last edited by

                                  I reinstalled the pfBlocker. I though I cleaned it out pretty well, but it still picked up the PRI1 list (I do not remember this being automatic anyways). So far I do not see any issues in the logging. so it looks good so far. I will give an update later if I see any php errors.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    mcury @NokkieF
                                    last edited by mcury

                                    @nokkief I saved the xml through the GUI settings:

                                    @mcury the pfsense config you refer to the one in /conf?

                                    f195b9bf-941f-48c9-97bc-f573ec3a2065-image.png

                                    Save the XML, edit it and search for pfblockerng

                                    You will find a few of these:

                                    			<config>
				<aliasname>ADs_Basic</aliasname>
				<description><![CDATA[ADs Basic - Collection of ADvertisement Domain Feeds.]]></description>
				<row>
					<format>auto</format>
					<state><![CDATA[Enabled]]></state>
					<url>https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts</url>
					<header>StevenBlack_ADs</header>
				</row>
				<action>unbound</action>
				<cron>EveryDay</cron>
				<logging>enabled</logging>
				<order>default</order>
				<dow>1</dow>
			</config>
			<config>
				<aliasname>EasyList</aliasname>
				<description><![CDATA[EasyList Feeds - Utilizing only the domains which are listed to be blocked in full.]]></description>
				<action>unbound</action>
				<cron>EveryDay</cron>
				<dow>1</dow>
				<sort>sort</sort>
				<logging>enabled</logging>
				<order>default</order>
				<filter_alexa></filter_alexa>
				<custom></custom>
				<row>
					<format>auto</format>
					<state><![CDATA[Enabled]]></state>
					<url>https://easylist-downloads.adblockplus.org/easylist_noelemhide.txt</url>
					<header>EasyList</header>
				</row>
				<row>
					<format>auto</format>
					<state><![CDATA[Enabled]]></state>
					<url>https://easylist-downloads.adblockplus.org/easylistportuguese.txt</url>
					<header>EasyList_Portuguese</header>
				</row>
				<row>
					<format>auto</format>
					<state><![CDATA[Enabled]]></state>
					<url>https://easylist.to/easylist/easyprivacy.txt</url>
					<header>EasyPrivacy</header>
				</row>
			</config>
		</pfblockerngdnsbl>

                                    Remove the pfblockernng package without the `keep settings' option.
                                    Remove everything related to pfblockerng from the XML file, and then restore the config to the firewall through the GUI, this will clean all the feeds from the config.

                                    Note: It will take a few minutes to complete, your internet will be down during this period.

                                    Once the config restore/boot completes, install pfblockerng again, run the wizard, and add a few feeds you like, but don't add too many feeds..

                                    I reinstalled the pfBlocker. I though I cleaned it out pretty well, but it still picked up the PRI1 list

                                    PRI1 is OK to have, it's installed during the wizard in 3.0.0_16

                                    I'm using the following lists: (I added Easylist manually, it isn't there by default).

                                    2597e2f7-3bc5-44b9-a5a9-c4494ff1948b-image.png

                                    8ed4508a-cd18-4a30-bfd1-4f2ee560021e-image.png

                                    e1ad1a84-695e-4998-944d-2eecd7d032b5-image.png

                                    dead on arrival, nowhere to be found.

                                    N 1 Reply Last reply Reply Quote 1
                                    • N
                                      NokkieF @mcury
                                      last edited by

                                      @mcury thanks for the help, i am not seeing the php errors anymore. :)

                                      N 2 Replies Last reply Reply Quote 1
                                      • N
                                        NokkieF @NokkieF
                                        last edited by

                                        Can I change the maximum memory consumption for php somewhere? Seems the 3100 has plenty of memory left for some more lists?

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          NokkieF @NokkieF
                                          last edited by

                                          I sadly was wrong, just did not pay well enough attention (and probably was hoping it was fixed). I still see the errors every 15 minutes.

                                          M 1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Unfortunately this is not directly a memory issue that could be solved like that as I understand it.

                                            artooroA 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.